DHL phish with virus attachment from Romania

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 02 Jul 2022 07:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1o7dMo-000JWv-Uz

for dave@doctor.nl2k.ab.ca;

Sat, 02 Jul 2022 07:40:58 -0600

Resent-From: The Doctor

Resent-Date: Sat, 2 Jul 2022 07:40:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [84.234.98.211] (port=51688 helo=doctor.nl2k.ab.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1o7VMC-0000M5-Ma

for doctor@doctor.nl2k.ab.ca;

Fri, 01 Jul 2022 23:07:53 -0600

From: express.dhl.package@dhl.ca

To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?B?4pyIIFNoaXBtZW50IE5vdGlmaWNhdGlvbiA2NTQwNjc0MjIx?=

Date: 02 Jul 2022 09:07:30 -0700

Message-ID: <20220702090730.04F5E0523F52B230@dhl.ca>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




w3.org/TR/html4/loose.dtd">










uropean)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetic=

a Neue", sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=

: none; FONT-WEIGHT: 400; COLOR: rgb(32,31,30); FONT-STYLE: normal; ORPHANS=

: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255);=

TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: norma=

l; -webkit-text-stroke-width: 0px;=20

text-decoration-style: initial; text-decoration-color: initial; text-decora=

tion-thickness: initial'>


i, Helvetica, sans-serif; BORDER-RIGHT-WIDTH: 0px; VERTICAL-ALIGN: baseline=

; WHITE-SPACE: normal; BORDER-BOTTOM-WIDTH: 0px; WORD-SPACING: 0px; TEXT-TR=

ANSFORM: none; FLOAT: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); PADDING-BO=

TTOM: 0px; FONT-STYLE: normal; PADDING-TOP: 0px; PADDING-LEFT: 0px; ORPHANS=

: 2; WIDOWS: 2; MARGIN: 0px; DISPLAY: inline !important; LETTER-SPACING: no=

rmal; PADDING-RIGHT: 0px; BORDER-TOP-WIDTH: 0px;=20

BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligature=

s: normal; font-variant-caps: normal; text-decoration-style: initial; text-=

decoration-color: initial; font-variant-numeric: inherit; font-variant-east=

-asian: inherit; font-stretch: inherit">


ONT-SIZE: 13px; MAX-WIDTH: 100%; HEIGHT: auto; FONT-FAMILY: Helvetica, Aria=

l, sans-serif; BORDER-RIGHT-WIDTH: 0px; VERTICAL-ALIGN: baseline; WHITE-SPA=

CE: normal; BORDER-BOTTOM-WIDTH: 0px; WORD-SPACING: 0px; MIN-WIDTH: auto; T=

EXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(102,102,102); PADDING-BOT=

TOM: 0px; FONT-STYLE: normal; PADDING-TOP: 0px; PADDING-LEFT: 0px; MIN-HEIG=

HT: auto; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px;=20

LETTER-SPACING: normal; PADDING-RIGHT: 0px; BORDER-TOP-WIDTH: 0px; TEXT-IND=

ENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webki=

t-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-c=

olor: initial; text-decoration-thickness: initial; font-variant-numeric: in=

herit; font-variant-east-asian: inherit; font-stretch: inherit" border=3D0 =

hspace=3D0 alt=3D""=20

src=3D"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIYAAAAqCAYAAAB2pyMEAA=

AAAXNSR0IArs4c6QAAA1FJREFUeF7tmkFqFUEQhisICkIgIAgGBFdZCILgAfQCegBdi3svIF7Af=

XCtB9ADqHtdCYKuBCGCIASyEAWJ/IQmnaZnXv1dNTPYU7N8dHVX/fV1dU3P2zp+L8cSTyhQKLAV=

YAQTNQUCjOCiqkCAEWAEGMGAXoGoGHqtVjUywFhVuvXBBhh6rVY1MsBYVbr1wQYYeq1WNTLAWFW=

69cEGGHqtVjUywFhVuvXBzgrG16ciP1/rnWsZeW5bZOeOyO5DkfO74zP8eCny7Zl+lRuvzs559E=

Hky6M2e9jBXvtcfSxy+b52tH3cbGCwIlpDAyDXXwzD8edA5NMDkb9HupXKxFjsWSC3b4ns7ev89=

Bo1CxisiF7BAY6bb+qzMTu2lphWe1aLTYB7aVXOMwsYjIjegWKnI

%0AbH5wxxptcS02gMK2DJHSM1/b41q800OBiPiFAGXRwB7pHn2FawWl+6KXHsyhSqb55wcDGZ3b=

Hb3ZMSvz/qmMQeDLeOoNDu3z3p18LytL/kf+oo80snBqCUbCTp8K3L4TodC2Xhpj6byGNDa6bwa=

H5X3JSyQS/UVi4PBlNSy8WN2Xn4+M2tawbACuVRfsSgYTGJLgZmdl5/PbF9hBcMC5JJ9xWJgMIm=

Fk+XO0e56Sxm3QpH3NCyQ8BvN5qaLOauPGvtZewzmjB/aOZpm9sKVU3EB4+/vGil8xuSvxuzaud=

8+3rTPMghGahDbpz61xFWudrcnKxwjF/f41fMdh2NL2+CmCpWvaLFnrsr5KE8s8MYEbeFn6zN0z=

T4Kxsd7rcud2KXSiB07h1CWvqI8trAxmPhze6aPalU49V+wZ/zM1xv7/jIKhrUEozTiYb5JtAqV=

Q8H2MuWxZbFngWqNFyBCX2uOylvh5M8gGGzjVAaYxGb6ihaRsH

PwJ%0ATUvicyant9B4L9VN40GXtrOXjFSEzV1Sa118cyatYskqz1bbTQg5GNSzPjNWi3Gml33ip=

HEnqqvgDB4nav934It49a+YmjHwQ9cneN2V/tZXwOIt7ZNFUPjaIzpV4FZ7zH6lbG/yAKM/nLqE=

lGA4SJjf5MEGP3l1CWiAMNFxv4mCTD6y6lLRAGGi4z9TRJg9JdTl4gCDBcZ+5skwOgvpy4RBRgu=

MvY3yT9oxMtetujjAAAAAABJRU5ErkJggg=3D=3D" align=3Dbaseline data-imagetype=

=3D"DataUri">

Dear Customer,




uropean)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetic=

a Neue", sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=

: none; FONT-WEIGHT: 400; COLOR: rgb(32,31,30); FONT-STYLE: normal; ORPHANS=

: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255);=

TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: norma=

l; -webkit-text-stroke-width: 0px;=20

text-decoration-style: initial; text-decoration-color: initial; text-decora=

tion-thickness: initial'>


i, Helvetica, sans-serif; BORDER-RIGHT-WIDTH: 0px; VERTICAL-ALIGN: baseline=

; WHITE-SPACE: normal; BORDER-BOTTOM-WIDTH: 0px; WORD-SPACING: 0px; TEXT-TR=

ANSFORM: none; FLOAT: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); PADDING-BO=

TTOM: 0px; FONT-STYLE: normal; PADDING-TOP: 0px; PADDING-LEFT: 0px; ORPHANS=

: 2; WIDOWS: 2; MARGIN: 0px; DISPLAY: inline !important; LETTER-SPACING: no=

rmal; PADDING-RIGHT: 0px; BORDER-TOP-WIDTH: 0px;=20

BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligature=

s: normal; font-variant-caps: normal; text-decoration-style: initial; text-=

decoration-color: initial; font-variant-numeric: inherit; font-variant-east=

-asian: inherit; font-stretch: inherit">Your package has bee=

n returned to DHL Office, you must pay shipping costs $ 4.65

n=3Dtrue>You have 48 hours to pick up the package, otherwise it will be ret=

urned to the sender.






i, Helvetica, sans-serif; BORDER-RIGHT-WIDTH: 0px; VERTICAL-ALIGN: baseline=

; WHITE-SPACE: normal; BORDER-BOTTOM-WIDTH: 0px; WORD-SPACING: 0px; TEXT-TR=

ANSFORM: none; FLOAT: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); PADDING-BO=

TTOM: 0px; FONT-STYLE: normal; PADDING-TOP: 0px; PADDING-LEFT: 0px; ORPHANS=

: 2; WIDOWS: 2; MARGIN: 0px; DISPLAY: inline !important; LETTER-SPACING: no=

rmal; PADDING-RIGHT: 0px; BORDER-TOP-WIDTH: 0px;=20

BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligature=

s: normal; font-variant-caps: normal; text-decoration-style: initial; text-=

decoration-color: initial; font-variant-numeric: inherit; font-variant-east=

-asian: inherit; font-stretch: inherit">

ttp://bit.do/fUEbN">Click here to pay the shipping cost
<=

BR aria-hidden=3Dtrue>https;//dhl.com/apps/=

dhltrack/?action=3D6540674221trackwawawa@live.fr



s-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT=

-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS:=

2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT=

: 0px; font-variant-ligatures: normal; font-variant-caps: normal; text-deco=

ration-style: initial; text-decoration-color: initial" size=3D3>


IGN: baseline; BORDER-BOTTOM-WIDTH: 0px; COLOR: ; PADDING-BOTTOM: 0px; PADD=

ING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; PADDING-RIGHT: 0px; BORDER-TO=

P-WIDTH: 0px">

=




bri, sans-serif, serif, EmojiFont; BORDER-RIGHT-WIDTH: 0px; VERTICAL-ALIGN:=

baseline; WHITE-SPACE: normal; BORDER-BOTTOM-WIDTH: 0px; WORD-SPACING: 0px=

; TEXT-TRANSFORM: none; FLOAT: none; FONT-WEIGHT: 400; COLOR: rgb(68,68,68)=

; PADDING-BOTTOM: 0px; FONT-STYLE: normal; PADDING-TOP: 0px; PADDING-LEFT: =

0px; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px; DISPLAY: inline !important; LETTER=

-SPACING: normal; PADDING-RIGHT: 0px;=20

BORDER-TOP-WIDTH: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px=

; font-variant-ligatures: normal; font-variant-caps: normal; text-decoratio=

n-style: initial; text-decoration-color: initial; font-variant-numeric: inh=

erit; font-variant-east-asian: inherit; font-stretch: inherit">
=3D4>Support team - 
 


EmojiFont; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; F=

ONT-WEIGHT: 400; FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING:=

normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant=

-ligatures: normal; font-variant-caps: normal; text-decoration-style: initi=

al; text-decoration-color: initial" color=3D#dd2222 size=3D4>


-WIDTH: 0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM-WIDTH: 0px; COLOR: ; P=

ADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; PADDI=

NG-RIGHT: 0px; BORDER-TOP-WIDTH: 0px">DHL

>



Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA