[Mimedefang] Filtering idea for stock pump&dumps

[Joseph Brennan]

This PDF spam is tough.


The size of the PDF varies quite a bit.  Just five samples got me
message sizes of 28061, 22336, 18384, 17484, 16079.


Every example I've seen (dozens) has this header, but this is
probably a real version of Thunderbird:

User-Agent: Thunderbird 1.5.0.12 (Windows/20070509)


Sender address appears to be fake, and always starts with 3, 4, or 5
lowercase letters and the @ sign, e.g.

<aasgx at citadelgroup.com>
<acjz at marriott.com>
<acory at jennison.com>
<afo at yahoo.fr>
<aixo at mcleodusa.net>
<alht at emk-moessingen.de>
<alx at grey.com.tr>
<alxo at yahoo.fr>
<apkt at halcrow.com>
<asunc at abmcommercialflooring.com>
<asunc at ugent.be>
<avb at auburn.edu>
<avb at hawaii.rr.com>


Here are some subjects, not uniq'd.  There is a certain pattern to
them but still they are quite variable.  127/472 end with the word
'attached'.

Abuse.22468542260380.pdf
Abuse.22468542260380.pdf attached
Abuse.pdf
Alert.323560.pdf
Alert.pdf
Alert_DQDRNUFOSFQQ.pdf
Alert_deryg.pdf
Announcement-RRSNNAC.pdf
Announcement.pdf attached
Article.pdf attached
Bill-8420461.pdf attached
Bill-8ea8441.pdf attached
Bill.CYCRXDI.pdf attached
Bill.pdf
Bill.pdf attached
Bill.pdf attached
Bulletin-SGXHRFLTJ.pdf
Bulletin-SGXHRFLTJ.pdf
Bulletin.pdf
Bulletin.pdf
Bulletin.vttdrluxhh.pdf
Cancelled.45130728872.pdf attached
Cashed.ec35dc428e2b03.pdf
Cashed.vxutfbrz.pdf attached
Cashed_183218268632.pdf attached
Cashed_bshzaohbe.pdf attached
Check.54585114813.pdf
Check.pdf attached
Check_PBXKBG.pdf attached
Cheque.bb4689c97a7.pdf
Cheque.pdf attached
Complaint-WQAFOSFQQBPXTP.pdf
Complaint.pdf
Complaint_EGTNCOGPS.pdf attached

...

notification_41150122238705.pdf
notification_71362675.pdf
notification_XTPLULXG.pdf attached
paid-SBTXJJTP.pdf attached
paid.001340.pdf
paid.BSIRRSNNACORY.pdf
paid.ea84412782.pdf attached
paid_25b9228eb2a.pdf attached
paid_38060.pdf
post.4757800e5c25a3.pdf
post.VULGG.pdf
publication-knbryaay.pdf
readme.264aee23.pdf
readme_121326.pdf
report-fqyoj.pdf attached
report.44dc10c7.pdf attached
report.UUBXEQCD.pdf
report.pdf attached
report.pdf attached
report_88401533.pdf
report_NBSWRHAP.pdf attached
report_bbcupvx.pdf
request.pdf attached
request_7265354465.pdf attached
text_qhxwdjndrpyuk.pdf attached
unpaid-QQBPXTPLUL.pdf attached
unpaid-binbs.pdf
unpaid_0756424765.pdf
warning.8134200230.pdf attached
warning.pdf attached




Joe Brennan