Online Threat Alerts (OTA) - Alerting you to scams and frauds.
Online users, do not open email attachments with file extensions or names ending with ".jar". This is because cybercriminals are sending out fake emails to potential victims with a malicious Java file (.jar) attached. The fake emails have a deceptive message, which instructs the recipients to open the same attached malicious Java file. But, any attempts to open the attached malicious ".jar" file will result in the recipients' computers getting infected with a virus, spyware, ransomware or other malware. Therefore, online users are asked not to open email attachments with names ending with ".jar", even if the email messages appear to have been sent from someone they know, or a legitimate organization
"SCAN COPY PDF...1001.jar"
The malicious attachment (.jar) contains a malware called “Backdoor:Java/Adwind” that installs a malicious component or codes onto your computer, which opens a backdoor on it. Once the backdoor is open on your computer, the cybercriminals behind the malicious email message will be able to access your computer silently, infect your computer with other malware, steal your information, and may use your computer to commit other cybercrimes that will be traced back to your computer. If this should happen to you, do not be surprised if one day you see the police at your doorsteps with a warrant to search your home and confiscate your computer, because some form of online criminal activities, which you know nothing about, were traced back to your location and computer.
Most antivirus software will detect and remove the malicious attachment before it infects your computer. But, the smart thing to do, is to delete the email message.
Online users who have received the fake email messages and have been tricked into opening the malicious “.jar” attachment are asked to do a full scan of their computers with their antivirus software.
Related article:
Check the comment section below for answers or additional information. Share what you know, or ask a question about this article by leaving a comment below.
Online Threat Alerts (OTA) is not affiliated with or endorsed by any trademark owner mentioned in this article. Some of the information in samples in this article may have been impersonated or spoofed.
19
Here is another malicious email:------ Forwarded MessageFrom: April Leal Date: Thu, 23 Nov 2017 18:42:58 0200To: me Subject: FW: Purchase Order 22344E from Barclay Butera Inc. - NB
Here is another malicious attachment:"From: AthAATo: All Faculty and StaffSubject: IMPORTANTPlease refer to the attachment carefullyThank youAttachment: Payment_Invoice.JAR"
Here is another scam:"Subject: Inquiry T09824Date: Thu 21/09/2017 03:00From: "B.hrain Stephen"To: undisclosed-recipients:Attachment: T09824_PTRl.pdf Terms.jpg.jar 497 KBDear SirPlease kindly find the attached and quote us your best price ASAP.NOTE: Include our order number in your quotation.Best Regards...B.hrainSenior EngineerPRTRO-LINE GLOBAL CO. LTDUNIT1, Samiullah, Vasai, IndiaTel: 918950598722FAX: 9189504723/4"
Received via email:"The file "I left this for you.pdf.jar" is on all the disk drives of one of my computers, including the pen drive. When I delete the file, it takes 5 seconds and it comes back again. I opened the file through Winrar and found it to be a malicious program. I've already tried antivirus and Google search and got no results. I'll send the file for you to review.I hope you can help me.Thank you very much!Best regardsGildicley"--- ----Start the computers in Safe Mode and then scan them for viruses. Or, if you have Avast antivirus, use their Boot-Time scan.
Here is another malicious email:"Re: Re: CHEQUE PAYMENTMon 18/09/2017 06:35From: ACCOUNTANTAttachment: CHEQUE READY.jarDEAR SIR,PLEASE KINDLY COLLECT YOUR PAYMENT AS PER ATTACHMENT CHEQUE.confirm mentioned account number with IBAN number OK.Thank you,Best regardsAzad abdulAccount ManagerTraffic Control CenterTel : 33849994: 70083195"
Scammers address 2500 terrace ave. In California they email me saying they were from CC company. Can't find an address for the true company. Google map it.
Here is another malicious email:-- start of scam --Subject: PO 605-D382Date: Wed 30/08/2017 22:06From: "Kang Wooyoung" Attachment: PO 605-D382.jar (554 KB)Dear Sir, Please we want to make new order for the enclosed productsKindly find attached our purchase order and give us your current available product price list, Best FOB Prices with clear photos of your latest catalog, Payment term ( LC or TT ), MOQ & ETD.Also put into consideration time as I will want this products delivered Ending of next month latest. Awaiting your prompt response, please. Thank and Best Regards, Kang Wooyoung Sales Manager Office: 17-1-4 U Ghe Street, Tam Phu Wards,Thu Duc Dist. Ho Chi Minh CityTel: 08.2218.1960 - 08.2229.1970 -Fax: 08.5422.4738kang.wooyoung-gmail.comWeb: www.inminhlang.com
Here is another malicious email:"Subject: PURCHASE ORDERAttachment: attached Purchase order.jarDear sir/ Madam,Pleasure to book for the attached Purchase order,Kindly send us order confirmation without delay indicating the following as clearly specified in our order.Can you please provide us with your proforma Invoice and transaction sheet for the required payment.If we place this order within this month, Please confirm to us your arrangement & supply the material to our project site. Thanks & Regards,Nadim MullaPurchase Department[Inline image URL : ]D One Marine LLC T: 971 4 4426395 Ext.108 F: 971 4 4426895 M: 971 559353417 QQ 2032766852 P.O. Box 64464 Loc: WS#110,Dubai Maritime City,Dubai UAE purchase3-d1marine.co www.d1marine.com"
This is a question... If you download a popular .jar file that a lot of famous you-tubers have opened and installed is there still a chance that it could have a virus?Thanks
Not all .jar files are viruses. Therefore, download the file, go to www.virustotal.com, upload the file to the same website and scan it for viruses. After scanning, the website will tell you if the file is malicious or not.
May I know from where can I get sample .jar malware? From where can I download them? I need to analyse them in a virtual environment as part of my learning. Any help would be really helpful.
My colleague just got one today and she is so scared. She sent to me and asked me to have a look. I asked her to delete and ignore it."Attachment: lawsuit file document.jarSubject: URGENT (Vessel Arrest on court Order).Date: Thu, 6 Jul 2017 06:54:59 0600 (BDT)From: KudrI & Djamaris Reply-To: office-kndlawyers.com Dear Sir,We have been appointed to proceed with legal steps in arresting your vessel due to your inability to clear your long overdue payment with our client. Our client claims that several reminder has been sent to you on this subject matter without getting any response from you.Find attached lawsuit filed by our client including Court and lawyer cost. Kindly review and revert with your comment. Meanwhile, vessel will be arrested by the court till further notice.Your urgent response will be appreciated.THANK YOU AND BEST REGARDSKudrI & DjamarisAttorneys - Counsellor at LawMayapada Tower 5th floorJl. Jend. Sudirman Kav.28,Jakarta 12920, IndonesiaTelephone.: 62 21 522 5453Fax.: 62 21 522 5452Email.: office-kndlawyers.com"
Got one of these today:"Attachment New Order. jar (590kb)Dear Sir I have called your office phone but cannot connect to you, could you please look into the attached New Order immediately and then arrange to send us proforma invoice. Awaiting your swift response. Best Regards Assem AbdulsalamHead of Middle East Ascensia Diabetes Care P.O. Box 02 Jeddah 21411KSAPhone: 966 12 660 4757Cell: 966 505 646969"Needless to say I marked it as Spam without opening it.
Here is another malicious email:"Subject: Urgent OrderDate: Tue 06/06/2017 21:48From: ag.kum.aiguo-qq.comAttachment: FOB.pdf.jar (473 KB)Dear We have emailed your company a week ago about our interested in your products and we have not heard from your company. I hope all is well with you, Please quote your best prices on FOB as attachedPlease kindly send us your catalog.Best RegardsMr. Chiang Lin (Manager)Taiwan Semiconductor Manufacturing Company Limitedag.kum.aiguo-qq.com, ag.kum.aiguo-outlook.comskype: Chiang Lin"
Here is another malicious email:-- start of malicious email --"Subject: Purchase Contract/ PON02017/072/Date: Mon 05/06/2017 04:07From: Beatriz SalazarAttachments: PO201(07).zip 574 KBDear Sir,How are you?I attach the approved proforma of our order PON02017/072/please quote FOB to Port of St. Petersburg Russia 4x 20ft FCLI await your reply. Thanks you.Beatriz SalazarMegapolis Group Corporate Head Office Russia 27 Kalanchevskaya StreetMoscow 107078Russian FederationTel. 7 495 620-91-91 7 495 974-25-15Telex 412089 ALFARUFax: 7 (495) 642 9828 e-mail: dbtc.career-db.com-- end of malicious email --
Here is another malicious email message:"Subject: proforma invoiceSun 04/06/2017 23:42From: Customer Account Executive - CSAttachments: PROFORMAL INVOICE.jar 501 KBKindly send us order confirmation without delay indicating the following as clearly specified in our order.Can you please provide us with your Proforma Invoice and transaction sheet for the required payment.If we place this order within this month, Please confirm to your arrangement & supply the material to our project site.Best RegardsSenior Project Engineer And Sales EngineerAwaiting for your favorable feedback.If there is any clarification please feel free to contact me."
Here is another scam:"From: Linn BecklerSent: 31 May 2017 17:58Attachment: COURT CASE DETAILED BRIEFING30-05-2017_obfuscated.jarSubject: Re: Court Case #129 Ref No #763722 Hello Good Day,A COURT CASE has been established against you on Tuesday 30th May, 2017 by the housing agency.Find the attached for the detail and contact your Lawyer immediately.Yours,Bar. Linn Beckler"
Here is another malicious email:"Subject: Urgent OrderDate: Wed 31/05/2017 03:48From: ag.kum.aiguo-qq.comAttachment: FOB.pdf.jar 473 KBDearWe have emailed your company a week ago about our interested in your products and we have not heard from your company.I hope all is well with you, Please quote your best prices on FOB as attached Please kindly send us your catalog.Best Regards Mr. Chiang Lin (Manager)Taiwan Semiconductor Manufacturing Company Limitedag.kum.aiguo-qq.com, ag.kum.aiguo-outlook.com skype: Chiang Lin"
Here is a fake email message with a malicious .jar file:"Subject: Time Sheet and Security Sign on SheetDate: Sun 23/04/2017 19:50From: AIG Security GroupGood morningPlease find attached the Time sheet for week 05.04.2017-11.04.2017 and security sign sheet.Thank YouJanise ColemanAIG Security GroupAddress: 184 Grange Rd, FairfieldVIC 3078, AustraliaPhone: 61 1300 600 578"