.ACE Malicious Email Message Attachments

.ACE Malicious Email Message Attachments

Would you share this Article with others?

Online users who have received unexpected email messages with attached files with names ending with .ace are asked not to open them. This is because the attachments are compressed malicious files that contain malware. And, any attempt to open the malicious attachments will result in the recipients getting their computers infected with a virus, Trojan horse, spyware, ransomware or other malware.

A Sample of a Malicious .ACE Email Message

Subject: 00_Invoice_7267
Date: Wed 17/05/2017 11:27
Attachment: 00_Invoice_7267.ace (108 KB)

The .ACE compression is similar to ZIP or RAR which is the most popular file compression or archive formats.

Cyber criminals usually store their malware in compressed files to help prevent antivirus software from detecting them. In other words, they do it because the compressed malicious email attachments may bypass the recipients' antivirus software.

What is an .ACE file?

Files that contain the .ace file extension are archive files that have been compressed using the WinAce file archiving utility. Computer users utilize a file archiving program when they want to combine a large batch of files into a single archive folder. WinAce is a program that can do this, utilizing a proprietary compression algorithm. This proprietary algorithm offers faster compression speeds and a higher compression ratio than many of the other archiving applications on the market. This allows the user to create smaller file archives, saving space on the user's hard drive.

The .ace file extension is also used by the Aces200 software program. This program uses the .ace file extension for the image files it saves.

Note: Some of the names, addresses, email addresses, telephone numbers or other information in samples on this website may have been impersonated or spoofed.

Please share what you know or ask a question about this article by leaving a comment below. Check the comment section below for additional information, if there is any. Remember to forward suspicious, malicious, or phishing email messages to us at the following email address: info@onlinethreatalerts.com. And, report missing persons, scams, untrustworthy, or fraudulent websites to us. Tell us why you consider the websites untrustworthy or fraudulent. Also, to quickly find answers to your questions, use our search engine.

You can help maintain Online Threat Alerts (OTA) by paying a service fee. Click here to make payment.

Recommended by us: Malwarebytes Endpoint Protection provides what your antivirus can't: complete confidence. Its powerful technologies detect and remove zero-hour malware engineered to evade standard endpoint security.
Comments, Questions, Answers, or Reviews
(Total: 8)

To help protect your privacy, please do not post or remove, your full name, telephone number, email address, username, password, account number, credit card information, home address or other sensitive information in or from your comments, questions, or reviews.

The comments, reviews or answers below do not necessarily reflect the views of Online Threat Alerts (OTA).

  • July 25, 2018 at 4:05 AM by an anonymous user from Plovdiv, Bulgaria

    I wish to report another email sending out malware from email Solaya.cicadex@mail.com


  • February 19, 2018 at 6:18 PM by an anonymous user from Santa Monica, California, United States

    Here is another malicious email:

    "Subject: RE: INVOICE ??

    Accounts [zohaib.ahmed@greensyspk.com]


    attachment: copy-4855975.ace [163KB]


    Attached is the details as requested.



  • February 5, 2018 at 10:24 AM by an anonymous user from Toronto, Ontario, Canada


    "1.Angela <wk@teensnow.com> via gmail.com



    Sat, Feb 3, 2018 at 10:05 PM

    Your Future finally unveiled!


    Standard encryption (TLS) Learn more



    DHL GLOBAL FORWARDING® <track@dhl.com>

    Yesterday, 8:13 PMshop@svarmat.ru; info@weldcom.ru; weldaui@rambler.ru; sale@deltasvar.ru; info@calen.su;nehim@mail.ru; info@svarka74.ru; svarka@svarka.su;




  • October 2, 2017 at 9:19 AM by info

    Here is another scam:

    "From: "Olivia Heandra Nata" <oliviahaendra_nata@po-and-g.com>

    Subject: Request For Quotation For Pacific O & G Project

    Date: 2 October 2017 at 06:27:12 CEST

    Attachments: RFQ NO. PC01001ENQ-2017P10.ace (103 KB), Pacific standard terms and conditions(STC).ace (103 KB)

    Dear Sales,

    RFQ NO. PC01001/ENQ-2017/P/10

    Please refer to the attached RFQ and we request you to send us the quotation with Catalog for the (PACIFIC OIL & GAS) as per attached reference documents.

    We look forward to receive your offer on or before 10th of Oct. 2017.

    For any query, kindly call or write us.

    Please acknowledge the receipt of this email within two working days.

    Thanks & best Regards,"


  • June 8, 2017 at 1:30 PM by info

    Here is another malicious email message:

    -- original message --

    "Subject: REQUEST FOR QUOTE IMG06062017 00011

    Wed 07/06/2017 21:48

    From: Verde Trading LLC

    Attachment: IMG_SCAN0806201700001_PDF.ace 318 KB

    Attachment: Company Profile.ace 218 KB


    Dear Sir

    Please quote your competitive price for the attached mentioned materials:-





    Amount 1

    IMG06062017_QUOTE_00011,PDF 2”x6”&widerx8ft,11ft,12ft

    CFT 300

    Thanks and warm regards."


  • June 6, 2017 at 12:27 PM by info

    Here is another malicious email:

    "Pending Order under SAI 2/RM/437/12/2016-2017

    Mon 05/06/2017 20:26

    From: Elisco Lightning DTB

    Attachments: b3e55c1c.jpeg, ffffeaba.png, DTB_Order.PDF.ace

    Dear sir,

    Good morning,

    Please kindly note attached is our Intended orders, Please check to see our specification.

    they are two separate orders but we want them coming together in one shipment.

    Also, check if it will be possible to ship before mid-year.

    Kindly note Item 3&5 and confirm the price as I cannot determine it from your catalogue.

    We want 40"ft container each. And i will appreciate if this container is well packed to avoid damages.

    I await your reply now in response of this order.

    Looking forward to your reply.


    Purchase Department

    20/F., One Kowloon, 1 Wang Yuen Street,"


  • June 6, 2017 at 12:24 PM by info

    Here is another malicious email:

    "Shipping Document / Invoice and copy of DHL receipt.

    Mon 05/06/2017 20:27

    From: DHL Express

    Attachment: DHL AWB Receipt Telex.Pdf.ace

    Your parcel (shipping document) will arrive at the post office on 6rd JUNE, Here is your Shipping Document / Invoice and copy of DHL receipt for your tracking.

    Please kindly check the attached (Check Your Package) to confirm accordingly if your address is correct before we submit to our office outlet for dispatch to your destination."


  • June 6, 2017 at 12:21 PM by info

    Here is another malicious email:

    "Re: TT copy 05.06.2017

    Mon 05/06/2017 20:28

    Attachments: b3e55c1c.jpeg, 6db3c2e8.png, Scan_PDF.ace

    Subject: GTK-IMPORT-ORDER71A8210, with the picture from logo:

    Good day,

    Attached is May. TT balance payment for your reference.

    Please note that some of Qty was adjusted to round up last parking

    Kindly confirm and let me know if there is any amendment needed to do concerning the order.

    awaiting for your reply



    Accounts Department

    20/F., One Kowloon, 1 Wang Yuen Street,

    Kowloon Bay, Hong Kong

    Tel: (852) 2877-8933

    Fax: (852) 2877-1322"


 Show More Comments (8)
Write Your Comment, Question, Answer, or Review
Write your comment, question, answer, or review in the box below to share what you know or to get answers. NB: We will use your IP address to display your approximate location to other users.
Your comment, question, answer, or review will be posted as an anonymous user because you are not signed in. Anonymous posts cannot be edited or deleted. Sign-in.

.ACE Malicious Email Message Attachments