Tuesday, 22 December 2015

British Gas - A/c No. 602131633 - New Account

It isn't from British Gas, of course. Or from Topsource.

From: trinity <>
Subject: British Gas - A/c No. 602131633 - New Account
Hi ,

Please refer to the attached invoice from British Gas, the account number on it is different
from all the account numbers that we currently have in the system. Can you confirm if this is a
new account so that we will create this in system.

Thanks & Regards,

Pallavi Parvatkar

Trinity Restaurants Accounts Team | TopSource Global Solutions | 020 3002 6203
4th Floor | Marlborough House | 10 Earlham Street | London WC2H 9LN |

And why would a British Gas invoice come from Trinity Restaurants Accounts Team?

SHA256:    4fd0c87920c10568e2f39b3a62c6a61956beb6c638531a651a7a94a551ced259

Jotti - 3 out of 21 flagged it; Ikarus, Kaspersky and Quick Heal.
Metascan - 2 out of 43; Baidu and Kaspersky
Virustotal - 3 out of 54; Fortinet, GData and Ikarus

Virustotal first saw it 2 hours ago. And that's why antivirus products don't flag the files that are sent via email.


  1. I had to laugh at one targeted at me on Monday (with infected .DOC attachment). Subject was "SPAM Invoice". First thought was: thanks for being so open in pointing that out. BUT: it was pretending to be from, so possibly masquerading as an invice for supply of spam? Subtle !

  2. This comment has been removed by the author.