1

I am wondering if there is a security issue with this. I use Mozilla, and I got an email with Me, '.exe' <myemail@server.com>. I have never seen this. What is it? Is it a way to send mass email? I searched online, and it has something to do with PoserShell. I just don't want to be at risk.

As you can see .exe shows up right before my email address.

Here is what I mean Update - I uploaded it in Virus Total, and it seems to be clean.

2

Normally this seems to look like an error because it is really exposed, suspicious and because it is right in the title of the email. If there is an attachment I do not advise you to open this up in your real enviorment with an antivirus. As a matter of fact do not open it at all.

However this seems some sort of adware according to a specific site, either way if your that curious download a VM and open it up simulating a sandbox enviorment and execute it to see.

1

I take it this is an attachment you've received - .exe is not a valid top-level domain.

I would not advise you to open this at all. If you have the file on your device, you can have your anti-virus check it for a detection or you can upload it to VirusTotal to check it against a host of vendors.

If you weren't expecting this file and don't recognise the sender delete it and be done with it.

  • This is a good model 'I do not recognise this, so do not open and delete'. Unfortunately, if major providers did not allow XSS without our permission the 'do not open' the email policy would not be required, but this is only seen with smaller services like ProtonMail. But it's seen more often email servers blocking executable files and ZIP files containing executables. – safesploit Sep 10 '18 at 21:14
1

You could use VirusTotal, like suggest above. But this is entirely possible. Sending emails with a spoofed address is possible, we use SPF but validation, but even with this its possible, as additional validation techniques are required.

  • While this is a valid point, you should do more to add to the answer. As other answers have already made most of these points. Please reframe in the future from making points without referencing. Despite this, a valid point about SPF, as it is used by email servers to mitigate spam which has failed validation checks. – safesploit Sep 10 '18 at 21:16
0

The '.EXE' you see is the "full name" field of an email address, typically what the sender has in their address book. On a protocol level, this is the content of the To: field.

The sender has set the To: field to multiple email addresses. The first one is your email, which is shown as "Me" in the screenshot. The second address is the @yahoo.com account with a name of " '.EXE' " (inner quotes included). You can tell because there are two stars in the screenshot, one after each recipient. This account is likely controlled by the spammer for the purposes of capturing any reply you happen to send.

In short: The spammer is being tricky with the "name" field in the email. If there's an attachment, don't open it - the trickiness with the name is probably intended to confuse you and get you to do just that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.