Crashed Pips - Computers, politics, emetic trash

Spam is one of those things that’s often so bad, it’s good. Today, I received one of those messages. It was sent to the hello@crashedpips.co.uk e-mail address (obviously harvested, from here) and I present the text below:

Dear customers,
Thank you for using our new service “Buy airplane ticket Online” on our website.
Your account has been created:

Your login: hello@crashedpips.co.uk
Your password: passRHK6

Your credit card has been charged for $669.57.
We would like to remind you that whenever you order tickets on our website you get a discount of 10%!
Attached to this message is the purchase Invoice and the flight ticket.
To use your ticket, simply print it on a color printed, and you are set to take off for the journey!

Kind regards,
Spirit Airlines

There are multiple reasons why this is dubious.

1. I never booked a flight, and the idea I would do so with Spirit Airlines is ludicrous. Because they operate in the Americas as an ultracheap airline (a bit like EasyJet in the UK, but without as much orange.)
2. As Spirit is an ultracheap airline, $669 (even with the current state of the dollar) is excessive.
3. Printer is mis-spelled printed. It seems unlikely that a medium-size airline (still quite a large operation) would make such a mistake - can they not afford a dictionary?
4. The ‘invoice’ and ‘flight ticket’ are attached in a ZIP file, apparently. Examination of the zip file reveals - yes, you guessed it - Ticket_N141-SK.exe, which looks suspiciously like a virus. I’ll be sending this off to some antivirus companies for analysis.
5. They’ve obviously put in no effort with header spoofing whatsoever: the ‘from’ address is kvtgady (at] bradshawplace (full stop) com (address obfuscated to prevent spam to the (possibly) innocent owner of this address).
6. Yep, the usual “Dear Customers” opening line (surprise, surprise).
7. This is perhaps the most important point of all. It demolishes the e-mail’s premise in one swipe: I don’t even have a damn credit card. Even if I did, I’d have paid in pounds or euros, rather than dollars. If I did have to pay in dollars, I would have sent the money using a money transfer service or simply by popping a cheque in the post.

For the record, I’ve tried to contact Spirit about this, but the only phone numbers I can find are for their reservations centre, and the only e-mail addresses I can find are for comments on the Web site. If anyone can source a number or address direct to Spirit’s HQ, I’d be very grateful - it’s best the airline knows about this so it can post an advisory in its website.

EDIT: I’ve sent the file to McAfee and its online scanner says it’s spy-agent.bw. An extra .dat file is being issued for this - I’ll see what McAfee’s rules on redistribution are, and if it’s OK with them I might mirror it here for if you’re using a McAfee scanner. Meanwhile, Symantec won’t let me show them the virus unless I pay them money, and Sophos’s process is long and irritating.

The file will now be shredded to protect other machines on my network.