Vanja Svajcer of Sophos has posted a blog entry about a fake email from Microsoft’s Director of Security Assurance, Steve Lipner.

The email is professionally written and it contains a link to a file. Svajcer notes that Microsoft emails never links directly to a file that ends in .exe or have that type of file as an attachment. Therefore, it is a sign that the email is probably fake.

The file was proactively detected as Mal/EncPK-LL.

Svajcer found that it is a Delphi executable and it was made using a custom packer.

Source: Sophos