Fact Check

'Funeral Announcement' Malware

Messages announcing the death of a friend harbor malware that infects the recipient's computer with a Trojan.

David Mikkelson

Published Jan 24, 2014

Virus:   Funeral Announcement

REAL VIRUS

Example:   [Collected via e-mail, January 2014]


Eubank Funeral Home & Cremation Services

For this unprecedented event, we offer our deepest prayers of condolence and invite to you to be present at the celebration of your friends life service on Thursday, January 23, 2014 that will take place at Eubank Funeral Home at 11:00 a.m.

Please find invitation and more detailed information about the farewell ceremony here.

Best wishes and prayers,
Funeral home receptionist,
Joseph Swanson
 

The Amos Family
Funeral Announcement
Hereby we want to share your sorrow for your dear friend who passed away on Friday, January 10, 2014.
You are cordially invited to express your sympathy in memory of your friend at a celebration of life service that will be held on Monday, January 13, 2014 at the Ocker Funeral Home, Arkansas.

Please find more detailed information about the memorial service here.

Sincerely,
Funeral Home Secretary,
Mateo Little


 

Origins:   In January 2014, Internet users began receiving e-mails from various funeral homes with attention-getting subject lines such as "Passing of your friend," messages that informed recipients a "dear friend" had passed away and invited them to attend that person's upcoming funeral or memorial service. The messages provided a hyperlink (on the word "here") for readers to click in order to obtain detailed information about the date and location of the service.

However, that link actually pointed to a foreign web site and initiated the download of a ZIP file (e.g., FuneralProcession.zip); users who attempted to open and view that ZIP file ended up executing a malicious file (e.g., FuneralProcession.exe) which installed a Trojan on their PCs.

Last updated:   24 January 2014

By David Mikkelson

David Mikkelson founded the site now known as snopes.com back in 1994.

Read More

Become
a Member

Your membership is the foundation of our sustainability and resilience.

Perks

Ad-Free Browsing on Snopes.com
Members-Only Newsletter
Cancel Anytime
$50.00 per year
$12.50 every 3 months
$5.00 per month
Choose your membership, or see other ways to help
default
Most Searched
A rumor says that Elon Musk received wealth or inheritance from an apartheid or slave emerald mine.

What We Know About Elon Musk and the Emerald Mine Rumor

Facebook Private Messages

The Origins of Rudolph the Red-Nosed Reindeer