With the holidays and presents season approaching, most of us are thinking what presents to order for Christmas. Many people prefer to order them online than to spend hours chasing presents in a mall. I know I am one of those… This fact is also known by cyber criminals who are doing anything to get more money or to extend their botnets. If we see usually only some targeted fake shops or phishing campaigns, this time the stake was raised to a higher level. A spam campaign which pretends to represent the delivery service FedEx is delivering an archive attached to the emails. The ZIP file contains an executable file called Postal-Receipt.exe which, at the time of analyzing, was detected only by three antivirus software from the 48 registered at the online scanning service VirusTotal. Avira briefly analyzed the file and added the detection TR/Inject.exab for that file. The executable in the archive is a clever malware which tries to fool the user by starting a notepad, pretending to display the receipt. In background, it injects code in svchost.exe and tries to contact its command and control server in order to transfer some malicious payload on user’s computer. And this is how…