I also found this spam:

http://malware-test-lab.blogspot...vista- spam.html
Roger Chiu | Homepage | 08.28.08 - 3:49 am | #

Yup, upon looking in our inbox today, we found the same as you have reported on.

Currently looking at it in more details.

Andrew Kleijn
www.securitycsadets.com
AndyAtHull | Homepage | 08.28.08 - 8:54 am | #

... and the target of this particular SWF is an IP address that is known to be in the RBN, the Russian Business Network.

Specifically:

http://www.spamhaus.org/sbl/sbl....? query=SBL67258

And the largest netblock:

http://www.spamhaus.org/sbl/sbl....? query=SBL67259


Thanks for sharing these investigations, Alex!
Andrew from Vancouver | 08.28.08 - 2:01 pm | #