No, it’s not about the Disney’s movie that you can see today at cinemas. There has been a massive sending of a message with a file attached that is supposed to be the movie trailer, the name of the file is:


We have received some hundreds samples proactively blocked by TruPrevent, most of them coming from Italy. Once you run the file (detected as Trj/Pirabbean.A), it shows you the following message:

At the same time, it downloads & installs a dialer, and also creates two shortcuts in the desktop:

It also changes some settings of Internet Explorer (adding 2 URLs in the Trusted Sites). In case you visit those URLs it will install you some more dialers.