Is this normal for Koobface?

I get a suspicious Facebook email that has a link to what's eventually an .exe download after a redirect. I check the .exe through virustotal and it's detected in 14/42 scanners. I then get another email with another suspicious url link, but to a different site. Same thing- redirect and .exe download. I check virustotal for that .exe and notice that again 14/52 scanners detect the malware. I then check the md5 hash and they are the same.

 

While it may look like it, I doubt it is from Facebook. It just run of the mill spam.

 

Facebook never sends out email with links to installers (.exe files), because if it has a link then it is spam, report it and delete it , never click on the links or download any files.

Always check the full headers on each email, if it is not from for example:*@facebook.com, then it is not from Facebook.

Thanks.