Tuesday, 23 September 2014

Malicious "Employee Documents - Internal Use" spam spoofs victim's domain

This spam appears to come from the victim's own domain, but in fact doesn't and it leads to malware instead.
From:     victimdomain.com [INTERNAL@victimdomain.com]
To:     victim@victimdomain.com
Date:     23 September 2014 11:43
Subject:     Employee Documents - Internal Use

DOCUMENT NOTIFICATION, Powered by NetDocuments

DOCUMENT NAME: Employee Documents

DOCUMENT LINK: http://cystersi.wagrowiec.pl/bitusagezp/paqzdzsfjs.html

Documents are encrypted in transit and store in a secure repository

This message may contain information that is privileged and confidential. If you received this transmission in error, please notify the sender by reply email and delete the message and any attachments.
In this case the link goes to cystersi.wagrowiec.pl/bitusagezp/paqzdzsfjs.html and then downloads a file from cystersi.wagrowiec.pl/bitusagezp/EmployeeDocuments.zip which unzips to a malicious executable EmployeeDocuments.scr. This is exactly the same payload as found in this spam run earlier today.

According to this spam.. "You have a new voice". Really?

This strangely titled spam leads to malware.

From:     Voice Mail
Date:     23 September 2014 10:17
Subject:     You have a new voice

You are receiving this message because we were unable to deliver it, voice message did not go through because the voicemail was unavailable at that moment.

* The reference number for this message is _qvs8213783583_001

The transmission length was 78
Receiving machine ID : R8KU-UY0G3-ONGH

To download and listen your voice mail please follow the link below: http://www.ezysoft.in/ocjnvzulsx/begmnbjiae.html

The link to this secure message will expire in 24 hours. If you would like to save a copy of the email or attachment, please save from the opened encrypted email. If an attachment is included, you will be given the option to download a copy of the attachment to your computer.
Hang on.. cough cough.. la la la la la la.. testing testing. Nope, my voice sounds pretty much the same as it usually does.

The link in the email downloads a file from www.ezysoft.in/ocjnvzulsx/VoiceMail.zip which contains a malicious executable VoiceMail.scr which has a VirusTotal detection rate of 2/54.

According to this Anubis report the malware attempts to phone home to very-english.co.uk which might be worth blocking.

Monday, 22 September 2014

"Your online Gateway.gov.uk Submission" spam

This fake spam from the UK Government Gateway leads to malware:

From:     Gateway.gov.uk
Date:     22 September 2014 12:54
Subject:     Your online Gateway.gov.uk Submission

Electronic Submission Gateway

Thank you for your submission for the Government Gateway.
The Government Gateway is the UK's centralized registration service for e-Government services.

To view/download your form to the Government Gateway please visit http://www.gateway.gov.uk/

This is an automatically generated email. Please do not reply as the email address is not
monitored for received mail.
gov.uk - the best place to find government services and information - Opens in new window

The best place to find government services and information

The link in the email does not go to gateway.gov.uk at all, but in this case the the link goes to the following:
http://maedarchitettura.it/wfntvkppqi/wnazvamlzv.html ->
http://www.maedarchitettura.it/wfntvkppqi/wnazvamlzv.html ->

The ZIP file contains a malicious executable GatewaySubmission.exe which has a VirusTotal detection rate of 1/55. The Anubis report shows that it attempts to make a connection to ruralcostarica.com which is probably worth blocking.

Lena Michalczyk STE LTD "documents" spam

This spam message does not come from STE UK Ltd or any company of a similar name, not does it come from anyone called Lena Michalczyk. In the sample I received, it actually originated from a hacked machine located in the Federated States of Micronesia.

From:     lena michalczyk [michalczyklena@gmail.com]
Date:     22 September 2014 10:01
Subject:     documents

Regards Lena Michalczyk STE LTD.
office no. 07999258583

Regards Lena Michalczyk STE LTD.
office no. 07999258583
In the same I saw, the attached file was block20140915_16321753.pdf.zip but the attachment itself was corrupt, however there's a good chance that the spammers will fix this and send it out with a working payload.

If you receive a message like this, simply delete it and do not open the attachment.

Sunday, 21 September 2014

Why is Mobiquant pretending to be Southampton Solent University?

I wrote about the French (or possibly Moroccan) IT security firm Mobiquant Technologies last year when their website was serving up an exploit kit, and they failed to respond to any attempts at communicating with them. Eventually (after several weeks) they woke up and fixed the problem, and then proceeded to mount a bizarre and highly personal attack on me.

I've kept a bit of an eye on them since then as there are several things that don't add up. One of them is an a website they are running at mobiquantacademy.com. For some reason I cannot fathom, it appears to have been set up to spoof a site belonging to Southampton Solent University, an organisation that they do not seem to be affiliated with in any way.

It isn't a copy of the current Solent myCourse site, it seems to be a couple of years old. So a copy, not a mirror or anything.

The Mobiquant site prominently displays a login box:

A look at the HTML source [pastebin] shows that although there are plenty of references back to the solent.ac.uk domain, the part that handles processing the login is very much on the mobiquantacademy.com domain.

<form action="http://www.mobiquantacademy.com/login/index.php" method="post" id="login"  >
  <div class="loginform">
    <div class="form-label"><label for="username">Username</label></div>
    <div class="form-input">
      <input type="text" name="username" id="username" size="15" value="" />
    <div class="clearer"><!-- --></div>
    <div class="form-label"><label for="password">Password</label></div>
    <div class="form-input">
      <input type="password" name="password" id="password" size="15" value=""  />
      <input type="submit" id="loginbtn" value="Log in" />
    <div class="clearer"><!-- --></div>
    <div class="rememberpass">
  <input type="checkbox" name="rememberusername" id="rememberusername" value="1"  />
  <label for="rememberusername">Remember username</label>
<div class="clearer"><!-- --></div>
  <div class="forgetpass"><a href="forgot_password.php">Forgotten your username or password?</a></div>

So, if a student found this site somehow and typed in their credentials, then they would be processed by a PHP scripts on the mobiquantacademy.com site. That's a bit peculiar, isn't it? You might think that this was a security risk, which is an odd thing for an IT security firm to be doing.

So perhaps this is some sort of configuration error? I have certainly seen cases where misconfigured webservers serve up the wrong website. Well, there are several reasons why this isn't the case.. Solent host their websites in their own IP address range of -, www.mobiquantacademy.com is hiding behind a Cloudflare IP address but plain old mobiquantacademy.com (without the www) is hosted on the real IP address of which also contains a number of sites that clearly link the domain with Mobiquant.


As I found before with Mobiquant's main mobiquant.com domain, the WHOIS details for mobiquantacademy.com are completely fake.

Registrant Name: ALEXANDRA MEYER
Registrant Organization: FORTESIA
Registrant Street: 33
Registrant Street: KNIGHTSBRIDGE RD
Registrant City: PISCATAWAY
Registrant State/Province: NJ
Registrant Postal Code: 08854
Registrant Country: US
Registrant Phone: +1.3477481090
Registrant Phone Ext:
Registrant Fax: +1.5555555555
Registrant Fax Ext:
Registrant Email: adds31@gmail.com
Registry Admin ID: 

This isn't the first set of fake WHOIS details they have supplied for the domain. When I complained to their registrar and host that they were using fake details, they briefly removed the spoof Solent site and changed their WHOIS details from:

Registry Registrant ID:
Registrant Name: INTERNET GROUP
Registrant Organization: HOSTING JEWEL
Registrant Street: 7
Registrant Street: CHEVAL PLACE
Registrant City: LONDON
Registrant State/Province: LD
Registrant Postal Code: S6SDJ7
Registrant Country: GB
Registrant Phone: +44.2077776588
Registrant Phone Ext:
Registrant Fax: +1.5555555555
Registrant Fax Ext:
Registrant Email: ADDS31@GMAIL.COM
Registry Admin ID: 

The fact that the spoof Solent site was removed and then re-added looks rather strange in my personal opinion. Namecheap (the registrar) confirmed that the content had been removed, but now it is back.

Another thing that makes this look like a deliberate act is the way that the mobiquantacademy.com website is explictly referred to in the HTML source code when it comes to the login handler which means that the code was altered deliberately. If the site had somehow been accidentally mirrored then it would not have that explicit reference.

Neither Mobiquant's websites or Solent's website has any reference to the other party. A Google search of the two parties does not show any relationship, apart from Mobiquant's copy of Solent's site. I cannot see any legitimate reason why Mobiquant would be running a site that was asking for the credentials of Solent students.

So what is this site for? I leave you to draw your own conclusions.

UPDATE: Mobiquant must be keeping track of my blog or my Tweets as they have now deleted the site.

However, if you wish to analyse a copy of the site yourself you can download a ZIPped copy from here.

Saturday, 20 September 2014

Scam: advocateforyouths.org is not the real Advocates for Youth (and other scam sites)

I've covered these scammers before - they rip off legitimate websites such as the genuine Advocates for Youth and use them to commit fraud. The domain advocateforyouths.org is currently being pushed by the bad guys, note that the legitimate domains is actually advocatesforyouth.org.

From:     advocates3@esecuredmails.eu
Date:     20 September 2014 00:52
Subject:     Re: Effects of Teenage Marriage
Signed by:     esecuredmails.eu


Advocates for Youth and co-organizers of the 21st international NGO's & CBO's conference on community Development and Development Planning have the pleasure to invite Youth Organizations, Socio Cultural Organizations, Community Based Organizations (CBO) Scholars, Researchers, Health Organizations, Professionals, Business Organizations (NGOs) Religion Organizations, Human Right Organizations & Women Groups to the International Conference on"Effects of Teenage Marriage and HIV/AIDS " taking place from Thursday 20th - Friday 21st November 2014 in U.S.A and Monday 24th - Friday 28th November 2014 in The NETHERLANDS respectively.

This is the most important event in the framework of the fight to Educate the Youth on HIV/AIDS, Child Abuse, human and community development which will take place in Washington DC, United States of America from Thursday 20th - Friday 21st November 2014 in U.S.A and Monday 24th - Friday 28th November 2014 in The NETHERLANDS respectively.

Advocates for Youth is registered 501(c) Non profit international organization whose aims & objectives are to empower individuals and communities worldwide through offering grants for business, education, economic enhancement, community development and environmental conservation, to support groups and organizations addressing social issues, youth ad women empowerment, and a variety of philanthropic projects through grants to non-profit organization; to provide education & information with view of limiting abuse and child molestation, to support and advocate on behalf of those infected and affected by the menace or abuse and neglect to promote the well-being of mankind by empowering the capacity of charitable organization to provide effective programs of quality.

This conference will bring together 1026 representatives of NGOs/CBOs and numerous numbers of interested individual participants from all over the world. The conference will be conducted on participatory bases with satellite plenary and simultaneous sessions followed by general and small group discussions.

FINANCIAL SUPPORT: The conference receives financial support from CitiBank New York and United Nations Youth Commission etc. This sponsorship covers the following:

1. Return Airplane travel tickets for selected delegates from their home countries to venues of the event in Washington DC ( United States of America ) and The Hague City (The Netherlands), then back to their home countries.

2. Hotel accommodations in Washington DC ( United States ) only for selected delegates and their friends.

3. Medical insurance cover for delegates throughout the entire conference duration.

Advocates for Youth will not assume the responsibilities of any other costs other than those listed above.

NOMINATION & SELECTION OF PARTICIPANTS: Intending participants are requested to nominate between Five (5) to Ten (15) active members to participate. Participants should be from 14 years and above (Male or Female).

REGISTRATION PROCESS: To register to take part in this Conference, please request for the International Delegates Registration form and other conference information. The request for registration form and other conference information should be addressed to the Secretary:

Linara J. Davidson
Secretary, Advocates for youth
2000 M Street, NW Suite 750,
Washington DC 20036,
United States of America,
Tel: +1 202.600.9543
Fax: + 1 650.747.4401
Email: ljdavidson@advocateforyouths.org
Website: www.advocateforyouths.org 

While we anticipate your earliest response, you are advised to contact the Secretary by email and we look forward to meeting up with you and your group in Washington DC and The Hague City to assert a new change for a stronger society.

Announcer !!!

Debra Hauser
President, Advocates for youth,
Washington DC
Email: debra.hauser@advocateforyouths.org

This email is a scam and is basically a way to defraud the potential victim of money by making them think that they are dealing with a real organisation. The websites referred to is an almost pixel-perfect copy of the real thing.

The differences are very subtle. Crucially the contact details between the fake and real sites are different, but the scammers have gone to the effort of acquiring a phone number in the same area code.

Let's look at the WHOIS details for the fake domain:

Registrant ID:DI_37927050
Registrant Name:weba
Registrant Organization:greg
Registrant Street: rue marcel de france
Registrant City:la chapelle
Registrant State/Province:St luc
Registrant Postal Code:10600
Registrant Country:FR
Registrant Phone:+33.2356789990
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email:nelsondove1@gmail.com

Not much to go on there, but the scammers are using their own email infrastructure to pump these out from using the domain esecuredmails.eu registered to:

Name: Nelson
Organisation: N/A
Language: English
bijsterhuizen 1160
2282 pm Rijswijk
Phone: +31.645433356
Email: unit1x1@yahoo.com

Both of these refer to "Nelson". The website advocateforyouths.org actually forwards to a framed page on www-parisline.in (hosted on in India) registered to:

Registrant Name:Patrik Pie
Registrant Organization:N/A
Registrant Street1:14 rue du Theatre
Registrant Street2:
Registrant Street3:
Registrant City:Porte de Versailles
Registrant State/Province:Paris
Registrant Postal Code:75015
Registrant Country:FR
Registrant Phone:+33.0617750470
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:nelsondove1@gmail.com

As before, this site also contains a number of other fake sites, some of which are likely to form part of the same scam. I covered the fake Al-zaida Emirates Group Holding Co and Hotel T Bello before. There may be other scam sites on the same server.

Advocates for Youth is a decent organisation, and apparently these scumbag scammers have no shame whatsoever in using their good name for their own financial gain. Given the relative sophistication of the scammer's set-up, it is likely that they will keep trying with this particular scam.
 Take care.

Friday, 19 September 2014

Microsoft Outlook "You have received a voice mail" spam

This fake voice mail message leads to malware:
From:     Microsoft Outlook [no-reply@victimdomain.com]
Date:     19 September 2014 11:59
Subject:     You have received a voice mail

You received a voice mail : VOICE976-588-6749.wav (25 KB)
Caller-Id: 976-588-6749
Message-Id: D566Y5
Email-Id: conrad@longmore.me.uk

Download and extract to listen the message.

We have uploaded voicemail report on dropbox, please use the following link to download your file:

Sent by Microsoft Exchange Server
The link in the email messages goes to www.prolococapena.com/yckzpntfyl/mahlqhltkh.html first and then downloads a file from www.prolococapena.com/yckzpntfyl/Invoice102740_448129486142_pdf.zip which contains exactly the same malicious executable being pushed in this earlier spam run.

"NatWest Statement" spam.. yet again.

Poor old NatWest is being spoofed again in this spam run that leads to malware..

From:     NatWest.co.uk [noreply@natwest.com]
Date:     19 September 2014 10:40
Subject:     NatWest Statement

 View Your September 2014 Online Financial Activity Statement

Keep track of your account with your latest Online Financial Activity Statement from NatWest Bank. It's available for you to view at this secure site. Just click to select how you would like to view your statement:

View/Download as a PDF

View all EStatements

So check out your statement right away, or at your earliest convenience.

Thank you for managing your account online.


NatWest Bank

Please do not respond to this e-mail. If you have any questions about this inquiry message or your NatWest Bank ®
Merchant account, please speak to a Customer Service representative at 1-800-374-2639

NatWest Bank Customer Service Department

P.O. Box 414 | 38 Strand, WC2N 5JB, London

Copyright 2014 NatWest Company. All rights reserved.


In this case, the link in the email goes to www.teli.us/ylojwatayv/hjhgoflpob.html which then downloads a file from the same site at www.teli.us/ylojwatayv/Invoice102740_448129486142_pdf.zip - this in turn unzips to a malicious executable Invoice102740_448129486142_pdf.exe which has a VirusTotal detection rate of 1/55.

Analysis of this binary is still pending.

UPDATE: the Anubis report shows network activity to hallerindia.com on I would suggest that this is a good domain to block.

Thursday, 18 September 2014

"Important - New account invoice" spam leads to malware

This fake NatWest invoice (since when did banks send invoices?) leads to a malicious ZIP file.

From:     NatWest Invoice [invoice@natwest.com]
Date:     18 September 2014 11:06
Subject:     Important - New account invoice

  Your latest NatWest invoice has been uploaded for your review. If you have any questions regarding this invoice, please contact your NatWest service team at the number provided on the invoice for assistance.

To view/download your invoice please click here or follow the link below :


Thank you for choosing NatWest.

Important: Please do not respond to this message. It comes from an unattended mailbox.

This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

The Royal Bank of Scotland International Limited trading as NatWest (NatWest). Registered Office: P.O. Box 64, Royal Bank House, 71 Bath Street, St. Helier, Jersey JE4 8PJ. Regulated by the Jersey Financial Services Commission.

The link in this particular email goes to bnsoutlaws.co.uk/qvgstopmdi/njfeziackv.html which then downloads a ZIP file from bnsoutlaws.co.uk/qvgstopmdi/Account_Document.zip which in turn contains a malicious executable Account_Document.scr which has a VirusTotal detection rate of just 1/53.

The ThreatTrack report [pdf] shows that the malware attempts to call home to:

Recommended blocklist:

UPDATE: bnsoutlaws.co.uk is now cleaned up, so you can un-block it.

The same malware is also being pushed by a fake Lloyds Bank email..

From:     Lloyds Commercial Bank [secure@lloydsbank.com]
Date:     18 September 2014 11:45
Subject:     Important - Commercial Documents

Important account documents

Reference: C146
Case number: 68819453
Please review BACs documents.

Click link below, download and open document. (PDF Adobe file)

Please note that the Terms and Conditions available below are the Bank's most recently issued versions. Please bear in mind that earlier versions of these Terms and Conditions may apply to your products, depending on when you signed up to the relevant product or when you were last advised of any changes to your Terms and Conditions. If you have any questions regarding which version of the Terms and Conditions apply to your products, please contact your Relationship Manager. .

Yours faithfully

James Vance
Senior Manager, Lloyds Commercial Banking

Calls may be monitored or recorded in case we need to check we have carried out your instructions correctly and to help improve our quality of service.

Please remember we guarantee the security of messages sent by email. 

Wednesday, 17 September 2014

The Furniture Market "TFM Confirmation - Order R12003585" spam

This fake order confirmation is not from The Furniture Market (thefurnituremarket.co.uk). It has a malicious PDF file attached to it that you should not open. The Furniture Market's computer systems have not been compromised.

From:     Marc - The Furniture Market [marc@thefurnituremarket.co.uk]
Date:     17 September 2014 15:40
Subject:     TFM Confirmation - Order R12003585

Good afternoon,

  Thank you for your order.  Please find attached to this mail, confirmation of the products ordered and collected from us earlier today.

  Should you have any further queries, then please do not hesitate to contact us.

Kind Regards,

Marc Chadwick

The Furniture Market
( Tel: 01829 759 259
* Email:marc@thefurnituremarket.co.uk
: web: www.thefurnituremarket.co.uk 

VAT No. 904103182  │ Company No. 6491540

  new-signiture (2)

Please consider the environment before printing this e-mail

find us on facebooktwitter-logo-follow1 trustpilot-coolpriser

It is trivially easy to fake who an email message is "From", and this email looks very convincing which makes me suspect that the bad guys have based it on a real message, possibly harvested from a hacked computer.

The attachment is IR12003585-001.pdf which is a malicious PDF file with a VirusTotal detection rate of 10/54. The VT report indicates that it is using vulnerability CVE-2013-2729 to execute malicious code. If you are using an up-to-date version of Acrobat Reader (or an alternative PDF reader) then there is a good chance that you will be OK.

The Furniture Market gets considerable kudos in my book for being very on the ball and having a great big warning notice on their site. Hopefully they are just as efficient when it comes to delivering furniture!

"You've received a new fax". No you haven't, you've received a new bit of malware.

This tired old spam format comes with warmed-over malware attachment.
From:     Fax [fax@victimdomain.com]
Date:     17 September 2014 09:32
Subject:     You've received a new fax

New fax at SCAN6405035 from EPSON by https://victimdomain.com
Scan date: Wed, 17 Sep 2014 16:32:29 +0800
Number of pages: 2
Resolution: 400x400 DPI

You can secure download your fax message at:


(Google Disk Drive is a file hosting service operated by Google, Inc.)
The link in the email downloads an archive file Message_Document_pdf.zip from the same estudiocarraro.com.br site. This has a VirusTotal detection rate of 3/54. The ThreatTrack report shows that the malware attempts to phone home to:


Recommended blocklist: