Date: 28 October 2014 11:01
Subject: INVOICE 101760 from Power EC Ltd
Please find attached INVOICE number 224244 from Power EC Ltd
The invoice number varies, as does the name of the attachment but it will be similar to INVOICE101760.doc which has a VirusTotal detection rate of 5/53. This contains this malicious macro [pastebin] which attempts to download a file from http://Riccis.homepage.t-online.de/Testseite/js/bin.exe which is currently 404ing but I believe to be the same payload as this [virustotal]. The Malwr analysis for that file shows it communicating with the following URLs:
Another version of this spam is doing the rounds, very similar in nature:
From: firstname.lastname@example.orgI have only seen one version of this with a malicious attachment 14153.DOC which has a VirusTotal detection rate of 4/55, which contains this malicious macro [pastebin] which attempts to download a component from http://fruido.de/js/bin.exe to %TEMP%\XZLNXTMSJUX.exe but fortunately that download location is not working (however, there could well be other download locations).
Date: 12 November 2014 12:57
Subject: INVOICE 224245 from Power EC Ltd
Please find attached INVOICE number 224245 from Power EC Ltd
A further version of this spam run is under way, described here.