Sponsored by..

Friday, 27 February 2015

Malware spam: "Dennys Invoice INV650988" / "accounts@dennys.co.uk"

This fake invoice email is not from Dennys but is a simple forgery with a malicious attachment. Dennys are not sending the spam, and their systems have not been compromised in any way.
From:    accounts@dennys.co.uk
Date:    27 February 2015 at 09:14
Subject:    Dennys Invoice INV650988

To view the attached document, you will need the Microsoft Word installed on your system.
So far I have only seen a single sample, with an attachment INV650988.doc which has a VirusTotal detection rate of exactly zero. This contains this malicious macro [pastebin] which downloads another component from the following location:


This is saved as %TEMP%\324235235.exe and has a VirusTotal detection rate of 1/57.

According to the Malwr report, this executable then goes on and downloads another version of itself and a config file from:


It drops several files, KB2896~1.EXE [VT 3/57], edg2.exe [VT 3/57] and a Dridex DLL which is much more widely detected (and we saw this same DLL yesterday). (If you have a Malwr account you can download a copy of everthing from here)

Between the Malwr and VirusTotal analyses, we see attempts to communicate with the following IPs: (Centarra Networks, US) (Leaseweb, Netherlands) (SuperHost.pl, Poland) (MWTV, Latvia) (Webazilla, US) (Broadband Multiplay Project, India) (Net 3, US)

Some of these are shared hosting, I recommend for maximum protection that you apply the following blocklist:

No comments: