Sponsored by..

Wednesday, 11 November 2015

Malware spam: "Invoice SI823610 from OfficeFurnitureOnline.co.uk Order Ref 4016584" / "accounts@equip4work.co.uk"

This fake invoice does not come from OfficeFurnitureOnline.co.uk but is instead a simple forgery with a malicious attachment.
From     accounts [accounts@equip4work.co.uk]
Date     Wed, 11 Nov 2015 14:54:33 +0400
Subject     Invoice SI823610 from OfficeFurnitureOnline.co.uk Order Ref 4016584

Please find attached a sales invoice from OfficeFurnitureOnline.co.uk.

This email address is only for account enquiries, please check your confirmation
for any information regarding the order details or delivery lead times.

Thank you for your order.
Attached is a file SI823610.XLS which I have seen only one version of in several samples of the email. Usually there are different variants. In this case, the spreadsheet contains this malicious macro [pastebin] and has a VirusTotal score of 4/54. According to this Hybrid Analysis report it then downloads a malicious binary from:


In turn, this binary has a detection rate of zero. Those two reports plus this Malwr report show between them malicious traffic to the following IPs: (Iomart / Rapidswitch, UK) (Ministry Of Education, Thailand) (Elvsoft SRL / Coreix , Romania / UK)

The payload is the Dridex banking trojan.

Recommended blocklist:



Carl Culshaw said...


We have this email with the same attachment, however, the download location for the exe is http:\\conesulmodelismo.com\br\87yte55\6t45eyv.exe

barcapat said...

Got this dodgy email today too.
Is there any suggested follow on for this type of dodgy email - eg where to report it?

Saul Haisaid said...

Got this email today also. Deleted straight away but good to see others have detected this.

Pete Hainlen said...

Here is the Hybrid Anlysis for conesulmodelismo.com.br
Overlapping IP from the callbacks:
Other recommended blocks: