Sponsored by..

Tuesday, 15 December 2015

Malware spam: "Order PS007XX20000584" / "Nicola Hogg [NHogg@pettywood.co.uk]"

This rather brief spam does not come from Petty Wood but is instead a simple forgery with a malicious attachment:
From:    Nicola Hogg [NHogg@pettywood.co.uk]
Date:    15 December 2015 at 10:14
Subject:    Order PS007XX20000584
There is no body text, but instead there is an attachment PS007XX20000584 - Confirmation with Photos.DOC which has a VirusTotal detection rate of 5/55 and it contains a malicious macro [pastebin] which (according to this Malwr report) downloads a binary from:


There are probably other version of the document with different download locations. This malicious executable has a detection rate of 2/54 and between them these three reports [1] [2] [3] indicate malicious traffic to: (Megawire Inc, Canada) (Ho Chi Minh City Post And Telecom Company, Vietnam)

The payload here is likely to be the Dridex banking trojan.


Recommended blocklist:

No comments: