Sponsored by..

Friday 25 July 2014

HM Revenue and Customs "Notice of Underreported Income" spam

The second HMRC spam run of the day, this one contains a malicious link.
From:     HM Revenue and Customs [noreply@hmrc.gov.uk]
Reply-To:     HM Revenue and Customs [noreply@hmrc.gov.uk]
Date:     25 July 2014 12:19
Subject:     Notice of Underreported Income

Taxpayer ID: ufwsd-000007954108UK
Tax Type: Income Tax
Issue: Unreported/Underreported Income (Fraud Application)
Please review your tax income statement on HM Revenue and Customs ( HMRC ).Download your HMRC statement.
Please complete the form. You can download HMRC Form here.
In this case the link in the email goes to ecanovas.com/boceto/hmrc.exe which the user is expected to download and run. It has a VirusTotal detection rate of 3/51. Automated analysis tools are pretty inconclusive [1] [2] [3] but do reveal some of the behavioural activity.

No comments: