Sage "Outdated Invoice" spam

This fake Sage email leads to a malicious file.

From:     Sage Account & Payroll [invoice@sage.com]
Date:     9 September 2014 13:31
Subject:     Outdated Invoice

Sage Account & Payroll

You have an outdated invoice from Sage Accounting that is ready for payment. To find out more details on this invoice, please follow the link bellow or click here to view/download your account invoice: https://invoice.sage.co.uk/Account?902687=Invoice_090914.zip If we hold any information about you which is incorrect or if there are any changes to your details please let us know by so that we can keep our records accurate and up to date. If you would like to update your records or see a copy of the information that we hold about you, you can contact us at Data Protection Officer, Sage (UK) Ltd, North Park, Newcastle-upon-Tyne, NE13 9AA or by email to [redacted]. If you request a copy of your information you will need to pay a statutory fee which is currently £10. The contents of this email and any attachments are confidential. They are intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to anyone or make copies. We have communicated this information with users as well, and we will continue to communicate with you through email as your transition continues. This email was sent to: [redacted]

This email was sent by: Sage UK Limited NC1-002-08-25, Newcastle upon Tyne., North Park, NE13 9AA, United Kingdom

Privacy and Security
Keeping your financial information secure is one of our most important responsibilities. For an explanation of how we manage customer information, please read our Privacy Policy. You can also learn how Sage UK Limited keeps your personal information secure and how you can help protect yourself.

The link in the email does not go to invoice.sage.co.uk at all, but loads a page from:
[donotclick]anphucconduit.com/cslxpnzwzg/jnxxblpzjn.html

which in turn executes the following scripts:
[donotclick]lager.leadhoster.com/jflguwjgdk/rqkypcjgqt.js
[donotclick]northinc.com/mlfbxurfhn/pctxizxtfd.js
[donotclick]www.drhousesrl.it/lpwfszqqjt/gttigxxhme.js
[donotclick]mariatome.myartsonline.com/ykfmbdqqrm/jgawguxmub.js

those scripts attempt to download a malicious .ZIP file from the following locations:
[donotclick]cartadegintonics.com/js/jquery/invoice_090914.zip
[donotclick]anpilainate.org/bin/invoice_090914.zip
[donotclick]raggiottoimpianti.it/wp-content/uploads/2014/08/invoice_090914.zip
[donotclick]importedjewelryoutlet.com/include/invoice_090914.zip

You would have expected an exploit kit after all this hard work, but not.. it's a plain old ZIP (invoice_090914.zip) file containing a malicious executable invoice_090914.scr which has a VirusTotal detection rate of 8/55.

The ThreatTrack report [pdf] and Anubis report show that the malware attempts to make a connection to:
vaderhopland.be/js/9k1.cl
95.141.37.158/0909uk1/NODE01/0/51-SP3/0/
95.141.37.158/0909uk1/NODE01/1/0/0/
95.141.37.158/0909uk1/NODE01/41/5/4/

Recommended blocklist:
95.141.37.158
vaderhopland.be
anphucconduit.com
lager.leadhoster.com
northinc.com
drhousesrl.it
mariatome.myartsonline.com
cartadegintonics.com
anpilainate.org
raggiottoimpianti.it
importedjewelryoutlet.com