Sponsored by..

Monday 13 October 2014

"Your Amazon.co.uk order" spam with malformed DOC attachment

A whole bunch of these just came through:

From:     AMAZON.CO.UK [order@amazon.co.uk]
To:     1122@eddfg.com
Date:     13 October 2014 08:32
Subject:     Your Amazon.co.uk order }837-1171095-3201918

Hello,

Thanks for your order. We’ll let you know once your item(s) have dispatched.You can view the status of your order or make changes to it by visiting Your Orders on Amazon.co.uk.

Order Details

Order #837-1171095-3201918 Placed on October 11, 2014
Order details and invoice in attached file.
Need to make changes to your order? Visit our Help page for more information and video guides.
We hope to see you again soon. Amazon.co.uk

The order number changes in each version of the spam. Note the misplaced "}" in the title though.. that's not the only thing wrong with this spam.

Attached is a file with a random number and a DOC extension, but in fact it is a plain text attachment that begins:

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAIgAAAAAA
AAAAEAAAJAAAAAEAAAD+////AAAAACEAAAD/////////////////////////////////////
////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////
///////////////////////////////////spcEAKWAZBAAA8BK/AAAAAAAAEAAAAAAABgAA
AQgAAA4AYmpiaoARgBEAAAAAAAAAAAAAAAAAAAAAAAAZBBYALhAAAOJ7AADiewAAAQAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//w8AAAAAAAAAAAD//w8AAAAAAAAAAAD//w8A
AAAAAAAAAAAAAAAAAAAAAKQAAAAAALADAAAAAAAAsAMAALADAAAAAAAAsAMAAAAAAACwAwAA
AAAAALADAAAAAAAAsAMAABQAAAAAAAAAAAAAAOoDAAAUAAAAIgQAAAAAAAAiBAAAAAAAACIE


Obviously something has gone wrong here, it looks like the attachment is Base 64 encoded when it shouldn't be, but running it through a decode still seems to generate nothing but junk.

My guess is that something has gone wrong with this spam run, and this is meant to be a malicious executable. As it stands, neither the original or decoded version trigger anything at VirusTotal [1] [2]. There's a good chance that the bad guys will figure this out and fix it though, so be cautious if you receive an unexpected email from Amazon.


1 comment:

MB said...

Hi, I've decoded the base64 sample again. This is the output. pastebin.com/EwnN922V
Best M