Malware spam: "Notification of Vehicle Tax DD Payment Schedule (Ref: 000000-000005-274421-001)" / "directdebit@taxdisc.service.gov.uk"

This spam does not come from the UK government , but instead is a simple forgery with a malicious payload:

From: directdebit@taxdisc.service.gov.uk
Date: Fri, 26 Jun 2015 15:58:38 +0700
Subject: Notification of Vehicle Tax DD Payment Schedule (Ref: 000000-000005-274421-001)

Important: Confirmation of your successful

Direct Debit instruction

Dear customer

Vehicle registration number: FG08OEE

Thank you for arranging to pay the vehicle tax by Direct Debit.

Please can you check that the details attached below, and your payment schedule are correct.

If any of the above financial details are incorrect please contact your bank as soon as possible.

However, if your details are correct you don’t need to do anything and your Direct Debit will be processed as normal. You have the right to cancel your Direct Debit at any time. A copy of the Direct Debit Guarantee is included with this letter.

For your information, the collection will be made using this reference, and this is how your payment will be detailed on your bank statements:

• DVLA Identifier: 295402
• Reference: FG08OEE

Your vehicle tax will automatically renew unless you notify us of any changes. We will send a new payment schedule at the time of renewal.

Yours sincerely

Rohan Gye

Vehicles Service Manager

www.gov.uk/browse/driving

Attached to the message is a file FG08OEE.doc with a VirusTotal detection rate of 2/55. The macro in it proved resistant to manual analysis, but the Hybrid Analysis does the job easily enough, spotting a download from:

werktuigmachines.be/708/346.exe

This file was also being used in another spam run earlier today.




cccccccccccccccccc