Malware spam: "Invoice for Payment" / "CivicaReports@plymouth.gov.uk"

This fake invoice spam foes not come from Plymouth City Council but is instead a simple forgery with a malicious attachment.

From     [CivicaReports@plymouth.gov.uk]
Date     Thu, 08 Oct 2015 14:03:31 +0400
Subject     Invoice for Payment

THIS IS A POST-ONLY EMAIL. PLEASE DO NOT REPLY TO THIS MESSAGE. THIS
EMAIL ADDRESS
IS NOT MONITORED FOR RESPONSES.

From: Plymouth LIVE SYSTEM (New)

Please find attached your invoice for payment in accordance with our
agreed terms and conditions.

The invoice is sent in PDF format. Double click on the attachment to
open the file.

PDF files require Adobe Acrobat Reader to view them. Download Adobe
Acrobat Reader
free of charge from the Adobe website at www.adobe.com/products/reader


For enquiries specifically relating to this invoice, please e-mail :
incomes@plymouth.gov.uk

This e-mail is confidential and intended for the exclusive use of the
addressee.

Any views or opinions expressed in this e-mail do not necessarily
represent those of Plymouth City Council, and are not to be relied upon
without subsequent written confirmation by an authorised representative.
If you are not the addressee, any disclosure, reproduction,
distribution, forwarding, or other dissemination or use is strictly
prohibited. If you have received this e-mail in error please notify the
Plymouth City Council Transaction Centre (incomes) helpdesk on 01752
304443

Plymouth City Council, The Civic Centre, Armada Way, Plymouth, PL1 2AA.

Telephone : 01752 668000 Website : www.plymouth.gov.uk

There are at least four different version of the document in circulation, each containing a malicious macro. Download locations spotted so far are:

katastimataone.com/bvcb34d/983bv3.exe
vsehochuti.unas.cz/bvcb34d/983bv3.exe
swaineallen.uk/bvcb34d/983bv3.exe
archives.wnpvam.com/bvcb34d/983bv3.exe

The payload is exactly the same as used in this spam run.

MD5s:
bb4d2d606091de154e81e292036981c8
80fba8c6b4947cea3d55cef66515d70f
1f5d975dedd140e62f794993792d906b
de413dd09e70e1dc48c5060afe3f87f0
70570b4d1806a25414959d7967bb542f