Sponsored by..

Wednesday 3 February 2016

Malware spam: "Attached Image" from canon@ the recipient's own domain

This spam pretends to come from the victim's own domain, but it doesn't. Instead it is a simple forgery with a malicious attachment.
From:    canon@victimdomain.tld
Date:    3 February 2016 at 12:09
Subject:    Attached Image
There is no body text. Attached is a file 1690_001.xls of which I have seen a single variant with a detection rate of 9/54. The Hybrid Analysis shows it downloading an executable from:


This has a detection rate of 6/51 and is the same binary as used in this other spam attack today.

No comments: