From: accounting@abcimportexport.com Reply-To: userworldz@yahoo.com To: Recipients [accounting@abcimportexport.com] Date: 31 May 2016 at 12:31 Subject: New Company Order
Good Day,
Find
the attached specifications in the purchase order for our company
mid year order & projects before sending your Proforma Invoice and
do get back to me with your quotations asap.
An Official order placement will follow as soon as possible.
This
message (including any attachments) contains confidential information
intended for a specific individual and purpose, and is protected by law.
If you are not the intended recipient, you should delete this message
and are hereby notified that any disclosure, copying, or distribution of
this message, or the taking of any action based on it, is strictly
prohibited.
The link in the email message goes to gallery.mailchimp.com/4dcdbc9b7e95edf6788be6723/files/scan_purchase_orders.zip . This contains a malicious executable scan purchase orders.exe which has a detection rate of 3/56. That VirusTotal report and these other analyses [1][2][3] shows network traffic to:
185.5.175.211 (Voxility SRL, Romania)
This executable drops another similar EXE [4][5][6][7] which phones home to the same IP. Between them, these reports indicate some sort of keylogger. There seems to be little of anything of value in this /24, so I would recommend blocking 185.5.175.0/24
This fake financial spam has a malicious attachment:
From: Lanna Weall Date: 31 May 2016 at 12:18 Subject: New Message from your bank manager
You have 1 new message from bank manager. To read it, please open the attachment down below.
In the sample I saw there was an attachment see_it_77235678.zip containing a malicious script warning_letter_Bdrh5W.js (detection rate 4/57) and the Malwr analysis of that sample shows that it downloads a binary from:
pvprojekt.pl/oLlqvX
The dropped binary is Locky ransomware with a detection rate of 4/56. All those reports plus these analyses [1][2][3] show network traffic to:
From: Meagan Branch Date: 27 May 2016 at 12:35 Subject: Information request
Dear [redacted],
As per our discussion yesterday, please find attached the amended meeting minutes. I have accepted the majority of the changes requested, however there are some that I have left in the document. I have included the edits as track changes.
Please confirm that the changes we have made are acceptable.
Many thanks
Regards,
Oramed Pharmaceuticals Inc.
Meagan Branch Phone: +1 (620) 980-41-94
The senders vary from email to email. Attached is a ZIP file with a malicious script, which in the examples that I have found downloads one of a variety of malicious executables [1][2][3][4] which call home to the same IP addresses found in this earlier spam run.
This German-language spam has a malicious attachment:
From: support@sipcall.de Date: 27 May 2016 at 10:57 Subject: Neue Abrechnung Nr. 746441
Guten Tag
Im Anhang erhalten Sie die neue Rechnung des vergangenen Monates mit der Abrechnungsnummer 746441.
Für eine fristgerechte Bezahlung danken wir Ihnen. Bei Fragen oder Anregungen steht Ihnen unser Kundendienst gerne zur Verfügung.
Freundliche Grüsse
Ihr VoIP Provider
Dies ist eine automatisch generierte Nachricht. Antworten auf diese E-Mail können nicht bearbeitet werden.
Reference numbers vary. Attached is a randomly-named Word document (e.g. INV842038-746441.docm). The sample I submitted to Malwr showed it downloading a binary from:
www.ding-a-ling-tel.com/98yh87nb6v4
Other sources indicate additional download locations at:
This spam email is phishing for email credentials. Unlike some, this one seems to be quite well done and might convince unsuspecting people that it is genuine.
From: M Tufail Shakir [admin@ebookmalls.com] Date: 27 May 2016 at 08:42 Subject: Re: Final PO Contract..xlsx
Please see below attachment for the final signed contract
Regards, 27-05-2016
Tom Yip | Regional Sales Team | Marchon Eyewear (HK) Ltd. Room 1503-05, 15/F, One Island South, 2 Heung Yip Road, Wong Chuk Hang, Hong Kong P: (852) 2814 6674 | tyip@marchon.com
From: Marites [villaventures@hotmail.com] Sent: Thursday, May 26, 2016 2:15 PM To: [redacted] Cc: Jeff Lam; Swallow Yeung Subject: SF and CE Contract
This gives a pretty convincing looking facsimile of an Excel spreadsheet, prompting for credentials..
Entering any combination of username and password seems to work, then you get redirected to a GIF of a spreadsheet..
Curiously, this GIF is not part of a phishing site but is on a wholly legitimate site belonging to a software company called Aspera (you can see it here):
The asperasoft.com domain is NOT involved in the phishing nor has it been compromised. As ever, I would advise you not to explore links like this as they might lead to an exploit kit or malware, and bear in mind that some phishing pages are better than others, and this is one of the more convincing ones that I have seen recently.
This spam appears to come from different companies and senders, and has a malicious attachment:
From: Sara Osborne Date: 26 May 2016 at 10:53 Subject: RE:
Dear sales,
Please find attached a document containing our responses to the other points which we discussed on Monday 23th May.
Please let me know if you have any queries
Regards,
Wayfair Inc.
Sara Osborne
Attached is a ZIP file (the ones I have seen so far all begin with responses_) which contains a malicious script name in a similar way to employees -382-.js. These have a typical detection rate of 4/56.
Two samples analysed by Malwr [1][2] show download locations from:
There will be many other download locations too. These drop two different binaries (VirusTotal results [3][4]). Those two VT results plus these two DeepViz analyses [5][6] show the malware phoning home to:
At first glance this spam looks like malware, but it appears to be a phish instead:
From: General trading ltd [info@7studio.co] Date: 26 May 2016 at 05:04 Subject: Payment
Dear Sir/Ma'am!
As requested by our customer Please find attached telegraphic transfer copy for payment made to your account today.
Kindly confirm once you received this payment.
Regards
Muhammad Farooq Exchange Manager, MCB New Garden Exchange U.A.E (1080) Contact: 971-35866698 - 03004278636
Disclaimer:
This E-mail is
confidential. It may also be legally privileged. If you are not the
addressee you may not copy, forward, disclose or use any part of it. If
you have received this message in error, please delete it and all copies
from your system and notify the sender immediately by return E-mail.
Internet communications cannot be guaranteed to be timely, secure, error
or virus-free. MCB Bank does not accept liability for any errors or
omissions.
Attached is a file TT-USD.pdf .. as a rule I would recommend not opening PDF files or other attachments from unknown sources. When you open the file it looks like this:
Yes, it does look that blurry. The enticement here is to click the link in the document, which is something I wouldn't recommend that you do because it could lead to a malicious download, exploit kit or in this case a simple phishing page hosted on poloimport2012.com.
This seems to be phishing for general webmail credentials. Of course, once a hacker has those they can use your account to send spam or even rifle through your private emails and reset passwords and gain access to other important accounts.
Signing in with any credentials appears to fail, but of course the bad guys have just harvested your password..
As I said, I don't recommend opening files like this and clicking links to see where they go. I use a test environment to do this, but some similar spam emails can deliver malware that will silently plant itself on your computer which can be even more dangerous than this phish.
This fake financial spam comes from random senders and companies and has a malicious attachment:
From: Alicia Ramirez Date: 25 May 2016 at 14:22 Subject: Weekly report
Hi [redacted],
Please find attached the Weekly report.
King regards,
Alicia Ramirez Castle (A.M.) & Co.
There are a large number of these, with a ZIP file attached containing a malicious scripts with a typical detection rate of 3/56. In this sample Malwr analysis, it downloads a file from:
test.glafuri.net/yxk6s
There will certainly be a LOT of other download locations. The dropped file GSKQtcnNu8MS.exe has a detection rate of 4/55 and that same VirusTotal report indicates C2 traffic to:
Even though other automated analysis failed [1][2] this time we have previously identified two of those IPs as being Locky ransomware, so there is little doubt that this will be more of the same.
From: Justin harmon Date: 25 May 2016 at 12:30 Subject: URGENT - DELIVERY
Dear customer.
Please find the attachment.
-- Thanks & Best Regards
Jobin Jacob HYTEX Ph: +974-44506682 Mob:+974-70400514,55129954
Attached is a ZIP file that contains one of many scripts that downloads a binary from one of the following locations (according to a trusted third party, thank you!):
Where[random-string] seems to be a random alphanumeric string. The dropped binary is Locky ransomware (as seen in this Malwr report) which phones home to:
These fake financial spams come from different companies, all with a malicious attachment.
From: Frank.ClaraZO@pr-real.com Date: 25 May 2016 at 11:34 Subject: The invoices from INCHCAPE PLC
Hello, Following the phone conversation with the accounting department represantatives I'm sending you the invoices.
Thank you for attention, Kind regards Clara Frank INCHCAPE PLC tel. (2045)/641493 54
> Sent from Iphone
Attached is a ZIP file with a name similar to Invoice 5044-032841.zip which in turn contains a malicious script named in a similar manner to invoice(677454).js which typically has a detection rate of 3/56. Hybrid Analysis of that sample shows the script creating a PFX (personal certificate) file which is then transformed into a PIF (executable) file using the certutil.exe application.
This PIF file itself has a detection rate of 6/56 but automated analysis [1][2][3] is inconclusive. The behaviour is somewhat consistent with the Dridex banking trojan but may possibly be Locky ransomware.
These fake security warnings come with a malicious attachment:
From: Jennings.KarlaVk@ttnet.com.tr Date: 24 May 2016 at 11:48 Subject: Account Compromised
Attention!
Suspicious logon attempt to your account was detected (Chrome browser, IP-address: 108.127.172.96)
Reason: unusual IP
Please refer to the attached report to view further detailed information.
BMJ Group
tel. (4813)/675337 33
> Sent from iPad
--------------
From: Hooper.Cecilep@hotelaviatrans.am Date: 24 May 2016 at 11:40 Subject: Suspicious logon attempt
Attention!
Suspicious logon attempt to your account was detected (Chrome browser, IP-address: 223.149.173.250)
Reason: unusual IP
Please refer to the attached report to view further detailed information.
YUJIN INTL LTD
tel. (4020)/438007 92
> Sent from iPad
In the two samples I have seen, there are attachments named Security Report.zip and Security Notification.zip which in turn contain a Word document with a name such as Security Report ID(11701573).doc
The two documents that I have seen have detection rates of about 3/56 [1][2] but according to these automated analyses [3][4][5][6] it seems that the infection doesn't work properly, failing to find a created file harakiri.exe. This Malwr report shows a dropped file named harakiri.pfx which isn't an executable, my guess is that this is an encrypted file that hasn't decrypted properly.
UPDATE
According to a third party analysis, this apparently drops Dridex which phones home to:
This fake TNT notification is phishing for credentials:
From: TNT Express Reply-To: sh3llsh0p@yahoo.com Date: 24 May 2016 at 11:34 Subject: TNT Consignment Notification
Attention: [redacted],
TNT is pleased to advise you that ANTONIOU KONSTANTINOS has arranged for a shipment to be collected from them on May 23, 2016 , and delivered to You on 275th May 2016.
The shipment has a TNT CONSIGNMENT NOTE NUMBER: 119138390
To be able to check the status of the shipment simply visit or click below to track.
From :
ANTONIOU KONSTANTINOS
Theokritou 5
THESSALONIKI
THESSALONIKIS
546 27
GR
Pieces : 1
Weight : 0.5 KG
Shipment reference :
Description : sample
If you would like to find out about the many ways TNT helps you to track your shipment, or if you would like to know more about the services provided by TNT, simply connect to www.tnt.com and select your location at any time.
---------------------------------------------------------------------------------------------------------------
This message and any attachment are confidential and may be privileged or otherwise protected from disclosure.
If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system.
If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person.
Please consider the environmental impact before printing this document and its attachment(s). Print black and white and double-sided where possible.
------------------------------------------------------------------------------
The link in the email is disguised to make it look like a link to tnt.com, but in face it goes to:
This URLquery report shows what is going on, as the victim ends up on a laughably fake phishing page:
Presumably this is phishing for general email credentials rather than a TNT login. Orignating IP is 87.106.178.108 (1&1, Germany) via an apparently compromised account or server at pmdf01b.rit.edu
Here's an Angler EK cluster, hosted on multiple ranges rented from OVH France.. working first from this list of Angler IPs in OVH address space we can see a common factor.
One handy thing that OVH does with suballocated ranges is give clear details about the customer. This certainly helps track down abusers. In this case, the ranges these IPs are in are allocated to:
This alarming looking spam has a malicious attachment:
From: Bradyrian Hassell Date: 23 May 2016 at 14:00 Subject: Account Deleted
Your bank account has been deleted,more information attached.
I have only seen a single copy of this and the ZIP file attached was corrupt, however, it is very likely that this is a variant of the Locky ransomware run from earlier today.
This spam appears to come from random senders, and leads to Locky ransomware:
From: Graham Roman Date: 23 May 2016 at 11:59 Subject: Re:
Hi [redacted]
Please find attached the file we spoke about yesterday.
Thank you,
Graham Roman
PCM, Inc.
Attached is a ZIP file starting with copy_invoice_ and then a random sequence. This contains a malicious script file which in the sample I analysed downloads an obfuscated binary from:
Automated analysis of the script [1][2] shows it dropping a file klA1KMQj2D.exe which has a VirusTotal detection rate of 5/56. Those prior reports plus these additional analyses of the binary [3][4][5] show network traffic to:
This spam comes from random senders and has a malicious attachment. Here is an example:
From: Frederic Spears Date: 20 May 2016 at 10:29 Subject: Re:
Hi [redacted],
I wanted to follow up with you about your refund.
Please find the attached document
Regards,
Frederic Spears
CBS Corporation
The company name and sender's name varies from message to message. Attached is a ZIP file which contains elements of the recipient's name, which in turn contains one of a variety of malicious scripts. Out of the samples I have seen, I have so far found download locations of:
Only three of those download locations work so far (VirusTotal results [1][2][3]) and automated analysis of those [4][5][6][7][8] shows behaviour consistent with Locky ransomware. All of those reports show the malware phoning home to:
From: Britney Hart Date: 16 May 2016 at 13:15 Subject: Re:
hi [redacted]
I have attached a revised spreadsheet contains customers. Please check if it's correct
Regards, Britney Hart
Other variations of the body text seen so far:
I have attached a revised spreadsheet contains general journal entries. Please check if it's correct I have attached a revised spreadsheet contains estimates. Please check if it's correct
Attached is a ZIP file with three identical malicious .js files. The ones I have seen so far download from
There are probably other download locations. Each one downloads a slightly different binary (VirusTotal prognosis [1][2][3]) and automated analysis [5][6][7][8][9] shows the malware phoning home to:
From: victim@victimdomain.tld To: victim@victimdomain.tld Date: 11 May 2016 at 12:39 Subject: Emailing: Photo 05-11-2016, 03 26 04
Your message is ready to be sent with the following file or link attachments:
Photo 05-11-2016, 03 26 04
Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled.
It appears to come from the sender's own email address, but this is a simple forgery (explained here). Attached is a ZIP file with a name similar to Photo 05-11-2016, 03 26 04.zip (the numbers in the attachment
match the references in the email). It contains a .js file with a similar name.
Trusted third-party analysis (thank you!) shows the various scripts downloading from:
This drops a file with a detection rate of 3/56. This is likely to be Locky ransomware, a full analysis is pending. However an earlier Locky campaign today phoned home to:
185.82.202.170 (Host Sailor, United Arab Emirates) 88.214.236.11 (Overoptic Systems, UK / Russia) 5.34.183.40 (ITL, Ukraine)
According to a DeepViz report, this sample has identical characteristics.
This fairly brief spam has a malicious attachment:
From: Alexandra Nunez Date: 10 May 2016 at 21:10 Subject: Re:
hi [redacted],
As promised, the document you requested is attached
Regards,
Alexandra Nunez
The name of the sender varies. Attached is a ZIP file with a name export_xls_nnn.zip or wire_xls_nnn.zip (where nnn are random letters and numbers) which contains multiple copies of the same malicious .js file (all apparently beginning urgent). These scripts download slightly different binaries from several locations including:
I blogged about "Project Management International" last year, an outfit running (in my personal opinion) fake or low-quality seminars, at that time using the domain projectmanagementinternational.org.
This outfit is run by Anthony Christopher Jones and Patchree "Patty" Patchrint (aka Patty Jones) from California. I've written about this oufit several times in the past five years, but it turns out that Jones and Patchrint have been running similar schemes since 2008.
In 2011 ABC15 news in Arizona investigated a previous incarnation of these scheme, named "NAPPPA"...
These Jones / Patchrint operations seem to pop up from time to time and then disappear, usually after being exposed for what they are. This latest iteration of the fake "Project Management International" organisation uses the domain projmanagementintl.org. It's a flashy-looking site, but really it is just made from a standard template.
The "Registration" page lists some prestigious universities as hosting these courses.
From what I can tell, the usual thing that happens is that at the last minute the location is changed to a nearby hotel or conference centre, and it seems that no booking are ever made with the university. All feedback on the courses seems to indicate that they are all of very poor quality. There are numerous reports that the people hired to teach these courses are also not paid as promised.
The courses themselves are advertised through spam email (example here)
The Project Management Fundamentals Course
will be offered May 25-27, 2016 at the University of Utah campus in Salt Lake City, Utah. Project management professionals, business and technology professionals, students, and educators are invited to register at the Project Management International website here .
May 25-27, 2016 Salt Lake City, Utah8:00am - 5:00pm
The Project Management Fundamentals Course
is designed for those seeking professional project management certification. It serves as a thorough introduction to the fundamentals of project management. Those seeking additional credentials such as the PMP®/PgMP®, PMI-SP®, and PMI-RMP® will benefit from this dynamic and interactive work session, while those currently holding credentials will find the certification to be an enhancement as well as the most up to date advanced professional development.
Project Management Fundamentals Course provides 24 hours of project management education hours for both PMI's Certified Associate in Project Management (CAPM)
® and Project Management Professional (PMP) certifications. Additionally, the Master Certification provides 24 Professional Development Units (PDUs) for current holders of PMP®/PgMP®, PMI-SP®, and PMI-RMP® credentials. Additionally, the program awards 2.4 Continuing Education Units (CEUs) upon request.
Program Description
Our certificate program teaches technical and business professionals how to master the critical skills of project management techniques as part of their technical career development.
The skills developed in the Project Management Fundamentals Course apply to large and small projects, product design and development efforts, construction projects, IT projects, software development, and any project with critical performance, time, and budget targets.
Our approach to project management education offers proven, results-focused learning.
Courses are developed and facilitated by professional subject experts with extensive industrial experience. Course emphasis is on providing practical skills and tools supported by relevant case examples.
Tuition
Tuition for the three-day Project Management Fundamentals Course is $595.00
Program Schedule and Content
1.Project Initiation, Costing, and Selection, Day 1
2.Project Organization and Leadership, Day 1
3.Detailed Project Planning, Day 2
4.Project Monitoring and Control, Day 2
5.Project Risk and Stakeholder Management, Day 3
Benefits
·A Project Management International Certificate of Accomplishment is awarded upon completion of the three day program. ·
Our instructors have extensive industrial experience. They focus on providing you with practical skills and tools using relevant case examples.· Each class is highly focused and promotes maximum interaction.·
You can network with other project management professionals from a variety of industries.· Earn Professional Development Units (PDUs) for maintenance of certification under the PMI Continuing Certification Requirements Program.·
Applicants for PMI's Certified Associate in Project Management (CAPM)® and Project Management Professional (PMP) certifications will receive 24 project management education hours towards the requirements for eligibility.
Registration
Participants may reserve a seat online at the Project Management International website
, by calling the Program Office toll-free at (888) 201-6372, or by sending their name and contact information via email to the Program Registrar.
Upon receiving your registration, a confirmation email is sent to registrants that include session site information, travel information, program description, and details on how to confirm attendance and make payment arrangements.
To unsubscribe from this mailing list, simply reply to this message and write EXCLUDE to be removed from future notices.
Contact numbers listed on the spamvertised site are:
If you see these telephone numbers on other seminar sites, then it will be the same operation. The site quotes a PO box as a contact address but reveals no other information about this so-called corporation.
Project Management International PO BOX 812112 Los Angeles, California 90081
If you feel you have been scammed by this operation then I urge you to report it to the police, FBI, FTC or your local AG's Office. If you would like to share your experiences (positive or negative) then please feel free to use the Comments section below.
This fake financial spam leads to malware. Details change slightly from email to email:
From: Administrator [adminHb@victimdomain.tld] Date: 5 May 2016 at 11:29 Subject: Statement 6BBC0E
Please See Attached
______________________________________________________________________ Scanned by MailDefender Plus, powered by Symantec Email Security.cloud http://www.intycascade.com/products/symantec/ ______________________________________________________________________ --- This email has been checked for viruses by Avast antivirus software. http://www.avast.com
It must be safe.. scanned by both Symantec and Avast! Well, of course that's just BS and the attached DOC file leads to malware, specifically the same payload as seen in this slightly earlier spam run.
This fake document scan appears to come from within the victim's own domain (but this is just a simple forgery) and has a malicious attachment:
From: DocuCentre-IV [DocuCentre1230@victimdomain.tld] Date: 5 May 2016 at 10:27 Subject: Scan Data
Number of Images: 1
Attachment File Type: PDF
----=_Part_45251_4627454344.4826709420825--
Details vary slightly from message to message. Attached is a DOC file (not a PDF) starting with PIC, DOC or IMG in the samples I have seen plus a random number. Typical VirusTotal detection rates are 6/56 [1][2][3][4][5][6]. Various automated analyses of these documents [7][8][9][10][11][12] [13][14][15][16][17] show a binary being downloaded from the following locations:
This spam email comes with a malicious attachment.
From: Elfrida Wymer [WymerElfrida9172@recordshred.com] Date: 3 May 2016 at 12:40 Subject: You Are Fired BBF904D
We regret to inform you, yet we no longer need require your services. Attached you can find additional information and the payout roll for the last month.
It's a bit of a self-fulfilling prophecy. If you are daft enough to download the ZIP file, and extract and run the script then perhaps you WILL get fired.
