"You've received a new fax" spam

Somebody has sent me a facsimile transmission. How quaint.

From:     Fax
Date:     16 September 2014 11:05
Subject:     You've received a new fax

New fax at SCAN0204102 from EPSON by https://victimdomain
Scan date: Tue, 16 Sep 2014 15:35:59 +0530
Number of pages: 2
Resolution: 400x400 DPI

You can download your fax message at:

http://ngujungwap.mobi.ps/sgfyzdptdc/gotmvoeqkk.html

(Google Disk Drive is a file hosting service operated by Google, Inc.)

The link is so obviously not anything to do with Google. Clicking on it loads another script from triera.biz.ua/twndcrfbru/zjliqkgppi.js which in turn downloads a ZIP file from www.yerelyonetisim.org.tr/pdf/Message_2864_pdf.zip which has a VirusTotal detection rate of 3/55.

This malware then phones home to the following locations, according to this ThreatTrack report:

188.165.204.210/1609uk4/NODE01/0/51-SP3/0/
188.165.204.210/1609uk4/NODE01/1/0/0/
188.165.204.210/1609uk4/NODE01/41/5/4/
brisamarcalcados.com.br/css/1609uk4.lim

Recommended blocklist:
188.165.204.210
brisamarcalcados.com.br
triera.biz.ua
yerelyonetisim.org.tr
ngujungwap.mobi.ps

"inovice 0293991 September" spam

This spam mis-spells "invoice" in the subject line, and has an .arj file attached that contains a malicious binary.

Example subjects:
inovice 8958508 September
inovice 7682161 September
inovice 4868431 September
inovice 0293991 September

Body text:
This email contains an invoice file attachment

The name of the attachment varies, but is in the format invoice_8958508.arj which contains a malicious executable invoice_38898221_spt.exe which has a VirusTotal detection rate of just 3/54. The ThreatTrack report [pdf] and Anubis report show a series a DGA domains [pastebin]
 that are characteristic of Zbot, although none of these domains are currently resolving.

If your organisation can block .arj files at the mail perimeter then it is probably a good idea to do so.

Sage "Outdated Invoice" spam

Another day, another fake Sage email leading to malware:

From:     Sage Invoice [invoice@sage.com]
Date:     15 September 2014 12:08
Subject:     Outdated Invoice

Sage Logo
 Sage Account & Payroll

You have an outdated invoice from Sage Accounting that is ready for payment. To find out more details on this invoice, please follow the link bellow or click here to view/download your account invoice:

https://invoice.sage.co.uk/Account?336541=Invoice_090914.zip


If we hold any information about you which is incorrect or if there are any changes to your details please let us know by so that we can keep our records accurate and up to date. If you would like to update your records or see a copy of the information that we hold about you, you can contact us at Data Protection Officer, Sage (UK) Ltd, North Park, Newcastle-upon-Tyne, NE13 9AA or by email to digital@sage.com. If you request a copy of your information you will need to pay a statutory fee which is currently £10.

The contents of this email and any attachments are confidential. They are intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to anyone or make copies.

We have communicated this information with users as well, and we will continue to communicate with you through email as your transition continues.

This email was sent to: [redacted]

This email was sent by: Sage UK Limited
NC1-002-08-25, Newcastle upon Tyne., North Park, NE13 9AA, United Kingdom

Privacy and Security
Keeping your financial information secure is one of our most important responsibilities. For an explanation of how we manage customer information, please read our Privacy Policy. You can also learn how Sage UK Limited keeps your personal information secure and how you can help protect yourself.

In the sample I had, the link in the email went to:

[donotclick]flashsavant.com/fauvugalwr/czkyfybjyt.html

which then attempted to load scripts from:

[donotclick]vicklovesmila.com/tpfkmryrfl/jjbyrihwib.js 
[donotclick]coursstagephoto.com/hmgjmyuliz/tbjzpxgspx.js 

which in turn downloads an archive file from:

[donotclick]www.florensegoethe.com.br/emailmmkt/Invoice18642.zip
[donotclick]petitepanda.net/emailmmkt/Invoice18642.zip

This ZIP file contains a malicious executable Invoice18642.scr which has a VirusTotal detection rate of just 1/55. The ThreatTrack report [pdf] shows that it attempts to communicate with the following resources:

188.165.204.210/1509uk1/NODE01/0/51-SP3/0/
188.165.204.210/1509uk1/NODE01/1/0/0/
green-fuel.us/upload/box/1509uk1.ltc
www.green-fuel.us/upload/box/1509uk1.ltc

Recommended blocklist:
188.165.204.210
green-fuel.us
petitepanda.net
florensegoethe.com.br
coursstagephoto.com
vicklovesmila.com
flashsavant.com

"Overdue invoice #6767390" spam has a malicious .arj attachment

This fake invoice email has a malicious attachment:

From:     Mauro Reddin
Date:     15 September 2014 10:32
Subject:     Overdue invoice #6767390

Morning,

I was hoping to hear from you by now. May I have payment on invoice #84819995669 today please, or would you like a further extension?

Best regards,
Mauro Reddin
+07843 329907

The attachment is an archive file invc_2014-09-15_15-07-11_6767390.arj so in order to get infected you would need an application capable of handling ARJ archives. Once unpacked, there is a malicious executable called invc_2014-09-15_15-07-11_88499270.exe which has a VirusTotal detection rate of just 1/55.

The Comodo CAMAS report shows the malware attemping to phone home to golklopro.com/bitrix/modules.php which is multihomed on a number of IPs that look like a botnet to me.

UPDATE:  The ThreatExpert report also shows an attempted phone-home to cosjesgame.su (also on a botnet) plus an attempted download from the following locations:

teles4.com/333.exe
gavilan.cl/333.exe
emstudio.fr/333.exe
calduler.com/333.exe
iamsaved.org/333.exe

This malware looks like Zbot and is poorly detected by VirusTotal. The ThreatTrack report [pdf] shows that the malware attempts to connect to a bunch of domains that do not currently resolved (listed here [pastebin]).

I recommend that you apply the following blocklist:

golklopro.com
cosjesgame.su
teles4.com
gavilan.cl
emstudio.fr
calduler.com
iamsaved.org
71.204.29.102
80.87.146.106
87.244.34.238
94.154.220.16
109.200.151.96
141.101.28.223
176.36.186.138
178.151.131.75
198.200.87.184
213.110.131.122
213.177.115.141
46.46.104.39
62.122.92.41
91.237.109.103
92.112.228.242
94.244.177.42
95.76.204.117
98.14.34.141
109.161.32.192
109.229.198.37
134.249.73.242
134.249.202.165
194.187.111.74
217.12.122.58
217.175.148.201

Added:
For information, the WHOIS details for cosjesgame.su are as follows:
domain:        COSJESGAME.SU
nserver:       ns1.floujorjnska.su.
nserver:       ns2.floujorjnska.su.
nserver:       ns3.floujorjnska.su.
nserver:       ns4.floujorjnska.su.
state:         REGISTERED, DELEGATED
person:        Private Person
e-mail:        agartudd@85mail.com
registrar:     R01-REG-FID
created:       2014.09.10
paid-till:     2015.09.10
free-date:     2015.10.13
source:        TCI

UPDATE 2014-09-16: a second binary is doing the rounds, the detection rate for this at the moment is 27/55. Initial analysis suggests that it calls home to the same domains and IPs as listed above.

Inspiration Mining Corporation (T.ISM / ISM.TO) pump-and-dump spam

This pump-and-dump spam for Inspiration Mining Corporation (T.ISM) follows on from this recent spam run, but this time it is pushing it under a different stock ticker.

From:     YahooFinance Canada
Date:     15 September 2014 08:14
Subject:     Biggest Trade Of 2014

YahooFinance Canada
View this email in your browser
Hurry! Biggest Trade Of 2014

Hey [redacted]

I have a new stock recommendation for you.
The company is called inspirationmining and it's trading in canada under the symbol ISM. Currently it's priced at right under 10 cents but by next week it should hit 30 or 40 even. I know this because my wife's uncle is the geologist at the company and they literaly just struck gold.

Move quickly on this.
Copyright (c) 2014 YahooFinance Canada Monthly, All rights reserved.
You have been sent this email as a friend of the Monthly.

Our mailing address is:
The Monthly 37-39 Langridge St Collingwood, Victoria 3066 Australia
unsubscribe from this list update subscription preferences

According to reports here the shares were recently suspended due to the pump-and-dump run that the company denies is anything to do with them. However, my previous analysis is that the P&D run is (in my personal opinion) most likely being orchestrated by an existing major stockholder rather that someone buying into the stock in order to manipulate it.

The pump and dump spam does seem to have raised the stock price from about 7.5 cents to 10.5 cents [source] but the chances are that the stock is worth much closer to zero. Avoid.

UPDATE 2014-09-16:
More spam has turned up overnight..

From:     Financial Post | Canadian
Date:     16 September 2014 07:35
Subject:     ISM.TO Is Back In Position For A Huge Jump

Financial Post | Canadian Business News, Investing and Commentary


One Cent Alert That's Ready To Pop
Tuesday, 16th September 2014

    The only company that should be on your trading screen today
    This stock can double fast

the more you wait the more it'll cost you to pick up shares of InspiraitonMinnig Corporation ( ISM . TO on the canadian exchange). this junior miner has been soaring the last few weeks since their discovery of billions in precious metals on one of their properties. act fast before cheapies run out.




All content is (c) 2005 - 2014 Port Phillip Publishing Pty Ltd All Rights Reserved
To remove your name from Money Morning and associated external offers sent from Money Morning, click here.
Port Phillip Publishing
Attn: Money Morning
PO Box 713 South Melbourne VIC 3205
Tel: 1300 667 481 Fax: (03) 9558 2219

From:     NYTimes Finance
Date:     15 September 2014 17:01
Subject:     ISM.TO Alert: Possible +280pct Rally This Week

If you have trouble reading this email, please click here


Monday, September 15, 2014
Morning Report

Did you catch my report on already?  | Believe me when I tell you that this rare chance only comes once a year, if we're lucky. There is an amazing company trading on the canadian market called InspirtaionMiningCorp (symbol is ISM.TO) and they are sitting on hundreds of millions of precious metals reserves. From Copper to Gold and Silver. As they begin extracting them soon we expect investors to take notice and the share price to soar past a dollar!
About This Email

You received this message because you signed up for NYTimes.com's Finance Email newsletter. As a member of the Truste privacy program, we are committed to protecting your privacy.
Manage Subscriptions| Unsubscribe| Change Your Email| Privacy Policy| Contact| Advertise
Copyright 2014 | The New York Times Company |NYTimes.com 620 Eighth Avenue New York, NY 10018

From:     BNN Financial News
Date:     15 September 2014 21:57
Subject:     The Race Is On!

Update Profile / Unsubscribe

BNN - Business and Financial News, Analysis.
Good Morning Readers!

Did you catch my report already?

...as you can see my latest stokc tip is going up like never before. i told you to take a look at [-ISM.TO-] (inpsirationMining) trading on the canadian exchange and since i contacted you about it we have seen tremendous gains. that company is literaly sitting on gold and other precious metals. make sure to buy it before it goes nuts. 

"To All Employee's - Important Address UPDATE" spam leads to Cryptowall

This fake HR spam leads to a malicious ZIP file:

From:     Administrator [administrator@victimdomain.com]
Date:     11 September 2014 22:25
Subject:     To All Employee's - Important Address UPDATE

To All Employee's:The end of the year is approaching and we want to ensure every employee receives their W-5 to the correct address.Verify that the address is correct - https://local.victimdomain.com/details.aspx?id=6871049687 If changes need to be made, contact HR at https://hr.victimdomain.com/update.aspx?id=6871049687. Administrator,http://victimdomain.com

To All Employee's:
The end of the year is approaching and we want to ensure every employee receives their W-5 to the correct address.
Verify that the address is correct - https://local.victimdomain.com/details.aspx?id=6871049687
If changes need to be made, contact HR at https://hr.victimdomain.com/update.aspx?id=6871049687.

 Administrator,
http://victimdomain.com

 The link in the email goes to the same site as described in this earlier post, which means that the payload is Cryptowall.

"rooms reservation" spam leads to a malicious Word document

This fake hotel booking email has a malicious Word document attached:

From:     Zorita [info@convividautore.it]
Date:     11 September 2014 15:02
Subject:     rooms reservation

Dear Hotel Manager,

I would like to reserve accommodation for 5 single rooms in your hotel for 7 nights for 5 guests.

Arrival date will be on 16 September.

List any special requirements attached to letter.

Thank you for your prompt attention to the above, I look forward to receiving a letter confirming my reservation.

Kind Regards

The Word document attempts to persuade the victim to remove the security settings from the application:

The text says:

This error usually occurs because of macro security settings.  To check your macro security settings, click the Microsoft Office Button, click Microsoft Word Options, click Trust Center, and then click Trust Center Settings. If macro security is set to Disable all macros without notification, all macros are automatically disabled. Use the following procedure to enable the macro. In the Trust Center dialog box, click Macro Settings, and then click Disable all macros with notification. Click OK in the Trust Center dialog box to apply the new setting. Click OK to close the program options dialog box. Close the file and the Microsoft  Word. Open the file again. A Security Alert appears in the Document Information Bar just below the ribbon. Click Enable Content to allow the macro to run.

The document itself has a VirusTotal detection rate of 9/54.

If you are foolish enough to do this, the document will then download an additional component from colfdoc.it/cart/update.exe (77.81.241.104) which in turn has a detection rate of 5/55. The ThreatTrack report [pdf] shows that the malware attempts to communicate with:

cityhotlove.com/datastat/datacoll.php (109.120.177.164)
cyklopesek.cz/css/r.pack (90.182.221.59)



I would recommend blocking the following:
109.120.177.164
cityhotlove.com
cyklopesek.cz
colfdoc.it

eFax spam leads to Cryptowall

Yet another fake eFax spam. I mean really I cannot remember the last time someone sent me a fax. What's next? "Someone has sent you a telegram"?

From:     eFax [message@inbound.efax.com]
Date:     11 September 2014 20:35
Subject:     eFax message from "unknown" - 1 page(s), Caller-ID: 1-865-537-8935

Fax Message [Caller-ID: 1-865-537-8935
You have received a 1 page fax at Fri, 12 Sep 2014 02:35:44 +0700.

* The reference number for this fax is atl_did1-1400166434-52051792384-154.

Click here to view this fax using your PDF reader.

Please visit www.eFax.com/en/efax/twa/page/help if you have any questions regarding this message or your service.

Thank you for using the eFax service!

       

j2 Global | eFax | eVoice | FuseMail | Campaigner | KeepItSafe | OneBox

2014 j2 Global, Inc. All rights reserved.
eFax is a registered trademark of j2 Global, Inc.

This account is subject to the terms listed in the eFax Customer Agreement.

I bet you've already guessed that the link in the message goes somewhere bad, in this case it downloads a ZIP files from cybercity-game.com/game/Documents.zip which unzips to a malicious executable Documents.scr which has a pretty low VirusTotal detection rate of 2/55.

The ThreatTrack report clearly identifies this as Cryptowall and identifies that it either downloads data from or posts data to the following locations:

188.165.204.210/1109inst2/NODE01/0/51-SP3/0/
188.165.204.210/1109inst2/NODE01/1/0/0/
mtsvp.com/files/3/install2.tar
suspendedwar.com/87n3hdh5wi04gy
suspendedwar.com/ttfvku8z7jn
goodbookideas.com/wp-content/themes/twentyeleven/111.exe
suspendedwar.com/gwfqwaratrpl2c
suspendedwar.com/h0nxfsskh0xu
suspendedwar.com/kvlfhc0hjgo6sgo

The 111.exe has a much wider detection rate of 22/53 and according the the ThreatTrack analysis of that binary there is some sort of network connection to the following IPs:

193.169.86.151
193.19.184.20

Overall, the web hosts involved are:
46.151.145.11 (Swift Trace Ltd, Crimea)
50.63.85.76 (GoDaddy, US)
76.74.170.149 (Daiger Sydes Gustafson LLC / Peer 1, US)
188.165.204.210 (OVH, France)
193.19.184.20 (PE Intechservice-B, Ukraine)
193.169.86.151 (Ivanov Vitaliy Sergeevich, Ukraine)

I would recommend blocking the following:
188.165.204.210
193.19.184.20
193.169.86.151
goodbookideas.com
mtsvp.com
suspendedwar.com

Malicious WordPress injection sending to 178.62.254.78 and 176.58.100.98

There is currently some sort of injection attack against WordPress sites that is injected code into the site's .js files. Not so unusual.. except that the payload site in the file changes every half hour or so.

A sample of the code can be seen here [pastebin], it looks similar to this (click to enlarge):

The site mentioned in the IFRAME is the one that keeps changing, so presumably there is either something running on the compromised WordPress site, or there is some other mechanism for the bad guys to update the details. The URLs I have seen recently are as follows:

[donotclick]sexyunanu.inthepress.org/bububiolasa16.html
[donotclick]binoduselda.vagfans.info/stickomanus16.html
[donotclick]binoduselda.finalmasterplugin.com/ditirakis16.html
[donotclick]binoduselda.ireleaseme.com/falcoruide16.html
[donotclick]binoduselda.hyakunime.net/bibkajuleman16.html
[donotclick]binoduselda.bateriafina.org/filimanuio16.html

All these subdomains are hijacked from legitimate domains using AFRAID.ORG nameservers, and are hosted on 178.62.254.78 (Digital Ocean, Netherlands). These then pass the victim onto another domain in the format

[donotclick]piplakoras.askhartleyauto.com/3674e375m87i/1/9ffbf35e4190fbba62f70c8477fa3964.html

which is hosted on 176.58.100.98 (Linode, UK). The URL structure indicates that this might be the Nuclear Exploit Kit, although it has been hardened against analysis.

I can't detect all the sites on 178.62.254.78, but a list of the ones I have observed so far can be found here [pastebin] and those on 176.58.100.98 can be found here. But blocking the following IPs may give you better protection:

176.58.100.98
178.62.254.78

Update 2014-09-12 0830 UTC: overnight a whole set of other malicious subdomains (hijacked again from AFRAID.ORG users) were active, using the same IPs to spread malware. The domains change every 30 to 60 minutes or so.

iflaroust.trainersclub.com.br/iflitegouler16.html
iflaroust.transtornomental.com.br/giditures16.html
iflaroust.transtornos.com.br/sukerkae16.html
iflaroust.ubertom.com/bubuerleras16.html
iflaroust.vaughnnugent.com/bubudejana16.html
biblaroita.lecnet.org/bubuidaheta16.html
biblaroita.ukies60.co.uk/nunigahulaala16.html
biblaroita.farahdzila.com/bubliorefusei16.html
biblaroita.buypurestevia.net/buidadusel16.html
biblaroita.loto-365.com/digigafus16.html
biblaroita.loto-777.com/ififuleradus16.html
biblaroita.g8r.ca/iglamiuser16.html
filmagrafy.qqm59.com/laperiuds16.html
filmagrafy.mda77.com/alsominora16.html
filmagrafy.fok96.com/ditroitosmiktajeras16.html
filmagrafy.hosting15.net/fiklakerasio16.html
filmagrafy.tab73.com/bibloruserna16.html
filmagrafy.uzz58.com/sigagulet16.html
filmagrafy.kts25.com/ifafloruseta16.html
guider.xmm85.com/fifakuitro16.html
guider.jam92.com/ifagugehaler16.html
guider.queensland-bedlinen.com/ifigahugera16.html

DPD Services "Home Delivery Notification" spam

This fake DPD message contains a link leading to an exploit kit.

From:     DPD Services [dpd_support@nikos-fahrschule.com]
Reply-to:     DPD Services [dpd_support@nikos-fahrschule.com]
Sate:     11 September 2014 14:18
Subject:     Home Delivery Notification

    DPD

    DPD - Parcel Services and Parcel Shipping

    Welcome to DPD

    Delivery Notification

    Track-Id: DP-U0096319662

    We could not deliver your parcel. Download Delivery Label here.

    Copyright 2014 (C) All rights reserved

In this case the link goes to [donotclick]seanergia.pl/model.php?dpd=Ny1yrZdnYkTUirJpfIQ6dj79Zbf5481JA1xta2JR54w= (this seems to be 404ing, but it could just be hiding). According to this report the payload is Asprox.

"LLC INC" / llcinc.net fake job offer

This fake company's name looks like it has been designed to be hard to find on Google. The so-called LLC INC using the domain llcinc.net does not exist.

Date:      Wed, 10 Sep 2014 19:51:50 -0400 [09/10/14 19:51:50 EDT]
From:      LLC INC
Reply-To:      recruiter@llcinc.net
Subject:      EMPLOYMENT OFFER

Hello,
  Good day to you overthere we will like to inform you that our company is currently
opening an opportunity for employment if you are interested please do reply with your resume
to recruiter@llcinc.net

Thanks
Management LLC INC 

This so-called job is going to be something like a money mule, parcel mule or some other illegal activity.

The domain llcinc.net was registered just a few days ago with fake details:

Registry Registrant ID: 
Registrant Name: BEATRIZ G SANDERS
Registrant Organization: LLCINC
Registrant Street: PO BOX 33100
Registrant City: SAN ANTONIO
Registrant State/Province: TEXAS
Registrant Postal Code: 78265
Registrant Country: US
Registrant Phone: +1.2102605808
Registrant Phone Ext:  
Registrant Fax: 
Registrant Fax Ext:
Registrant Email: JOETOMMY456@YAHOO.COM

There is no website. The email originates from 209.169.222.37, the mail headers indicate that this is probably a compromised email server mail.swsymphony.org.

Avoid.

Geir Myklebust (DHL NO) [Geir.Myklebust@dhl.com] invoice spam has a malicious attachment

Geir Myklebust is a real employee for DHL in Norway, but neither he nor DHL are responsible for this spam run in any way (their systems have NOT been breached either). Instead, it contains a malicious attachment and it should simple be deleted.

From:     Geir Myklebust (DHL NO) [Geir.Myklebust@dhl.com]
Date:     10 September 2014 10:35
Subject:     FW: customer acct. no.: 4690086 - invoice 0257241 needs to be paid


Dear Sir.

The attached invoice from Villmarksmessen 2014 has still not been settled.
Please advise as soon as possible.

Thank you and regards,
Geir
Med vennlig hilsen/ Kind Regards
Geir Myklebust
Product Manager, Avd. Trade Fairs & Events
DHL Global Forwarding (Norway) AS
Avd. Trade Fairs & Events
Messeveien 14
2004 Lillestrøm


Postboks 154 Leirdal
NO-1009 OSLO
NORWAY

Direct line:        + 47 90 95 58 26
Fax:                  + 47 64 00 71 87
Mobile:             + 47 90 78 52 44

Dear Sir.

The attached invoice from Villmarksmessen 2014 has still not been settled.

Please advise as soon as possible.

Thank you and regards,

Geir

Med vennlig hilsen/ Kind Regards
Geir Myklebust
Product Manager, Avd. Trade Fairs & Events

DHL Global Forwarding (Norway) AS
Avd. Trade Fairs & Events
Messeveien 14
2004 Lillestrøm


Postboks 154 Leirdal
NO-1009 OSLO
NORWAY

Direct line:        + 47 90 95 58 26
Fax:                  + 47 64 00 71 87
Mobile:             + 47 90 78 52 44

Attached is a ZIP file of various different names (e.g. invoice_0257241.zip), containing a malicious executable file invoice_3466198.exe which has a VirusTotal detection rate of 3/54.

The Comodo CAMAS report  shows an attempted connection to voladora.com/Imagenes/qaws.cab  which is currently coming up with a socket error. I would recommend that you block access to that domain. Further analysis is pending, I will update the post if I find more information.

UPDATE: a second malicious binary is doing the round, this time with a detection rate of 2/53. The ThreatTrack report [pdf] and Anubis report shows the malware performing lookups for a variety of domain names [pastebin] which are not currently resolving, but might be worth blocking.

Sage "Outdated Invoice" spam

This fake Sage email leads to a malicious file.

From:     Sage Account & Payroll [invoice@sage.com]
Date:     9 September 2014 13:31
Subject:     Outdated Invoice

Sage Account & Payroll

You have an outdated invoice from Sage Accounting that is ready for payment. To find out more details on this invoice, please follow the link bellow or click here to view/download your account invoice: https://invoice.sage.co.uk/Account?902687=Invoice_090914.zip If we hold any information about you which is incorrect or if there are any changes to your details please let us know by so that we can keep our records accurate and up to date. If you would like to update your records or see a copy of the information that we hold about you, you can contact us at Data Protection Officer, Sage (UK) Ltd, North Park, Newcastle-upon-Tyne, NE13 9AA or by email to [redacted]. If you request a copy of your information you will need to pay a statutory fee which is currently £10. The contents of this email and any attachments are confidential. They are intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to anyone or make copies. We have communicated this information with users as well, and we will continue to communicate with you through email as your transition continues. This email was sent to: [redacted]

This email was sent by: Sage UK Limited NC1-002-08-25, Newcastle upon Tyne., North Park, NE13 9AA, United Kingdom

Privacy and Security
Keeping your financial information secure is one of our most important responsibilities. For an explanation of how we manage customer information, please read our Privacy Policy. You can also learn how Sage UK Limited keeps your personal information secure and how you can help protect yourself.

The link in the email does not go to invoice.sage.co.uk at all, but loads a page from:
[donotclick]anphucconduit.com/cslxpnzwzg/jnxxblpzjn.html

which in turn executes the following scripts:
[donotclick]lager.leadhoster.com/jflguwjgdk/rqkypcjgqt.js
[donotclick]northinc.com/mlfbxurfhn/pctxizxtfd.js
[donotclick]www.drhousesrl.it/lpwfszqqjt/gttigxxhme.js
[donotclick]mariatome.myartsonline.com/ykfmbdqqrm/jgawguxmub.js

those scripts attempt to download a malicious .ZIP file from the following locations:
[donotclick]cartadegintonics.com/js/jquery/invoice_090914.zip
[donotclick]anpilainate.org/bin/invoice_090914.zip
[donotclick]raggiottoimpianti.it/wp-content/uploads/2014/08/invoice_090914.zip
[donotclick]importedjewelryoutlet.com/include/invoice_090914.zip

You would have expected an exploit kit after all this hard work, but not.. it's a plain old ZIP (invoice_090914.zip) file containing a malicious executable invoice_090914.scr which has a VirusTotal detection rate of 8/55.

The ThreatTrack report [pdf] and Anubis report show that the malware attempts to make a connection to:
vaderhopland.be/js/9k1.cl
95.141.37.158/0909uk1/NODE01/0/51-SP3/0/
95.141.37.158/0909uk1/NODE01/1/0/0/
95.141.37.158/0909uk1/NODE01/41/5/4/

Recommended blocklist:
95.141.37.158
vaderhopland.be
anphucconduit.com
lager.leadhoster.com
northinc.com
drhousesrl.it
mariatome.myartsonline.com
cartadegintonics.com
anpilainate.org
raggiottoimpianti.it
importedjewelryoutlet.com

"PAYMENT SLIP" spam comes with an encrypted .7z archive

This spam comes with a malicious attachment:

From:     daniel mo [danielweiche002@gmail.com]
Subject:     PAYMENT SLIP
Signed by:     gmail.com

Thanks for your last message,

We remitted 30% prepayment today amounting to 51,300USD against your invoice INV332831 as was agreed with you by our purchasing agent. Please check the attached invoice and the payment slip and correspond your account information. You will receive payment in your account after a few days.

Please confirm the receipt  below,
kindly use this password {121212} to view attachment for our payment slip;
Thanks,
Daniel
Accounts Assistant
67752222
64472801
Zenia Singapore Pte Ltd

In order to deal with the attachment new order.7z, you'll need something capable of dealing with .7z files (e.g. 7-Zip). Inside the archive is a malicious executable new order.scr which has a VirusTotal detection rate of 5/54. I have not been able to analyse the malware any further than this.

RBS "Important Docs" spam doing the rounds again

The Royal Bank of Scotland has been spoofed several times recently, this latest fake spam contains a payload that looks like it might be Cryptowall.

Date:      Mon, 8 Sep 2014 15:00:22 +0100 [10:00:22 EDT]
From:      Vicente Mcneill [Vicente@rbs.co.uk]
Subject:      Important Docs

Please review attached documents regarding your account.

Tel:  01322 929655
Fax: 01322 499190
email: Vicente@rbs.co.uk

This information is classified as Confidential unless otherwise stated. 

Attached is an archive RBS_Account_Documents.zip containing a malicious executable RBS_Account_Documents.scr which has a detection rate at VirusTotal of 4/53. The ThreatTrack analysis [pdf] shows that it attempts to download components from the following locations:

95.141.37.158/0809uk1/NODE01/0/51-SP3/0/
95.141.37.158/0809uk1/NODE01/1/0/0/
95.141.37.158/0809uk1/NODE01/41/5/4/
bullethood.com/ProfilePics/0809uk1.zip

95.141.37.158 is SeFlow.it Internet Services, Italy. bullethood.com is on a shared server at GoDaddy. The malware also appears to be attempting to connect to 94.23.250.88 (OVH, France).

Recommended blocklist:
bullethood.com
95.141.37.158
94.23.250.88

BH Live Tickets "Peter Pan" spam (bhlive.co.uk / bhlivetickets.co.uk)

I have seen a very large quantity of these spam emails, purporting to be from

From:     bhlivetickets@bhlive.co.uk
Date:     8 September 2014 08:43
Subject:     Confirmation of Order Number 484914

ORDER CONFIRMATION Order Number Order Date 484914 07-09-2014 13:00

YOUR E-TICKET(S) ARE ATTACHED TO THIS EMAIL, SENT TO [redacted]. Please print ALL PAGES of the PDF file attached to the email and bring them with you to gain admission to the event. The attachment requires that you have the Adobe Acrobat Reader installed on your computer. If you do not have Adobe Acrobat Reader installed, please click HERE to download and install this program. TICKETS QTY TICKET TYPE PRICE EACH TOTAL Peter Pan Bournemouth Pavilion Theatre Tue 23 Dec 2014 - 7:00 PM 3 Early Bird - Price A 18.00 54.00 6 Early Bird Child Under 16 - Price A 15.00 90.00 Ticket Information Circle/A 35-30 (6) , Circle/B 33-31 (3) DELIVERY METHOD AMOUNT Print At Home - E-Ticket(s) are attached to this order confirmation (You must be able to open and print a PDF file) 1.00 PAYMENTS TYPE # DATE AMOUNT Mastercard Sale ************7006 03-09-2014 13:00 145.00

Please keep this confirmation in a safe place. THIS IS NOT YOUR TICKET YOUR E-TICKET(S) ARE ATTACHED TO THIS EMAIL Please call 0844 576 3000 if there are any errors in your order, if you have not received your tickets as expected, or if you have any questions. BH Live Tickets Exeter Road, Bournemouth, BH2 5BH Tel: 0844 576 3000 bhlivetickets@bhlive.co.uk http://www.bhlivetickets.co.uk VAT Reg: 108 2248 37 TICKETS: 144.00 CHARGES: 1.00 TOTAL: 145.00 PAYMENTS RECEIVED: 145.00

These emails are not from BH Live Tickets and their systems have not been compromised in any way. Instead, these emails are a forgery with an attachment (tickets.3130599.zip or similar) which in turn contains a malicious executable (in this case tickets.332091.exe).

The VirusTotal detection rate for this malware is just 3/55. Comodo CAMAS reports that this downloads an additional component from tiptrans.com.tr/333 which has a VirusTotal detection rate of 4/51.

According to ThreatExpert, This second component POSTs some information to 80.94.160.129:8080 (OVH, France) and also appears to contact 92.222.46.165 (National Academy Of Sciences Of Belarus).

Recommended blocklist: (updates in italics)
tiptrans.com.tr
plancomunicacion.net
92.222.46.165
80.94.160.129

Added: there is at least one other version of the malicious binary, for example this one.  I have seen some reports that there are more.

UPDATE 2014-09-09:
A second spam run is in progress, essentially the same as the first one except some now have a subject in the form "Confirmation of E-Tickets Order Number 0088658".

There are two new binaries, well detected by anti-virus products with a VirusTotal score of 27/55 and 25/54.

In one case the binary downloaded an additional component from plancomunicacion.net/333  which has a detection rate of 25/54 and according to the ThreatExpert report has the same characteristics as before.

Also, the people operating BH Live have put a notice on their website.:

Concerns raised over emails purporting to be from BH Live Tickets
Published on 8 September 2014

Bournemouth, UK, 8 September – At approximately 7.30 this morning BH Live started to receive a high-volume of calls from members of the public in connection with an email purporting to come from BH Live Tickets. The email contains attachment(s) and hyperlinks relating to a booking for Peter Pan.

BH Live's Information Security teams together with information technology professionals and suppliers have investigated the matter and confirm that its internal systems have not been breached and that the emails were sent from known SPAM IP addresses. The emails are not genuine and do not originate from BH Live. A number of precautionary measures have been taken to ensure data, systems and networks continue to be protected.

The public is advised to delete these emails, to not open any attachments or links; ensure they are running the most up-to-date security products and that the operating system has been updated to the latest version. It is recommended that anyone receiving these emails update their passwords over the coming days.

BH Live continues to monitor the situation and is posting updates via websites and social media channels.

Shakira death hoax email comes with a malicious Word document

This Spanish-language spam email reports the (fake) death of Shakira in a car accident. Attached is a Word document that contains a malicious macro.

From:     El Universal [eluniversal@eluniversal.org]
Date:     5 September 2014 14:50
Subject:     Shakira muere en grave accidente

Muere Shakira en grave accidente

Esta madrugada a las 1:10 A.M. en el barrio la Macarena, Colombia. La conocida cantante e intérprete Shakira Isabel Mebarak Ripoll, sufrió un grave accidente automovilístico en el cual perdio la vida. Abordo del vehículo también se encontraba su manager, que quedó con heridas graves. Testigos, dicen que el auto conducido por este último, se dirigia a exceso de velocidad..

Para ver imágenes exclusivas y detalles de la noticia adjuntamos un documento con toda la información sobre este trágico acontecimiento.

Ampliaremos.

El Universal © todos los Derechos Reservados  2014.

This approximately translates as:

Shakira dies in serious accident

This morning at 1:10 A.M. in the neighborhood La Macarena, Colombia. The well-known singer and performer Shakira Isabel Mebarak Ripoll, suffered a serious car accident in which she lost herlife. Aboard the vehicle was her manager, who was seriously injured. Witnesses say the car driven by the latter, was speeding ..

To view exclusive images and details of the story, we have attached a document with all the information about this tragic event.

When attempting to open the Word document (IMAGENES_01.doc), the potential victim sees the following:

The rest of the document explains to the victim how to remove the security settings from Word, supposedly to enable them to view the pictures. But what will actually happen is that the malicious macro in the document will try to infect the PC.

This malicious document has a VirusTotal detection rate of just 2/54. According to an analysis of the document, it then appears to download additional components from an insecure Joomla site at [donotclick]www.papeleriaelcid.com/aurora/ajax/

This type of spam seems to commonly target Spanish-speaking South American victim (like this one).

In this case the originating IP was 207.150.195.247 (a SouthWeb Ventures IP allocated to a customer supposedly called "Microinformatica Gerencial, S.A. de C.V.").

Blocking the papeleriaelcid.com site and rejecting emails from 207.150.195.247 might be wise if you have Spanish-speaking users.

sage.co.uk "Invoice_7104304" spam

This fake invoice from Sage is actually a malicious PDF file:

From:     Margarita.Crowe@sage.co.uk [Margarita.Crowe@sage.co.uk]
Date:     23 July 2014 10:31
Subject:     FW: Invoice_7104304

Please see attached copy of the original invoice (Invoice_7104304).

Attached is a file sage_invoice_3074381_09042014.pdf which is identical to the payload for this Companies House spam circulated earlier.

Companies House "(AR01) Annual Return received" spam

This fake Companies House spam comes with a malicious attachment.

From:     Companies House [web-filing@companies-house.gov.uk]
Date:     4 September 2014 10:58
Subject:     (AR01) Annual Return received

Thank you for completing a submission Reference # (1650722).

    (AR01) Annual Return

Your unique submission number is 1650722
Please quote this number in any communications with Companies House.

Check attachment to confirm acceptance or rejection of this filing.

All web filed documents (with the exception of downloaded accounts templates) are available to view / download for 10 days after their original submission.

Once accepted, these changes will be displayed on the public record.

Not yet filing your accounts online? See how easy it is...

For enquiries, please telephone the Service Desk on +44 (0)303 1234 500 or email enquiries@companieshouse.gov.uk

This email was sent from a notification-only email address which cannot accept incoming mail. Please do not reply directly to this message.

Attached is a malicious PDF file ar01_456746_09042014.pdf which has a VirusTotal detection rate of 5/54. The Malware Tracker report shows that this attempts to exploit the CVE-2013-2729 flaw that was patched over a year ago.. so it may well be that if your version of Acrobat is up-to-date then you will be OK, as you will probably be if you use another PDF reader.

Sky.com "Statement of account" spam.. again.

These fake Sky emails are pretty common and have a malicious attachment:

Date:      Wed, 3 Sep 2014 09:17:22 +0200 [03:17:22 EDT]
From:      "Sky.com" [statement@sky.com]
Subject:      Statement of account

Afternoon,

Please find attached the statement of account.

We look forward to receiving payment for August, invoice as this is now due for payment.

Regards,
Clark

This email, including attachments, is private and confidential. If you have received this
email in error please notify the sender and delete it from your system. Emails are not
secure and may contain viruses. No liability can be accepted for viruses that might be
transferred by this email or any attachment. Wilson McKendrick LLP Solicitors, Queens
House, 29 St. Vincent Place, Glasgow G1 2DT Registered in Scotland No. SO303162. Members:
Mark Wilson LLB Dip. NP LP Allan T. McKendrick LLB Dip. LP NP. 

The attachment is Statement.zip which contains a malicious executable Statement.scr which has a reasonable VirusTotal detection rate of 18/55. The Anubis report indicates that the binary phones home to the following domains which may be worth blocking:

notarioschiapas.com
faviles.com

Fake westlothian.gov.uk "NDR Bill" email

Sometimes spammers come up with weird approaches. This one is a bill from West Lothian Council in the UK.. well, actually it isn't a bill but it comes with a malicious attachment.

From:     Ebilling [Ebilling@westlothian.gov.uk]
Date:     3 September 2014 09:20
Subject:     NDR Bill

Please find attached your Non Domestic Rates bill.

If your account is in credit you are due a refund unless you have any other debt due to the Council.

To allow your credit to be processed please confirm:

- If you want the credit transferred to another account you have with us. Please confirm the account details.
- If you want the credit refunded by cheque, please confirm who it should be sent to and the address.

Links to Non Domestic Rates information are detailed below.

Important Note:
If you access these links using a mobile phone the network provider may charge for this service.

Yours sincerely
Scott Reid
Revenues Manager

 http://www.westlothian.gov.uk/media/downloaddoc/1799465/1851216/2395547

* PDF Viewer required.

This message, together with any attachments, is sent subject to the
following statements:

1.    It is sent in confidence for the addressee only.  It may
    contain legally privileged information.  The contents are
    not to be disclosed to anyone other than the addressee.
    Unauthorised recipients are requested to preserve this
    confidentiality and to advise the sender immediately.
2.    It does not constitute a representation which is legally
    binding on the Council or which is capable of constituting
    a contract and may not be founded upon in any proceedings
    following hereon unless specifically indicated otherwise.

http://www.westlothian.gov.uk

Attached is a file 00056468.pdf.zip which contains a malicious executable D0110109.PDF.exe (which has an icon to make it look like a PDF file). This has a low detection rate at VirusTotal of 4/55.

The Comodo CAMAS report shows that it downloads an additional component from the following locations:

paodeler.com/333
awat.ugu.pl/333
twigsite.org/333
chico-assen.nl/333
beckerseguros.com.br/333
vacacionescosta.com.ar/333
frere-bros.com/333
kaituforumas.lt/333
www.van-der-leest.nl/333
lavetrinadeimotori.it/333
uj.spexx.hu/333
hamalabeachresort.com/333
voladora.com/333
ccemanpower.com/333
tiptrans.com.tr/333
areteeventos.com.br/333
ochodiez.com.ar/333
www.alabiimoveis.com/333
www.tbdistributors.co.nz/333
itspecialist.ro/333
groupgraphic.dk/333

This second component has a VT detection rate of just 3/55. The Anubis report shows an attempted phone home to 80.94.160.129 (National Academy of Sciences of Belarus) and 92.222.46.165 (OVH, France)

Recommended blocklist:
80.94.160.129
92.222.46.165
paodeler.com
awat.ugu.pl
twigsite.org
chico-assen.nl
beckerseguros.com.br
vacacionescosta.com.ar
frere-bros.com
kaituforumas.lt
van-der-leest.nl
lavetrinadeimotori.it
uj.spexx.hu
hamalabeachresort.com
voladora.com
ccemanpower.com
tiptrans.com.tr
areteeventos.com.br
ochodiez.com.ar
alabiimoveis.com
tbdistributors.co.nz
itspecialist.ro
groupgraphic.dk

Something evil on 95.163.121.188 (Sweet Orange EK)

95.163.121.188 is currently hosting the Sweet Orange Exploit Kit (hat tip). The IP is allocated to Digital Networks CJSC (aka DINETHOSTING) that has featured on this blog many times before.

Currently I can see the following domains active on this IP address. Ones highlighted are flagged as malicious by Google.

cdn2.sefu.co
cdn3.sefu.co
cdn4.sefu.co
cdn5.sefu.co
cdn.seefu.co
cdn2.seefu.co
cdn3.seefu.co
cdn.seefoo.co
cdn2.seefoo.co
cdn3.seefoo.co
cdn.critico.co
cdn.easynet.co
cdn.networkguys.co
cdn.tequilacritico.es
cdn2.tequilacritico.es
cdn3.tequilacritico.es
cdn4.tequilacritico.es
cdn5.tequilacritico.es
cdn.critico.com.mx
cdn.critico.mx
cdn.thecritico.mx
cdn2.thecritico.mx
cdn4.thecritico.mx
cdn5.thecritico.mx
cdn.tequilacritico.mx
cdn2.tequilacritico.mx
cdn3.tequilacritico.mx
cdn4.tequilacritico.mx
cdn5.tequilacritico.mx
cdn.sweetip.uk.com
cdn2.sweetip.uk.com
cdn3.sweetip.uk.com
cdn4.sweetip.uk.com
cdn5.sweetip.uk.com
cdn.sweetip.com
cdn2.sweetip.com
cdn3.sweetip.com
cdn4.sweetip.com
cdn5.sweetip.com
cdn.brazitel.com
cdn.thecritico.com
cdn2.thecritico.com
cdn3.thecritico.com
cdn4.thecritico.com
cdn5.thecritico.com
google.chagwichita.com
cdn.tequilatimes.com
cdn2.tequilatimes.com
cdn3.tequilatimes.com
cdn4.tequilatimes.com
cdn5.tequilatimes.com
google.ajdistributor.com
cdn.netguysglobal.com
cdn.tequilacritics.com
cdn2.tequilacritics.com
cdn3.tequilacritics.com
cdn4.tequilacritics.com
cdn5.tequilacritics.com
cdn.mcelectricalinc.com
cdn.tequilaspectator.com
cdn2.tequilaspectator.com
cdn3.tequilaspectator.com
cdn4.tequilaspectator.com
cdn5.tequilaspectator.com
cdn.primrosebrentwood.com
cdn.tequilaguildofamerica.com
cdn2.tequilaguildofamerica.com
cdn3.tequilaguildofamerica.com
cdn4.tequilaguildofamerica.com
cdn5.tequilaguildofamerica.com
cdn.primrosenashvillemidtown.com
cdn.seefu.net
cdn2.seefu.net
cdn3.seefu.net
cdn4.seefu.net
cdn5.seefu.net
cdn.seefoo.net
cdn2.seefoo.net
cdn3.seefoo.net
cdn.sweetip.net
cdn2.sweetip.net
cdn3.sweetip.net
cdn4.sweetip.net
cdn5.sweetip.net
cdn.networkguys.net
cdn2.networkguys.net
cdn3.networkguys.net
cdn.tequilacritico.net
cdn2.tequilacritico.net
cdn3.tequilacritico.net
cdn4.tequilacritico.net
cdn5.tequilacritico.net
cdn.gandco.pro
cdn.primrosebrentwood.xyz
cdn.tequilatimes.info
cdn2.tequilatimes.info
cdn3.tequilatimes.info
cdn4.tequilatimes.info
cdn5.tequilatimes.info
cdn.georgicasweets.info
cdn.sefu.mobi
cdn2.sefu.mobi
cdn3.sefu.mobi
cdn4.sefu.mobi
cdn5.sefu.mobi
cdn.seefu.mobi
cdn2.seefu.mobi
cdn3.seefu.mobi
cdn4.seefu.mobi
cdn5.seefu.mobi
cdn.seefoo.mobi
cdn2.seefoo.mobi
cdn3.seefoo.mobi
cdn.georgika.co
cdn.georgicasuites.com
cdn.georgicasweets.com
google.vctelectronics.com
cdn.limodog.net
cdn2.limodog.net
cdn3.limodog.net
cdn4.limodog.net
cdn5.limodog.net
cdn.soundpet.net
cdn2.soundpet.net
cdn3.soundpet.net
cdn4.soundpet.net
cdn5.soundpet.net
cdn.georgicas.net
cdn.georgicasweets.net
cdn.georgicasweets.org
cdn.limodog.xyz
cdn2.limodog.xyz
cdn3.limodog.xyz
cdn4.limodog.xyz
cdn5.limodog.xyz
cdn.georgicas.mobi
cdn.georgicasweets.mobi
cdn.georgika.net

The domains appear to be legitimates ones that have been hijacked in some way.

95.163.121.188 forms part of a large netblock of 95.163.64.0/18 - I have had half of this (95.163.64.0/19) blocked for several years which has stopped a great deal of badness, so I recommend that you block either the /19 or /18 and/or the following domains:

sweetip.uk.com
critico.com.mx
critico.co
easynet.co
georgika.co
networkguys.co
seefoo.co
seefu.co
sefu.co
ajdistributor.com
brazitel.com
chagwichita.com
georgicasuites.com
georgicasweets.com
mcelectricalinc.com
netguysglobal.com
primrosebrentwood.com
primrosenashvillemidtown.com
sweetip.com
tequilacritics.com
tequilaguildofamerica.com
tequilaspectator.com
tequilatimes.com
thecritico.com
vctelectronics.com
tequilacritico.es
georgicasweets.info
tequilatimes.info
georgicas.mobi
georgicasweets.mobi
seefoo.mobi
seefu.mobi
sefu.mobi
critico.mx
tequilacritico.mx
thecritico.mx
georgicas.net
georgicasweets.net
georgika.net
limodog.net
networkguys.net
seefoo.net
seefu.net
soundpet.net
sweetip.net
tequilacritico.net
georgicasweets.org
gandco.pro
limodog.xyz
primrosebrentwood.xyz