Sponsored by..

Tuesday, 30 June 2015

Malware spam: "Donna Vipond" / "donna.vipond@ev-ent.co.uk" / "Payment due - 75805"

This fake invoice does not come from Event Furniture Ltd but is instead a simple forgery with a malicious attachment:

From     "Donna Vipond" [donna.vipond@ev-ent.co.uk]
Date     Tue, 30 Jun 2015 13:13:28 +0100
Subject     Payment due - 75805

Please advise when we can expect to receive payment of the attached
invoice now due?  I await to hear from  you.

Kind Regards

Donna Vipond


Event Furniture Ltd T/A Event Hire

Tel: 01922 628961 x 201
Attached is a file 75805.doc which comes in two (or more) different versions (Hybrid Analysis report [1] [2]). The samples I saw downloaded a file from either:


This is saved as %TEMP%\silvuple.exe and it has a VirusTotal detection rate of 6/55. The various analyses including this Malwr report and this Hybrid Analysis indicate malicious traffic to (Hetzner, Germany).

The payload is probably the Dridex banking trojan.

Recommended blocklist:


Monday, 29 June 2015

Malware spam: "CEF Documents" / "Dawn.Sandel@cef.co.uk" / "Dawn Sandel"

This fake financial spam does not come from City Electrical Factors but is instead a simple forgery with a malicious attachment.

From: "Dawn.Sandel@cef.co.uk" [Dawn.Sandel@cef.co.uk]
Subject: CEF Documents
Date: Mon, 29 Jun 2015 13:48:27 +0300

Please find attached the following documents issued by City Electrical Factors:

Invoice - BLA/176035 - DUCHMAID

If you have any problems or questions about these documents then please do not hesitate to contact us.

Dawn Sandel
Phone: 01282 698 112
Fax: 01282 696 818

Dawn Sandel
Group Office
Nelson & Northwest Region

City Electrical Factors Limited
Tel: 01282 698 112  Fax: 01282 696 818
11 Kenyon Road, Lomeshaye Industrial Estate, Nelson, BB9 5SPv

The attachment is BLA176035.doc which contains a malicious macro. So far I have seen two different versions (Analysed here by Payload Security's Hybrid Analysis [1] [2]) which download a binary from one of the following locations:


This executable has a detection rate of 11/55. Those analyses show the samples phoning home to the following IPs: (Hetzner, Germany) (OneGbits, Lithuania) (OVH, France) (IP ServerOne, Malaysia)

The payload is probably Dridex, but I was not able to get a copy of the DLL.

Recommended blocklist:


Malware spam: "Payslip for period end date 29/06/2015" / "noreply@fermanagh.gov.uk"

This fake financial spam comes with a malicious payload:

From:    noreply@fermanagh.gov.uk [noreply@fermanagh.gov.uk]
Date:    29 June 2015 at 11:46
Subject:    Payslip for period end date 29/06/2015

Dear [redacted]

Please find attached your payslip for period end 29/06/2015

Payroll Section

Attached is a file payslip.zip which contains the malicious executable payslip.exe which has a VirusTotal detection rate of 8/55. Automated analysis [1] [2] shows a file being downloaded from:


That binary has a detection rate of just 2/55 [Malwr analysis] Also, Hybrid Analysis [1] [2] shows the following IPs are contact for what looks to be malicious purposes: (Landis Holdings Inc, US) (Panhandle Telecommunications Systems Inc., US) (ENERGOTEL a.s./ Skylan s.r.o, Slovakia) (Visionary Communications Inc., US) (Chickasaw Telephone, US) (Secom Inc , US) (Servei De Telecomunicacions D'Andorra, Andorra) (ISP Slovanet (MNET) Brezno, Czech Republic) (Orion Telekom, Serbia) (AgaNet Agata Goleniewska, Poland) (SWAN, a.s. TRIO network, Slovakia) (PP Merezha, Ukraine) (Safelink Internet, US) (Chickasaw Telephone, US) (E-Light-Telecom, Russia) (Trk Efir Ltd., Ukraine) (Orion Telekom, Serbia) (FLP Pirozhok Elena Anatolevna, Ukraine) (Southwest Oklahoma Internet, US) (Subnet LLC, Russia) (TRIOLAN / Content Delivery Network Ltd, Ukraine) (PSINet, US) (DSi DATA s.r.o., Slovakia) (Private Enterprise Radionet, Ukraine) (Moldtelecom LIR, Moldova) (Visionary Communications Inc., US)

I am unable to determine exactly what the payload is on this occassion.

Recommended blocklist:


Friday, 26 June 2015

Malware spam: "Notification of Vehicle Tax DD Payment Schedule (Ref: 000000-000005-274421-001)" / "directdebit@taxdisc.service.gov.uk"

This spam does not come from the UK government , but instead is a simple forgery with a malicious payload:

From: directdebit@taxdisc.service.gov.uk
Date: Fri, 26 Jun 2015 15:58:38 +0700
Subject: Notification of Vehicle Tax DD Payment Schedule (Ref: 000000-000005-274421-001)

Important: Confirmation of your successful
Direct Debit instruction

Dear customer
Vehicle registration number: FG08OEE
Thank you for arranging to pay the vehicle tax by Direct Debit.
Please can you check that the details attached below, and your payment schedule are correct.
If any of the above financial details are incorrect please contact your bank as soon as possible.
However, if your details are correct you don’t need to do anything and your Direct Debit will be processed as normal. You have the right to cancel your Direct Debit at any time. A copy of the Direct Debit Guarantee is included with this letter.
For your information, the collection will be made using this reference, and this is how your payment will be detailed on your bank statements:
  • DVLA Identifier: 295402
  • Reference: FG08OEE
Your vehicle tax will automatically renew unless you notify us of any changes. We will send a new payment schedule at the time of renewal.
Yours sincerely

Rohan Gye
Vehicles Service Manager

Driver a& Vehicle Licencing Agency logo

Attached to the message is a file FG08OEE.doc with a VirusTotal detection rate of 2/55. The macro in it proved resistant to manual analysis, but the Hybrid Analysis does the job easily enough, spotting a download from:


This file was also being used in another spam run earlier today.


Malware spam: "Order Confirmation RET-385236 250615" / "donotreply@royal-canin.fr"

This fake financial spam comes with a malicious payload:

From: [1NAV PROD RCS] [mailto:donotreply@royal-canin.fr]
Subject: Order Confirmation RET-385236 250615

Please find attached your Sales Order Confirmation

Note: This e-mail was sent from a notification only e-mail address that
cannot accept incoming e-mail. PLEASE DO NOT REPLY TO THIS MESSAGE.

In the sample I have seen, the attachment is called Order Confirmation RET-385236 250615.doc which contains this malicious macro [pastebin] which downloads a component from the following location:


Usually there are several different version of the macro, each one loading an identical binary but from different locations. This file is saved as %TEMP%\biksenpd.exe and has a VirusTotal detection rate of 7/55.

According to various automated analysis tools, the sample doesn't seem to run properly [1] [2] [3] [4] but it looks like it tries to send traffic to the following IPs: (Strategic Systems Consulting, US) (OneGbits, Lithuania) (ASDL Subscriber, Iran)

Recommended blocklist:

Wednesday, 24 June 2015

Malware spam: "Considerable law alternations" / "excerptum_from_the_implemented_rule.zip" / "Pamela Adams"

This fake legal spam comes with a malicious payload:
Date: Wed, 24 Jun 2015 22:04:09 +0900
Subject: Considerable law alternations

Pursuant to alternations made to the Criminal Code securities have to be reestimated.
Described proceeding is to finish until April 2016.
However shown levy values to be settled last in this year.
Please see the documents above  .
Pamela Adams
Chief accountant

In the sample I saw there was an attachment named excerptum_from_the_implemented_rule.zip containing a malicious executable excerptum_from_the_implemented_act.exe which has a VirusTotal detection rate of 2/55.

Automated analysis tools [1] [2] [3] show malicious traffic to the following IPs: (C2NET Przno, Czech Republic) (Clarity Telecom LLC / PrairieWave, US) (Radionet, Ukraine) (Safelink Internet , US) (Orion Telekom, Serbia) (SWAN, a.s. TRIO network, Slovakia) (Rostelecom / VolgaTelecom, Russia) (Telekom Srbija, Serbia)

The Malwr report and Hybrid Analysis report indicate a couple of  dropped files, gebadof.exe (VT 2/55 - identical to the initial file) and qppwkce.exe (VT 3/55). This malware appears to be a combination of the Upatre downloader and Dyre banking trojan.

Recommended blocklist:


Tuesday, 23 June 2015

Malware spam: "Hope this e-mail finds You well" / "Stacey Grimly"

This spam comes with a malicious attachment:

Date:    23 June 2015 at 14:14
Subject:    Hope this e-mail finds You well

Good day!

Hope this e-mail finds You well.

Please be informed that we received the documents regarding the agreement No. 7232-003 dated from 3rd day of June.
However there are some forms missing.
We made the list of missing documents for Your ease (the list is attached below).
Please kindly check whether these forms are kept in your records.
In case you have any questions here are our contact details: 838-72-99. Feel free to give a call at any time.

Stacey Grimly,
Project Manager
Some of the details vary in each email, but the overall format is the same. So far I have seen two different mis-named attachments:

check.zip size=57747.zipsize=57747
check.zip size=57717.zipsize=57717

The file sizes actually match the one listed in the file's name. Because the attachment is not properly named, some ZIP file handlers may fail to deal with them. Equally, the technique may be designed to get the spam past mail filters.

Each archive contains a file info_bank_pdf.exe with different checksums and a detection rate of 3/52 or 3/54. Automated analysis tools [1] [2] [3] indicate traffic to the following locations: (Orion Telekom, Serbia) (Suddenlink Communications, US) (Orion Telekom, Serbia) (Charter Communications, US)

These two Malwr reports [1] [2] show dropped files named yaxkodila.exe (two versions, VT 5/54 and 5/55) plus a file jieduk.exe (VT 8/54). Incidentally, the VirusTotal analysis also throws up another IP address of: (Time Warner Cable, US)

The malware is a common combination of the Upatre downloader and Dyre banking trojan, targeting Windows systems.

Recommended blocklist:


Monday, 22 June 2015

Malware spam: "Tax inspection notification" / "tax_663-20845-0479-435.zip size=18288.zipsize=18288"

This fake tax notification comes with a malicious payload.

Date:    22 June 2015 at 19:10
Subject:    Tax inspection notification

Good day!
Trust this e-mail finds You well.
Please be notified that next week the revenue service is going to organize tax inspections.
That is why we highly recommend You to file the attached form in order to be prepared.
Inspectors are to determine whether You as a taxpayer have settled the correct amount of taxes.
According to our records, the inspectors license No. is 090-96919-5886-935. Please check  as it is an important procedure rule.
We may discuss all the related matters by phone: +1 998-497-85. Feel free to contact us.
Bruce Climt,
Tax Advisor

Attached is a file with a malformed ZIP filename of tax_663-20845-0479-435.zip size=18288.zipsize=18288 which contains a malicious executable info_bank_pdf.exe which has a VirusTotal detection rate of 4/57.

This Malwr analysis indicates a traffic pattern consistent with the Upatre downloader:

That IP address is the same as seen in this attack earlier today and it belongs to Orion Telekom in Serbia. This VirusTotal report also shows traffic to (Optical Systems LLC, Ukraine), and this Hybrid Analysis report also shows traffic to (Triolan, Ukraine).

Furthermore, this other Malwr report shows two dropped executables, karetfob.exe [VT 4/57] and sveezback.exe [VT 15/57]. The dropped payload will be the Dyre banking trojan.

Recommended blocklist:


Malware spam: "Shareholder alert" / "instructions.zip size=21154.zipsize=21154"

This fake financial spam comes with a malicious attachment:

Date:    22 June 2015 at 13:07
Subject:    Shareholder alert

Hope this e-mail finds You well. Please note that in 2015 no dividends will be paid due to resolution of the Board of Directors. Please see attached.     Glen McCoy, Partner
Attached is a mis-named ZIP file called instructions.zip size=21154.zipsize=21154 containing a malicious executable instructions_document.exe which has a VirusTotal detection rate of 1/56.

The Malwr report indicates network traffic to: is Orion Telekom in Serbia.

It also drops an executable xiroukiqa.exe with a detection rate of 5/56 and vusjeson.exe with a detection rate of 4/57. The VirusTotal report for the last binary also shows traffic to ( Midwest Data Center, US), which is clearly malicious according to VirusTotal.

The characteristics of this malware indicate the Upatre download leading to the Dyre banking trojan.

Recommended blocklist:


Friday, 19 June 2015

Malware spam: "New instructions" / "instructions_document.exe"

This rather terse spam comes with a malicious payload:
From:    tim [tim@thramb.com]
Date:    19 June 2015 at 16:40
Subject:    New instructions

New instructions payment of US banks, ask to read

Attached is an archive file with the somewhat unusual name of instructions.zip size=19811 which contains a malicious executable named instructions_document.exe.

The VirusTotal analysis indicates that this is the Upatre download [detection rate 3/57]. Automated analysis tools [1] [2] [3] [4] show traffic to:

which is an IP operated by Orion Telekom in Serbia, and also which is Hamilton Telecommunications in the US. A characteristic of this generation of Upatre is that it sends traffic to icanhazip.com which while not malicious in itself is quite a good indicator of infection.

In all cases I have seen, Upatre drops the Dyre banking trojan, but I have been unable to obtain a sample.

Recommended blocklist:


Thursday, 18 June 2015

Malware spam: "NOTA FISCAL ELETRÔNICA COD. 6Uhrae.088693" / "sac.contact4e74974737@bol.com.br"

These Portuguese-language spam pretends to be some sort of banking invoice aim, but instead leads to malware hosted on Google Drive. The target appears to be users in Brazil.

From:    sac.contact4e74974737@bol.com.br
To:    mariomarinho@uol.com.br
Date:    18 June 2015 at 08:46
Subject:    NOTA FISCAL ELETRÔNICA COD. 6Uhrae.088693
Signed by:    bol.com.br

Estamos encaminhando o LINK para download da nota fiscal eletrônica.

Caso tenha alguns dos dados errados favor nos retorne no email nfe@jmcomercio.com.br.


18/06/15 :
04:46:18.161 :
Por favor, não "responda" esta mensagem.

The reference numbers and sender change slightly in each version.

I've seen three samples before, each one with a different download location [a list is here] which leads to a ZIP file named NFe_0185189710250029301785.zip which in turn contains a malicious executable NFe_0185189710250029301785.exe which has a VirusTotal detection rate of 8/57. Comments in that report indicate that this may be the Spy.Banker trojan.

The Malwr report indicates that it downloads components from the following locations:


The Hybrid Analysis report  also has some other details.

These sites are hosted on: (WebsiteWelcome, US) (Universo Online, Brazil)

The VirusTotal report for both these IPs [1] [2] indicates a high level of badness, indicating that they should be blocked.

Furthermore, Malwr shows that it drops a file with a detection rate of 2/57. As yet, I have only tested this on Malwr and it fails to run.

Recommended blocklist:


Monday, 15 June 2015

Malware spam: "[Nyfast] Payment accepted" / "Nyfast [mailto:sales@nyfast.com]"

This spam does not come from Nyfast but is instead a simple forgery with a malicious attachment.

From: Nyfast [mailto:sales@nyfast.com]
Sent: Monday, June 15, 2015 11:47 AM
Subject: [Nyfast] Payment accepted

Hi ,
Thank you for shopping with Nyfast!

Order ZUJIEQGQV - Payment processed
Your payment for order with the reference ZUJIEQGQV was successfully processed.

You can review your order and download your invoice from the "Order history" section of your customer account by clicking "My account" on our shop.
If you have a guest account, you can follow your order via the "Guest Tracking" section on our shop.

Nyfast powered by PrestaShop™
Attached is a Word document with a malicious macro, named 29172230_15.06.15.doc. The payload is the same as the one found in this earlier spam run.

Malware spam: "New Doc" / "Will Kinghan [WKinghan@hhf.uk.com]"

This spam does not come from Henry Howard Finance, but is instead a simple forgery with a malicious attachment.

From:    Will Kinghan [WKinghan@hhf.uk.com]
Date:    15 June 2015 at 12:09
Subject:    New Doc


My apologies again.

Document attached


With kind regards,

Will Kinghan
Account Manager
T: 01633 415235 |M: 07468723790| E: wkinghan@hhf.uk.com


Head Office

: 01633 415222  | F: 01633 415223
Unit 5
| Langstone Business Village | Langstone Park | Langstone | Newport | Gwent | NP18 2LH   
The information in or attached to this email is confidential and may be legally privileged. If you are not the intended recipient of this message any use, disclosure, copying, distribution or any action taken in reliance on it is prohibited and may be unlawful. If you have received this message in error, please notify the sender immediately by return email or by telephone on 01633 415222 and delete this message and any copies from your computer and network. Henry Howard Finance plc. do not warrant this email and any attachments are free from viruses and accepts no liability for any loss resulting from infected email transmissions.  Henry Howard Finance plc. reserve the right to monitor all e-mail communications through its networks. Please note that any views expressed in this email may be those of the originator and do not necessarily reflect those of Henry Howard Finance plc. registered in Wales, Company no. 40151132 has registered offices at Unit 5 Langstone Business Village, Langstone Park, Newport, NP18 2LH, VAT no. 753461724. Henry Howard Finance Plc is Authorised by the Financial Conduct Authority (FCA)
Attached is a Word document New doc.doc which contains a malicious macro. It is the same payload as seen in this other spam run earlier today.

Malware spam: "Payment Confirmation 29172230" / "reed.co.uk Credit Control [mailto:creditcontrol.rol@reed.co.uk]"

This fake financial spam does not come from Reed, but is instead a simple forgery with a malicious attachment:

From: reed.co.uk Credit Control [mailto:creditcontrol.rol@reed.co.uk]
Sent: Monday, June 15, 2015 11:10 AM
Subject: Payment Confirmation 29172230

Dear Sirs,

Many thanks for your card payment. Please find payment confirmation attached below.

Should you have any queries, please do not hesitate to contact Credit Control Team on 0845 241 9293.

Kind Regards

Credit Control Team
T: 020 7067 4584
F: 020 7067 4628
Email: creditcontrol.rol@reed.co.uk
The only sample I have seen so far has an attachment 29172230_15.06.15.doc [detection rate 3/57] which contains this malicious macro [pastebin] which downloads a component from the following location:


This is saved as %TEMP%\ginkan86.exe and has a VirusTotal detection rate of 6/57. There will probably be other download locations, but they should all lead to an identical binary. Automated analysis tools [1] [2] [3] show traffoc to the following IPs: (Hetzner, Germany) (Charter Communications, US) (Linode, US) (OVH, France) (Global Telecommunications Ltd, Russia)

According the this Malwr report, it also drops a Dridex DLL with a detection rate of 18/57.

Recommended blocklist:


Thursday, 11 June 2015

Pump and Dump: "Go buy DJRT right now" / Dale Jarrett Racing Adventure Inc

This illegal Pump and Dump spam is pushing stocks in Dale Jarrett Racing Adventure Inc (DJRT):

From:    PennyStockCrew [info@pennystockcrew.com]
Date:    10 June 2015 at 10:18
Subject:    Go buy DJRT right now!

Dear Traders,

Our alert DJRT is doing so amazing that you are probably regretting you didn't buy it yet.

I'll tell you this point blank. If you didn't buy DJRT you are an idiot. Take 1 or 2k and go buy it right this second because it is going to go absolutely ballistic.

DJRT is the stock of the minute, of the hour, of the moment and my stock pick of the year!

GO buy DJRT right now and watch it kick past 10 dollars in a heartbeat.

You are signed up to my alerts at www.pennystockcrew.com

Thank you for being a loyal member.

Sincerely yours,
Penny Stock Crew | info@pennystockcrew.com | Michael Killian | PO Box 110226 | Nutley, NJ 07110

The email is almost definitely nothing to do with pennystockcrew.com but is instead being spammed out by a criminally-controlled botnet.

DJRT is a loss-making stock which probably doesn't have good prospects according to it's own SEC filing.

The P&D spam started on 10th June, and we can see from the trading data that somebody bought 1.8 million shares just before the spam run started [via]

Date Close/Last Volume
13:18 0.045 167,875*
06/10/2015 0.041 850,878
06/09/2015 0.045 470,269
06/08/2015 0.044 1,355,516
06/05/2015 0.0132 0
06/04/2015 0.0132 0
06/03/2015 0.0132 1,000
06/02/2015 0.02 0
06/01/2015 0.02 5,002
05/29/2015 0.0269 5,000
05/28/2015 0.0175 10,000
05/27/2015 0.0175 0
05/26/2015 0.0175 0
05/22/2015 0.0175 5,600
05/21/2015 0.0175 1,362
05/20/2015 0.0175 0
05/19/2015 0.0175 1,652
05/18/2015 0.0175 0
05/15/2015 0.0175 0
05/14/2015 0.0175 61,000
05/13/2015 0.0175 0
05/12/2015 0.0175 0
05/11/2015 0.0175 0
* This data reflects the latest intra-day delayed pricing.

This activity pushed the stock price up from 1.3 cents to nearly 5 cents. In recent years stocks have never traded particularly highly, but they recent dropped to the 1 cent area after trading from 2 to 5 cents.

Usually with a pump-and-dump spam such as this, it is either the spammers who are trying to manipulate the share price, or a stock holder seeking to boost the value of the shares so they can sell them. I have no evidence at all that anyone connected with Dale Jarrett Racing Adventure Inc has anything to do with this.

Typically, stocks promoted through P&D spams such as this will collapse after the spamming has finished, leaving investors out of pocket. Often the companies are on the verge of bankruptcy anyway, so investors sometimes lose everything. This too is likely to be a poor investment. Avoid.

Phish: "New_Order_#056253_Hf_Constructions" / "joseph.zhou@hong-kee.com"

I've seen a few of these today, presumably they aren't quite spammy enough to get blocked by our mail filters..

From: Kang Li [mailto:joseph.zhou@hong-kee.com]
Sent: 10. juni 2015 09:35
Subject: New_Order_#056253_Hf_Constructions


Please find attached our new order and send P/I against 50% advance payemnt

best regards
The attachment is New_Order_#056253_Hf_Constructions.pdf which looks like a purchase order, but there is a blurred out section.

An examination of the underlying PDF file shows two URLs listed:


In turn these redirect to:


The second URL listed 404s, but the first one is active. According to the URLquery report, it looks harmless, just leading to a phishing page. But when I tried it in a test environment, the behaviour was somewhat different and it also attempted to load a page at:


This page 404s, but was previously hosted on a bad server at [VT report]. That server has been offline for a few days, but the URL is suggestive of an exploit kit of some sort.

The "megatrading.hol.es" (hosted on by Hostinger - VT report) landing page looks like a straightforward phish:

Entering the username and password always seems to return an error, even if you are absolutely certain the combination are correct..

I suspect that all this portion is doing is collecting email addresses and passwords for use later. Webmail accounts have some value to the bad guys, and of course many people re-use passwords all over the place, so it could be used as a way to get access to other services. Take care.

Recommended blocklist:

Wednesday, 10 June 2015

Malware spam: "Hayley Sweeney [admins@bttcomms.com]" / "Your monthly BTT telephone bill"

This spam does not come from BTT Communications, but is instead a simple forgery with a malicious attachment:

From:    Hayley Sweeney [admins@bttcomms.com]
Date:    10 June 2015 at 11:20
Subject:    Your monthly BTT telephone bill

Please find attached your telephone bill for last month.
This message was sent automatically.

For any queries relating to this bill, please contact Customer Services on 01536 211100. 
So far I have only seen one sample with an attachment Invoice_68362.doc which contains this malicious macro [pastebin] which downloads a malicious executable from:


This is saved as %TEMP%\birsafpc.exe and it has a VirusTotal detection rate of 6/57. Automated analysis tools show traffic to the following IPs: (Linode, US) (OVH, France) (Global Telecommunications Ltd, Russia)

This Malwr report also indicates that it drops a Dridex DLL with a detection rate of 7/57.

Recommended blocklist:


Tuesday, 9 June 2015

Malware spam: "Password Confirmation [490192125626] T82"

This spam email message comes with a malicious attachment:
From:    steve.tasker9791@thomashiggins.com
Date:    9 June 2015 at 10:41
Subject:    Password Confirmation [490192125626] T82

Full document is attached
So far I have seen only a single example of this. Attached is a malicious Word document named 1913.doc [VT 3/57] which contains this malicious macro [pastebin] which downloads a component from the following location:


Incidentally, the macro contains a LOT of junk that appears to have been harvested from a Microsoft tutorial or something. The downloaded executable has a VirusTotal detection rate of 4/57 and automated analysis tools [1] [2] [3] [4] indicate traffic to the following IPs: (Linode, US) (OVH, France) (Selectel, Russia)

The Malwr report shows that it downloads a Dridex DLL with a detection rate of 3/57.

Recommended blocklist:


Monday, 8 June 2015

Malware spam: "Bank payment" / "sarah@hairandhealth.co.uk"

This fake financial spam does not come from SBP Hair and Health but is a simple forgery with a malicious attachment.
From: sarah@hairandhealth.co.uk [mailto:sarah@hairandhealth.co.uk]
Sent: Monday, June 08, 2015 10:10 AM
Subject: Bank payment

Dear customer

Please find attached a bank payment for £3083.10 dated 10th June 2015 to pay invoice 1757.  With thanks.

Kind regards

Attached is a file Bank payment 100615.pdf [VT 2/57] which appears to drop a Word document with a malicious macro. Although there are probably several versions of this attachment, according to the Hybrid Analysis report it downloads a component from:

This is saved as %TEMP%\biksampc.exe and has a VirusTotal detection rate of 5/57. Automated analysis tools [1] [2] [3] indicate network traffic to the following IPs: (Digital Ocean, Netherlands) (Selectel, Russia) (Global Telecommunications Ltd, Russia) (Internet Thailand Company Limited, Thailand) (RuWeb, Russia)

The Malwr report indicates that it drops a Dridex DLL with a detection rate of 4/57.

Recommended blocklist:


Friday, 5 June 2015

Some domains belonging to Michael Price of BizSummits

Here are some domains belonging to Michael Price of BizSummits. Just saying.