word malware continues

Word document based malware continues to changed it formats

Here's the latest two versions...

This one "from" Sandra Whitmore of Nazarethcare:

 And this one "from" Soo Sutton of Power EC Ltd:

Note that in both cases Thunderbird is showing an unknown size for the document.

Again, Sanesecurity.Malware.24528.DocHeur works a treat again and blocks them before
doing any damage.

Malware Detected as: Sanesecurity.Malware.24528.DocHeur
ClamAV 3rd Party signatures: http://sanesecurity.com
#clamav #sanesecurity #malware

Fake Amazon word document malware

Just receiving some word document malware, supposedly from Amazon....



It was blocked by an existing signatures...

Malware Detected as: Sanesecurity.Malware.24528.DocHeur
ClamAV 3rd Party signatures: http://sanesecurity.com
#clamav #sanesecurity #malware

Current md5 hashes...

1b952f7556a5046a03f2d77877dcf507
d078b7afea87ceefc5064200a5412ae4
ef3aadf9aa910b00d99614b8cef7df0f

VirusTotal Result (5/54) @ 12.29

Remittance Advice November word malware

More malware infected word documents on their way...


From: "Doreen Todd"
Subject: Remittance Advice November WT1841041R
Reply-To: "Doreen Todd"

Dear Sir/Madam

Please find attached the details of the payment credited to your account =
for the sum of 1739.67 GBP

Regards

Doreen Todd
Accounts Payable Department DUCO


Malware Detected as: Sanesecurity.Malware.24528.DocHeur
ClamAV 3rd Party signatures: http://sanesecurity.com
#clamav #sanesecurity #malware  

12:26: VirusTotal Results: 1, 2, 3 and 4
15:41: Eset have just added detection, so after 3 hours we have 1/54 AV's picking it up

Fake iTunes phishing blocked again...

Oh dear... iTunes email just coming in...

... but it's blocked by: Sanesecurity.Phishing.Fake.24204 which was added a day ago...

Here's one site's view of the situation.... and it's history over time...

Malware via Word documents

We seem to be receiving a few variants of word documents at then moment, containing macros to download externally hosted malware.

 3 variants of these documents so far...

VirusTotal 1
VirusTotal 2
VirusTotal 3

I've added detection for all these types, in phish.ndb as:

Malware Detected as: Sanesecurity.Malware.24509.DocHeur

ClamAV 3rd Party signatures: http://sanesecurity.com
#clamav #sanesecurity #malware

Sample Subjects:

Commercial Debt Recovery, Ref No:
Industrial Invoices
Employee Documents - Internal Use
Reference: