FW: Invoice_5294370 PDF Malware


FW: Invoice_5294370 pretending to be from Laurence.Bryson@sage.co.uk ( the name of the alleged sender is random and can be any name) is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers.

Almost all of these have a password stealing component, with the aim of stealing your email or FTP ( web space) log in credentials. Many of them are also designed to specifically steal your facebook and other social network log in details.

Please read our How to protect yourselves page for simple, sensible advice on how to avoid being infected by this sort of socially engineered malware.

The invoice number is different in each email as it the name of the sender, but they all pretend to come from somebody@sage.co.uk. They do not come from sage. They do not contain an invoice of any description. Very simple email that reads:

Please see attached copy of the original invoice (Invoice_5294370).

These emails contain a genuine PDF file that is malformed and contains a script virus and can infect you with no action on your part by simply previewing the PDF in your browser or in the PDF reader. It depends on which version of Adobe reader you use, but older ones are definitely vulnerable to this exploit and hopefully the most recent one will be safe ( but I won’t guarantee that ) As far as I can tell they are using an exploit from 2013 that was fixed Adobe Security Bulletin and an even older one from 2010. Make sure you are using a version of Adobe reader that has been declared free from these vulnerabilities.

Please also read my previous post about this type of attack https://myonlinesecurity.co.uk/infected-malformed-pdf-attachments-emails/

4 September 2021: sage_invoice_3074381_09042021.pdf Current Virus total detections: 4/55

All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email. Whether it is a message saying “look at this picture of me I took last night” and it appears to come from a friend or is more targeted at somebody who regularly is likely to receive PDF attachments or Word .doc attachments or any other common file that you use every day. Be very careful when unzipping them and make sure you have “show known file extensions enabled“, And then look carefully at the unzipped file. If it says .EXE then it is a problem and should not be run or opened.

Leave a Reply

Your email address will not be published.

Related Posts