Re: Credit Reference File Request.(108278994) Fake Word Doc Malware

RE: Credit reference file request.(108278994) is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers.

Almost all of these have a password stealing component, with the aim of stealing your email or FTP ( web space) log in credentials. Many of them are also designed to specifically steal your facebook and other social network log in details.

This Credit reference file request email appears to come from random names at random companies. When you unzip the attachment you see what at first glance appears to be a genuine word doc. However they have added a load of spaces between the .doc extension and the actual extension it is which is a .scr ( that is a screensaver which windows runs as a normal .exe file). Unless you have “show known file extensions enabled“, it will look like a proper word file instead of the .scr executable file it really is, so making it much more likely for you to accidentally open it and be infected.

Each attachment is named at random but does appear to match the random numbering in the subject line.
With all the recent warnings about stolen personal information and hacked websites and companies. Many people would be unduly worried by somebody saying that they would help you get your credit file to see what is happening and open the attachment to see what is known about them

Update: A second version of the malware using what at first glance is a genuine XLS ( Excel) spreadsheet, but of course this is a .scr file as well

Please read our How to protect yourselves page for simple, sensible advice on how to avoid being infected by this sort of socially engineered malware.

Email reads

Dear derek@thespykiller.co.uk

You have obtain a copy of your credit reference file.

We’re happy to help you with any questions or concerns you may have. Please contact us directly 24/7 .

Lynn Buck.

21 August 2014: Credit_file_108278994.zip (52 kb): Extracts to Credit reference file.doc .scr Current Virus total detections: 2/52

21 August 2014: Credit_file_642094175.zip (85kb): Extracts to credit_reference_file.xls .scr Current Virus total detections: 2/52

This RE: Credit reference file request.(108278994) is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper word file instead of the .scr executable file it really is, so making it much more likely for you to accidentally open it and be infected.

All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email. Whether it is a message saying “look at this picture of me I took last night” and it appears to come from a friend or is more targeted at somebody who regularly is likely to receive PDF attachments or Word .doc attachments or any other common file that you use every day. Be very careful when unzipping them and make sure you have “show known file extensions enabled“, And then look carefully at the unzipped file. If it says .EXE then it is a problem and should not be run or opened.