{"id":13162,"date":"2022-04-11T08:54:52","date_gmt":"2022-04-11T08:54:52","guid":{"rendered":"https:\/\/myonlinesecurity.co.uk\/?p=13162"},"modified":"2023-04-03T12:42:51","modified_gmt":"2023-04-03T12:42:51","slug":"gail-walker-mbl-seminars-limited-outstanding-invoice-271741-word-doc-malware","status":"publish","type":"page","link":"https:\/\/myonlinesecurity.co.uk\/gail-walker-mbl-seminars-limited-outstanding-invoice-271741-word-doc-malware\/","title":{"rendered":"Gail Walker MBL (Seminars) Limited Outstanding Invoice 271741 \u2013 Word Doc Malware"},"content":{"rendered":"
Outstanding Invoice 271741 pretending to come from Gail Walker <gail@mblseminars.com> with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment.<\/p>\n
A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers.<\/p>\n
Almost all of these also have a password stealing component, with the aim of stealing your bank, PayPal or other financial details along with your email or FTP ( web space) log in credentials. Many of them are also designed to specifically steal your Facebook and other social network log in details.<\/p>\n
MBL Seminars are a genuine company who are not sending these emails. They have not been hacked or their servers compromised in any way. All the alleged senders, companies, names of employees and phone numbers mentioned in the emails are all innocent and are just picked at random.<\/p>\n
Some of these companies will exist and some won\u2019t. Don\u2019t try to respond by phone or email, all you will do is end up with an innocent person or company who have had their details spoofed and picked at random from a long list that the bad guys have previously found. The bad guys choose companies, Government departments and organisations with subjects that are designed to entice you or alarm you into blindly opening the attachment or clicking the link in the email to see what is happening.<\/p>\n
This email has what appears to be a genuine word doc attached which is malformed and contains a macro script virus. Modern versions of Microsoft office, that is Office 2010 and 2013 and Office 365 have Macros disabled by default, UNLESS you or your company have enabled them. If protected view mode is turned off and macros are enabled then opening this malicious word document will infect you, and simply previewing it in windows explorer or your email client might well be enough to infect you.<\/p>\n
Definitely DO NOT follow the advice they give to enable macros to see the content. Almost all of these malicious word documents appear to be blank when opened in protected view mode, which should be the default in Office 2010, 2013 and 365.<\/p>\n
At this time, these only affect windows computers. They do not affect a Mac, IPhone, Blackberry, Windows phone or Android phone.<\/p>\n
The malicious word or excel file can open on any system, and potentially the macro will run on windows or mac BUT the downloaded malware that the macro tries to download is windows specific, so will not harm or infect any other computer except a windows computer. You will not be infected if you do not have macros enabled in Excel or word.<\/p>\n
Please read our How to protect yourselves page<\/a> for simple, sensible advice on how to avoid being infected by this sort of socially engineered malware. Also please read our post about word macro malware and how to avoid being infected by them<\/p>\n All these emails have random invoice numbers in the subject line and the invoice number matches the attachment name & number in most cases so far today<\/p>\n The email looks like:<\/p>\n Dear Customer<\/p>\n Payment for your Season Ticket was due by 31 January 2021 and has not yet been received. A copy of the invoice is attached.<\/p>\n By way of a reminder, the Season Ticket entitles all members of your organisation to save up to 50% on our public seminars and webinars. Since being a Season Ticket Holder your organisation has saved \u00a3728.50.<\/p>\n Please arrange for payment by return by BACS, cheque, or credit card. If payment has been arranged and just not reached us yet then please ignore this email.<\/p>\n If you have any queries, please do not hesitate to contact us.<\/p>\n Regards<\/p>\n Gail Walker<\/p>\n MBL (Seminars) Limited<\/p>\n The Mill House Tel: +44 (0)161 793 0984 <\/p>\n There are several different attachments around with this one today and some are the same as the attachment with today\u2019s version of CIT Inv# 15000375 for PO# SP14161 \u2013 Word doc malware<\/p>\n Update 12 February 2021: another run of this email today delivering the same malware as Julio Lopez Minuteman Press West Loop INVOICE 1398 \u2013 FEB 4 2021 \u2013 Word doc malware<\/p>\n 11 February 2021: invoice.doc Current Virus total detections: 1\/57<\/p>\n According to Dynamoo\u2019s Blog there are several different versions of the macro. These download a component from the following locations:<\/p>\n
\n6 Worsley Road
\nWorsley
\nManchester
\nUnited Kingdom
\nM28 2NL<\/p>\n
\nFax: +44 (0)161 728 8139<\/p>\n