Eliza Fernandes NUCSOFT-Payroll December document malware

Just a heads up about incoming malware hitting hard this morning...

More details on my security blog...

http://sanesecurity.blogspot.co.uk/2015/01/eliza-fer...

Cheers,

Steve

Getting loads of these and Defender even picked the file up on disk, so Windows Live Mail must drop the file to disk even if it is not opened.

X-Original-From: [email protected]
X-CLAMAV-Details: Sanesecurity.Malware.24646.DocHeur.UNOFFICIAL
X-CLAMAV-Results: Infected

The new Spam du Jour appears to be;

From: Ieuan James <[email protected]>
Sunject: invoice EME018.docx

There's a malformed Base64 encoded attachment which is supposed to be a Word document, no doubt with a macro payload.

Less common today is

From: [variable]
Subject: NOVEMBER INVOICE ADVISE

This has a Word document attached too.

I had 3 of these in quick succession, all to diff email addys that I had registered with prominent sites that had leaked, incl. Santander & Groupon.