MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the subject “UKMail 988271023 tracking information”.
This email is send from the spoofed address “email@example.com” and has the following body:
Your parcel has not been delivered to your address November 23, 2015, because nobody was at home.
Please view the information about your parcel, print it and go to the post office to receive your package.
UKMail expressly disclaims all conditions, guarantees and warranties, express or implied, in respect of the Service.
Where the law prevents such exclusion and implies conditions and warranties into this contract,
where legally permissible the liability of UKMail for breach of such condition,
guarantee or warranty is limited at the option of UKMail to either supplying the Service again or paying the cost of having the service supplied again.
If you don’t receive a package within 30 working days UKMail will charge you for it’s keeping.
You can find any information about the procedure and conditions of parcel keeping in the nearest post office.
The attached file 988271023-PRCL.xls 118 kB large Excel file with embedded malicious macro script that will download a trojan from a host.
The malware is known as LooksLike.Macro.Malware.gen!x3 (v) or X97M.Dropper.KV.
At the time of writing, 3 of the 55 AV engines did detect the trojan at Virus Total.
Use the Virus Total for more detailed information.