The Barracuda Labs Internet Security Blog

If you’re in any kind of business there’s a good chance you have to deal with resumes on a daily basis, especially if you’re a manager or Human Resources professional.  While you probably delete that Viagra ad and ignore the promise of Nigerian riches, when a resume hits your inbox, you read it.

Spammers know this and have been increasingly presenting malware as if it were a resume, hoping that the recipient will be so curious about a potential applicant that they open or run something that they shouldn’t.

The Barracuda Labs spam monitoring center has detected a recent increase in the amount of this fake resume spam from multiple sources.  While the messages are similar, the threats they carry are all different.  Here are three cautionary examples…

HTML attachment

One common feature of these fake resumes is that the spammer keeps the  message short and sweet, hoping you’ll open the attachment to see if this is that one resume they’ve been waiting for.

Of course in this case better grammar would help make the sale.   This particular message contains an HTML attachment, something our honeypots have seen a great deal of in the past week.    HTML attachments are less likely to be filtered by email scanning software that might otherwise reject binary attachments by default, and even end users who are conditioned not to open and run programs might look at a HTML file and think that it is harmless.

Except that this HTML is anything but harmless.

The attachment is 100% obfuscated malicious JavaScript.   Opening it in a browser (which is the default action when clicked) raises an alert

and sends you off to a bogus antivirus site.

Don’t open suspicious HTML attachments.   Email the sender and ask for the information in a different format, such as a Word document or text file.

RTF attachment

Since the Rich Text Format (RTF) is handled by Windows Wordpad and Microsoft Word, you wouldn’t necessarily be surprised to get an email with a resume in that format

However, it is possible to completely embed an executable program within an RTF document, and that’s what we have here.

When first opened the filename of this embedded object only partly displays.   Still, clicking on it does display a security warning that should make you think twice.   After all, a resume doesn’t normally need to be “Run”.

If you do click run, nothing seems to happen.   However, if you’re watching your internet traffic you’ll see the telltale signs of a Zeus Trojan infection.

A Zeus trojan will quietly examine your internet traffic looking for usernames and passwords, and then send them back to criminals who use them to take over online accounts.  Many cases of online banking fraud involve passwords stolen by this malware family.

ZIP attachment

The last example has the most convincing message text, and the file name of the attachment includes a persons name, making it look less threatening

But once you’ve opened the .zip attachment the alarm bells should be ringing.

A careful check of the properties of the file inside shows it is an executable, and clicking on it would run it.  As we said above, resumes do not normally need to be “Run”.   Doing so just installs a fake antimalware named SecurityTool onto your computer.

If you or your colleagues handle resumes be careful of unsolicited or unanticipated resume emails.  Examine any resume attachments carefully before opening them, and as we repeatedly stress, never press the “Run” button unless you are certain that is appropriate – it rarely is.

Barracuda Spam & Virus Firewall customers are protected from these attacks.

Dave Michmerhuizen – Barracuda Labs

by Barracuda Labs

This week a new sort of spam started showing up in the Barracuda Labs Spam Honeypots – fake sender verification emails such as the one below:

Sender Verification emails ask users to verify that they sent a particular email to someone, usually by responding with another email, or as in this case, by clicking on an embedded link.

Under normal circumstances, these emails come from an email server that has been enhanced with  sender verification software as a spam-fighting measure.  While this software is not as common as it once was, these systems still are used by some businesses and ISPs.

However, the example above merely pretends to be one of these verification emails and is not from an email server at all.  Instead, it is cleverly constructed spam whose included link can take the recipient to suspicious Websites, or even offer up executable malware.

This spam appears plausible and easily can trick the unwary email user.

Close examination does reveal several tell-all signs that this email is suspicious. For starters, the name of the person supposedly emailed is missing.  Second, the domain that the email purports to come from is the same domain as that of the user, which makes no sense since the user should not need to verify himself to his own mail server.

Indeed,  one aspect of this campaign is that each spam is carefully tailored to  reference the email domain of the recipient, most likely because that domain is one the recipient knows and trusts.

The message is sent only in HTML format, and the link has varied over time. In some cases, it redirects to Canadian Pharmacy Viagra sites.  In others, the link presents the user with a Windows .EXE to run, which is a variant of the rapidly spreading TDSS rootkit.

While it is easy enough to hover over the link and see that it does not go back to the organization shown as having sent the email, many users will not question the name of the domain in the verification link.

Barracuda Spam & Virus Firewalls block these emails.  We suggest users take note and warn other email users of this new social engineering tactic.  These emails do not fight spam; they ARE spam.