Bogus "Invoice" Links Not Detected

Hi Folks,

I know that I’ve been given an email address to send reports like this to in the past but I can’t now remember it.

In recent days we’ve received a lot of bogus email messages that purport to include a file attachment for an “invoice” but in fact there is no attachment; instead the “attachment” link points to a URL. The avast! mail scanner does not detect these.

I don’t know if it’s reasonable to expect avast! to detect this type of spam/malware, since it would essentially seem to require combining the behaviors of the email and web shields in one operation, but I thought I would report it to see what you think.

Below is an example with (partially redacted) header info.

If it would be better to submit this directly to someone at avast! please let me know the correct address for doing so.

Thanks for any help.

— MESSAGE TEXT —
Subject: Cust QZ-73-11339
From: Sue Leven rnava@batteryusa.com
Sent: Tue, Jul 17, 2018 at 10:53 am
To: [REDACTED]

You have received an invoice from Sue Leven for $1,586.12.

[REDACTED]eurebia.net/pdf/En/INVOICE-STATUS/Invoice-58894133975-07-17-2018/
Attachment File Type: Doc (Microsoft Word), Multi-Page
— END MESSAGE TEXT —

— HEADER INFO —
Delivered-To: [REDACTED]
Return-Path: rnava@batteryusa.com
Delivered-To: [REDACTED]
Received: from proxy6.mail.ord1d.rsapps.net ([172.30.157.45]) by store192a.mail.ord1c.rsapps.net (Dovecot) with LMTP id WUT2A8QCTlsMFwAA86Hg+g for <[REDACTED]>; Tue, 17 Jul 2018 10:52:52 -0400
Received: from smtp31.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy6.mail.ord1d.rsapps.net with LMTP id aPR8F84CTlvUBgAAQyIf0w ; Tue, 17 Jul 2018 10:53:02 -0400
Return-Path: rnava@batteryusa.com
X-Spam-Threshold: 95
X-Spam-Score: 0
X-Spam-Flag: NO
X-Virus-Scanned: OK
X-Orig-To: [REDACTED]
X-Originating-Ip: [184.173.49.130]
Authentication-Results: smtp31.gate.ord1d.rsapps.net; iprev=pass policy.iprev=“184.173.49.130”; spf=pass smtp.mailfrom="rnava@batteryusa.com" smtp.helo=“mx1.visualedgedesign.com”; dkim=none (message not signed) header.d=none; dmarc=none (p=nil; dis=none) header.from=batteryusa.com
X-Suspicious-Flag: NO
X-Classification-ID: 1a529d1a-89d1-11e8-8fe0-525400b3ac8c-1-1
Received: from [184.173.49.130] ([184.173.49.130:59411] helo=mx1.visualedgedesign.com) by smtp31.gate.ord1d.rsapps.net (envelope-from rnava@batteryusa.com) (ecelerity 4.2.1.56364 r(Core:4.2.1.14)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 64/6C-29927-EC20E4B5; Tue, 17 Jul 2018 10:53:02 -0400
X-SmarterMail-Authenticated-As: rnava@batteryusa.com
Received: from 10.0.63.79 (197-248-214-54.safaricombusiness.co.ke [197.248.214.54]) by mx1.visualedgedesign.com with SMTP; Tue, 17 Jul 2018 09:52:59 -0500
Date: Tue, 17 Jul 2018 17:53:15 +0300
From: Sue Leven rnava@batteryusa.com
To: [REDACTED]
Message-ID: <33749250461398820064.1F6A66933C9769F4@[REDACTED]>
Subject: Cust QZ-73-11339
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=“----=_Part_45185_4116636773.14542872732605478806”
X-Declude-Sender: rnava@batteryusa.com [197.248.214.54]
X-Declude-Spoolname: 980538462151.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.12.11
X-Declude-Scan: Outgoing Score [0] at 09:53:00 on 17 Jul 2018
X-Declude-Tests: None
X-Country-Chain:
X-Declude-Code: 0
X-HELO: 10.0.63.79
X-Identity: 197.248.214.54 | | [REDACTED]
— END HEADER INFO —

I know that I've been given an email address to send reports like this to in the past but I can't now remember it.
Try bookmark ;) https://forum.avast.com/index.php?topic=198166.0

URL is blacklisted
https://www.virustotal.com/#/url/b927c6d93866239bd7e20b80cfe1342cfa45755fd834c3473b97cb7ce26fb95f/detection

you should edit your post and remove https://www from the link you posted above so it is not clickable

If it would be better to submit this directly to someone at avast! please let me know the correct address for doing so.
spam filters usually have a "report spam" button

How to report >> https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

Done.

The blacklisting doesn’t seem to be very widespread though…

I read that thread. I’m not sure why it’s relevant.

Our email provider does have quite good SPAM filtering; however, some messages like this are caught but others are not.

The blacklisting doesn't seem to be very widespread though...
It may be new? ... most malware and malicious URLs start there life as undetected :-\
I read that thread. I'm not sure why it's relevant.
If you want to check a suspicious mail, you forward it including attachment to > sanitize-beta@metadefender.com after 10minutes you recive a mail with the scan result

Problem is, that only provides an “either/or” option for files vs URLs. There are no files. The URL would likely be blocked if I tried to go there in my browser. If I chose the option to report the URL I would likely not get a helpful response.

The need is for avast! to block the MESSAGE BODY, because it CONTAINS a dangerous URL link.

If that’s not a realistic expectation, so be it. Though I would rather the engineers at avast! devote their time to figuring out how to do that, than to how to use avast! to leverage the pop-up self-advertising capabilities of other products that avast! owns, or to warn me that some website developer hasn’t deployed the latest patch to some software or other when the site itself contains nothing actually dangerous.

Just sayin …

Thanks. That would be useful for me as the IT guy where I work. But probably not a realistic option to suggest to the well over 100 ordinary non-computer-geek people who are using email at our organization.

The need is for avast! to block the MESSAGE BODY, because it CONTAINS a dangerous URL link
do you use avast spam filter? does it not have a report spam button?
If that's not a realistic expectation, so be it. Though I would rather the engineers at avast! devote their time to figuring out how to do that, than to how to use avast! to leverage the pop-up self-advertising capabilities of other products that avast! owns, or to warn me that some website developer hasn't deployed the latest patch to some software or other when the site itself contains nothing actually dangerous.
After avast was registered on the stock exchange it is all about revenue and they now use evry legal trick in the book, annoying or not They have the world's largest user base but most of it is the free version so shareholders want a larger pice of the cake that the big ones have, Symantec / McAfee / Trend Micro .... it is all about $ now

No, we use a third-party email service provider called RackSpace. It has a “report spam button”, and I use it. It is, in most respects, a very good spam filter. But it is only catching some messages that look like this, not all of them. It probably will get better over time, but that doesn’t make me feel comfortable about this threat today, or over the next few days. Also, our people use fat-client email software on our computers, not webmail. So I actually have to go into the webmail version for each account to train the filter, which will only happen in most cases after people have already downloaded the email to the fat clients. So I had hoped for a second line of defense from avast!

Thanks.

So I had hoped for a second line of defense from avast!
Well, it seems the malicious URL is taken down as it give no response ;)

This is emotet malspam.Its not directly malicious…It gives you a doc file which then downloads the actual banker malware binary which is caught.

The US-CERT has an official warning out for EMOTET Malware: https://www.us-cert.gov/ncas/alerts/TA18-201A

It is an advanced, modular banking Trojan that primarily functions as a downloader or dropper of other banking Trojans.

Because of the wormlike qualities removing malware inside a network can be costly.

See attached image.

polonus