‘You Have Received a 5 Page fax’ Email Contains Malware

Email claims that you have received a 5 page fax from online fax service eFax and can view the document by opening an attached file.

Brief Analysis:
The email is not from eFax and the attachment does not contain a faxed document. Instead, the attached contains a malicious file that, if opened, can install malware on your computer.

Fax Message

You have received a 5 page fax at Thu, 21 Jan 2016 10:26:57 +0700.* The reference number for this fax is syd1_did14-20160121032657-8544745-16.

View this fax using your PDF reader.

Please visit www.efax.com.au/web-fax-faq if you have any questions regarding this message or your service.

Thank you for choosing eFax!

The eFax® Team

Five Page Fax Malware Email

Detailed Analysis:
According to this email, which at first glance appears to come from popular online fax service eFax, you have received a five page fax. The email, which features the eFax logo along with a fax reference number and other details, claims that you can view your fax using your PDF reader. The email includes an attached .zip file which supposedly contains the promised fax.

However, the email is not from eFax and the attachment does not contain a fax message.

While reliance on the once ubiquitous office fax machine has ebbed considerably in recent years, faxes can still be sent and received via online fax services. These services usually send users an email to notify them that a fax has been received.

The criminals bank on the fact that at least a few customers of such services may open the attachment without due caution. And, even people that have never used such a service may open the attachment out of simple curiosity.

Opening the attached .zip file reveals a dangerous executable file that, if clicked, can install malware on Windows based computers.

The exact nature of the malware payload may vary. Typically however, once installed, such malware may harvest sensitive information from the infected computer and send it to criminals waiting online. It may also download and install further malware components and allow the criminals to control the infected computer from afar.

Because online fax services do generally notify people of incoming faxes via email, criminals often send emails pretending to be from such services to trick people into installing malware.  If you receive such an email, do not open any attachments or click any links that it contains. Instead, login your online fax service account by entering the account address into your browser’s address bar.  If you really did receive a fax, you should be able to safely access and view it via the service’s website.

Malware Threat

Last updated: September 1, 2016
First published: January 22, 2016
By Brett M. Christensen
About Hoax-Slayer

‘You Have Received a 4 Page Fax’ Malware Email
‘Incoming Fax Report’ Malware Email
Malware Threat Articles