‘You Have Received a 5 Page fax’ Email Contains Malware

Outline

Email claims that you have received a 5 page fax from online fax service eFax and can view the document by opening an attached file.

Brief Analysis

The email is not from eFax and the attachment does not contain a faxed document. Instead, the attached contains a malicious file that, if opened, can install malware on your computer.

Example

Detailed Analysis

According to this email, which at first glance appears to come from popular online fax service eFax, you have received a five page fax. The email, which features the eFax logo along with a fax reference number and other details, claims that you can view your fax using your PDF reader. The email includes an attached .zip file which supposedly contains the promised fax.

However, the email is not from eFax and the attachment does not contain a fax message.

The criminals bank on the fact that at least a few customers of such services may open the attachment without due caution. And, even people that have never used such a service may open the attachment out of simple curiosity.

Opening the attached .zip file reveals a dangerous executable file that, if clicked, can install malware on Windows-based computers.

The exact nature of the malware payload may vary. Typically, however, once installed, such malware may harvest sensitive information from the infected computer and send it to criminals waiting online. It may also download and install further malware components and allow the criminals to control the infected computer from afar.

Because online fax services do generally notify people of incoming faxes via email, criminals often send emails pretending to be from such services to trick people into installing malware.

If you receive such an email, do not open any attachments or click any links that it contains. Instead, login your online fax service account by entering the account address into your browser’s address bar.  If you really did receive a fax, you should be able to safely access and view it via the service’s website.