Here is a very clever phishing attempt / attempt to drop malicious code.
The email further below was received with the subject line: Notice of Payment.
Red Flags:
Red Flag number 1 is that it is purportedly from UBS Switzerland AG but the email address is emaralmada@emar.almada.sa
So, caution is advised.
Bottom line – if you receive this e-mail and view the attached PDF you will see a ‘warning’ saying; “This version of Adobe Acrobat on your computer does not have the latest updates. Acrobat cannot be used to view PDF Documents until you download and update from Acrobat.”
And that is Red Flag number 2.
Red Flag number 3 is the link that the “Update Acrobat Now” takes you to: marycar.com.br/Adobe_PDF_Reader_Upgrade.exe.js – as you can see that link is definitely dodge.
And, yes, I did go to the marycom.br site to give them the heads up that their site had been compromised BUT, only their index page works, the site is in Portguese and it looks suspiciously like a co-conspirator.
Just to be clear:
The marycar.com.br/Adobe_PDF_Reader_Upgrade.exe.js link is extremely dangerous and points directly to active malware.
Here is why that specific file name should set off immediate alarm bells:
The Double Extension Trick (.exe.js): This is a classic social engineering and evasion tactic. Windows systems are often configured by default to hide file extensions for known file types. A file named Adobe_PDF_Reader_Upgrade.exe.js will often look to an unsuspecting user like a harmless document or installer (Adobe_PDF_Reader_Upgrade.exe), but the .js at the very end means it is actually a JScript/JavaScript file.
What Happens If It Runs: When executed, a malicious .js file acts as a “dropper.” It silently executes a script in the background that reaches out to a command-and-control (C2) server, downloads full-scale malware (such as a remote access trojan, info-stealer, or ransomware), and installs it on your machine—all while pretending to update a PDF reader.
The Domain: The URL relies on a compromised or spoofed third-party domain hosting malicious payloads.
WHAT YOU SHOULD DO:
Do not click it, download it, or open it under any circumstances.
If you or someone else already clicked or downloaded it, do not run the file.
If the file was executed, immediately isolate the computer from the network (unplug the ethernet cable or turn off Wi-Fi) and run a full, deep offline malware scan using an enterprise-grade endpoint security tool.
Proceed with caution dear reader.
The email as received is below:
Notice of payment
This e-mail contains official information from UBS Switzerland AG and is intended for use by the
addressee only.There are some minimum requirements needed before you will be able to view PDF
attachments:– You require specific software on your computer capable of reading PDF files.
– In the unlikely event that you do not have such software, you can download
Adobe Acrobat Reader from www.adobe.com free of charge.
– If there is no attachment to this e-mail, speak to your network/e-mail administrator,
Internet Service Provider or computer support technician to assist you in
resolving possible restrictions in receiving PDF attachments.Important Notice: Important restrictions, qualifications and disclaimers (“the Disclaimer”) apply to
this e-mail. To read this click on the following address: http://www.ubs.com/disclaimerThe Disclaimer forms part of the content of this e-mail in terms of section 11 of the Electronic
Communications and Transactions Act, 25 of 2002. If you are unable to access the Disclaimer,
send a blank e-mail to disclaimer@ubs.com and we will send you a copy of the Disclaimer.