# MA-473.042015: MyCERT Alert - Circulation of Emails Attached with Malicious Document

**Date:** 28 Apr 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-473.042015  
**Advisory ID:** MA-473.042015

---

#### **1.0 Introduction** MyCERT has been receiving several reports of circulation of a malicious email with a suspicious attachment. The email comes with various contents with includes application for jobs and internships. The email also contains a malicious attachment which is a document file purportedly containing resume of the applicant.
**2.0 Impact**
Based on our initial analysis, users who clicks the document will be prompted to a window to enable macro. Once enabled, it will download another executable file from a malicious URL within the document. Once infected, the malware can have full control of the infected machine and download other malware.
**3.0 Brief Description**
Figure 1 below shows the macro security alert that will be prompted in Microsoft Office when the users open the attachment in the email.
**Figure 1:** Macro security alert window as appeared in Microsoft Office.
Once users enable the Macro, the computer will be infected with the malware.
**4.0 Systems Affected**
All Windows operating systems running Microsoft Office with macro enabled are affected.
**5.0 Recommendations**
- Do not open and save Microsoft Office file from unknown sources or unexpectedly.
- Users are encouraged to always disable macros in Microsoft Word.
- Install an updated version of antivirus software and keep it updated daily.
- Do not click on any attachments you received via email and instant messages. If you need to open the attachment, save the attachment and scan it with an updated version of antivirus to confirm that the attachment is clean before you can open it.
- If your computer is infected with the malware, run an updated version of antivirus software to scan, detect and remove the malware from the infected computer.
- Users can also use free removal tools which are available at:
Trendmicro: <http://housecall.trendmicro.com/>
McAfee: <http://home.mcafee.com/downloads/free-virus-scan>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#3f5c465d5a4d0606067f5c465d5a4d4c5a5c4a4d564b46115246) or [[email protected]](/cdn-cgi/l/email-protection#89e4f0eaecfbfdc9e4f0eaecfbfda7e6fbeea7e4f0) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**6.0 References**
- Trendmicro: <http://housecall.trendmicro.com/>
- McAfee: <http://home.mcafee.com/downloads/free-virus-scan>