Order turns out to be phishing attack in Excel look

The email that arrives in potential victims' inboxes is supposedly an order with an attachment called purchase-order.htm:

There are several clues that expose the order as fake and potentially dangerous:

1. A quick search reveals: The supposed company, VOLTRANS TRADING CO., LTD, does not exist under this name in Vietnam. There is a company that sounds similar: VOLTRANS LOGISTICS CO. LTD
2. The sender's email address does not sound like an official company address and does not match the supposed sender's name: a free email address, is questionable for a company
3. There is no nominated recipient for this message. The sender address is also the recipient address: <t[DELETED]n@gmail.com>
4. The document attachment is an .htm file, which is somewhat unusual for an order form: purchase-order.htm – this is a very important clue. Neither HTM(L) attachments nor scripts promise anything good.
5. The email contains a number of spelling mistakes. Of course, spelling mistakes can always occur, but they should be taken as a clue in forming an opinion: "Dear sir", "i did not receive" and "so i have just sent" as well as “Quotation”.
6. The sign-off at the end of the email is duplicated: "Best Regards" and "With thanks & best regards", another carelessness we can notice.

The file attempts to disguise itself as a type of Microsoft Excel online document. In the background, an Excel spreadsheet can be seen. However, this is just an image (order.png), not a spreadsheet that can be edited. This and other images are loaded from a server based in Hong Kong.

The attackers are trying to use social engineering techniques to make the potential victim even more curious about the supposed document. For example, the highlighted red text on the right hand side suggests that this is a confidential document.

But the appearance of the web page might give the user an indication that this is a fake. For example:

1. The upper edge of the web page contains a mistake in the grey bar: the F here is in the wrong place. The attackers have placed it outside of the <div> segment in the HTML code. 
2. The logon screen does not look like it would when logging on to the Microsoft live.com platform to work on a document online. Things such as the fact that, when opened, the .htm file looks like an Excel 2013 file and not the latest product, Excel 2016, hint at this. And finally, because of the word "Starting...", we assume that this login window is a modified screenshot of the Excel 2013 start window. As it seems, the attackers are mainly aiming at users who are working with online Microsoft Office tools.
3. The language in the Excel image and the login form is English. This is another warning signal for users who actually use their system and software in a different language. The user is presumably meant to enter his login data into the form to start the download. But this involves a form that uses a background image (excel.png) downloaded from the same server in Hong Kong, and from the same domain, as the previous background image.

This web page is on a server in London, England. Here again, it looks like the attackers have seized the server to store their own data there, as this is a website that is actually legitimate but that now contains a subdirectory in which the attackers' data resides.

It is obvious in this error message that the attackers have copied together multiple texts without deleting duplications – as with the sign-off in the email. The last part of the message, "logging in or", does not fit the sentence. Even so, the attackers are using another social engineering technique here to encourage the user to enter data into the fake Excel document once again. As mentioned, the appearance is rather unprofessional. Presumably they also do not want to cause any more waves at this stage of the attack, as they have received at least one data set.

The loss of personal login data is always associated with risks! 

If the attackers gain access to an email account – whether a private individual's or a company's – this can be used for sending more spam. For this reason, access to a company account is more attractive, of course, as it provides a trustworthy sender address as well as a trustworthy sender server.

This current scam, even though it does not ask for any log-in data in particular, suggests that Windows Live data are the focus. This data is valuable, because it offers access to a lot of services at the same time. Attackers can simultaneously spy on online Office documents, send emails, browse through the online files server and much more. They can gain access to a broad variety of tools and services as well as information. This can be misused as well – especially in the corporate environment.

If the data is lost in a company context, far-reaching problems can develop, such as unauthorised access to internal company data and emails. Such misuse can be carried out secretly by the attackers and, potentially, over a long period of time, e.g. until the affected user needs to reset his password due to corporate policy, or if irregularities occur in the system logs.

The data can also be sold on in underground markets by the attackers, subsequently bought by criminal buyers and misused for a wide range of activities.

The attackers have chosen a rather unknown scam for their attack and have used a new lure– this can be dangerous for inattentive readers. Vigilant and educated computer users can spot the scam quite easily: the email comes with a suspicious attachment, contains errors, as do the phishing page and the error message.

The HTML code suggests to us that they have copied together elements from various sources, presumably using different phishing kits, and have made mistakes when doing so as well.

Using the same server for delivering the images and collecting the phishing data is risky from the attackers' perspective. On the one hand, they are trying to cover up their tracks by visiting different domains, which would not immediately be suspicious in network data traffic, but on the other hand, with this attack, the server is a single point of failure for them.

This scam using a fake Excel document is entirely worth mentioning; however, luckily for the user, it can easily be revealed just by using your eyes.