Date: Fri, 9 Dec 2011 -01:35:13 -0800
From: "Josie Carlson" [TateAlmgren@concentric.net]
Subject: The variant of the contract you've offered has been delcined.
After our legal department studied this contract carefully, they've noticed the following mismatches with our previous arrangements. We've composed a preliminary variant of the new contract, please study it and make sure that all the issues are matching your interests
With respect to you
SHA512 check sum: [redacted]
This leads to a malicious payload on ciredret.ru/main.php, hosted on 18.104.22.168 (as with this other spam/virus run), so blocking 22.214.171.124/23 (UkrStar ISP, Ukraine) is a very good idea at the moment.