From: Margo Lawrence [mailto:firstname.lastname@example.org]There's an HTML-in-ZIP attachment, leading to a malicious payload at dhjhgfkjsldkjdj.ru (report here). Blocking access to the IP addresses shown in this post may be prudent.
Sent: 04 April 2012 14:17
Subject: Re: FW: End of Aug. Statement
as reqeusted I give you inovices issued to you per february (Internet Explorer format).
Wednesday, 4 April 2012
"End of Aug. Statement" spam / dhjhgfkjsldkjdj.ru
this one earlier today.