Date: Thu, 21 Feb 2013 14:32:08 -0500 [14:32:08 EST]Attached is a file called payment receipt - 884993762994.zip which unzips to payment receipt - 884993762994.exe which has a disappointing VirusTotal detection count of just 14/46. Automated analysis tools are inconclusive.
From: Payment notification system [firstname.lastname@example.org]
Subject: Automatic transfer notification
ACH transaction is completed. $443 has been successfully transferred.
If the transaction was made by mistake please contact our customer service.
Receipt on payment is attached.
*** This is an automatically generated email, please do not reply ***
Blocking EXE-in-ZIP files at the perimeter generally causes very little trouble, assuming you can do it..