Date: Tue, 28 Jan 2014 14:28:24 +0000 [09:28:24 EST]10/50, and the Malwr analysis shows an attempted callback to ren7oaks.co.uk on 126.96.36.199 (Enix Ltd, UK).
From: Sheila Wise [email@example.com]
Subject: New Fax Message on 01/22/2013
You Have a New Fax Message
From: (691) 770-2954
Received: Wednesday, January 22, 2014 at 11:31 AM
To view this message, please open the attachment
Thank you for using RingCentral.
The executable then downloads an apparently encrypted file from [donotclick]ren7oaks.co.uk/images/al2701.enc which has defied my half-hearted attempts an analysis.