From: HM Revenue and Customs [email@example.com]In this case the link in the email goes to ecanovas.com/boceto/hmrc.exe which the user is expected to download and run. It has a VirusTotal detection rate of 3/51. Automated analysis tools are pretty inconclusive    but do reveal some of the behavioural activity.
Reply-To: HM Revenue and Customs [firstname.lastname@example.org]
Date: 25 July 2014 12:19
Subject: Notice of Underreported Income
Taxpayer ID: ufwsd-000007954108UK
Tax Type: Income Tax
Issue: Unreported/Underreported Income (Fraud Application)
Please review your tax income statement on HM Revenue and Customs ( HMRC ).Download your HMRC statement.
Please complete the form. You can download HMRC Form here.