From: firstname.lastname@example.orgThe attachment is named passport.doc. It is exactly the same malicious payload as the one used in this spam run earlier today, and it drops the Dridex banking trojan on the victim's PC.
Date: 30 March 2015 at 11:58
Subject: FW: Passport copy
From: Raad Ali [mailto:email@example.com]
Sent: 26 March 2015 08:03
Subject: Passport copy
Please find attached copy of the passport for my wife and daughter as requested. please note we need to complete on the purchase in 4 weeks from the agreed date.