From: Rachael Murphy
Date: 23 December 2015 at 13:05
Subject: Christmas Industrial Decorating invoice-50473367)
Please find attached 1 invoice for processing.
Regards and Merry Christmas!
This email has been scanned by the Symantec Email Security.cloud service.
The sender's name and reference number varies, the attachment is in the format invoice45634499.doc and it comes in at least three different versions (VirusTotal results   ).
Analysis is pending, the payload is likely to be the Dridex banking trojan.
The payload appears to be the same as the one found in this spam run.