From Jonathan Carroll [Jonathan@john-s-shackleton.co.uk]
Date Wed, 16 Dec 2015 11:11:09 -0000
Subject Documentation: Your Order Ref: SGM249/013
Your Order: SGM249/013
Our Order: 345522
Advice Note: 355187
Despatch Date: 22/12/15
s547369.DOC Shackleton Invoice Number 355187
John S. Shackleton (Sheffield) Ltd
4 Downgate Drive
Tel: 0114 244 4767
Fax: 0114 242 5965
Phone us for a free stock brochure.
Our product range includes: Beams, Columns, Pfc's, Channels, Flats, Rounds, Squares,
Angles, Tees, Convex, ERW Tubes, Hollow Section, Cold Reduced Sheet, Hot Rolled Sheet
Galvanised Sheet, Zintec Sheet, Floorplate, Open Mesh Flooring, Handrail Standards,
Tube, Tubeclamps. Welded Mesh, Expanded Metal, Perforated Sheet, U Edging, Fencing
and Bright Bar.
Our Terms and Conditions of Sale apply to all quotations and the supply of all goods.
Copies of our Terms and Conditions of Sale are available on request or can be found
on our website www.johnsshackleton.co.uk . These
Terms and Conditions include a provision (see term 12) that title to goods supplied
shall not pass to a customer until payment is received by us in full for all goods
supplied. We only accept orders for the supply of goods on the basis our Terms and
Conditions of Sale apply.
I have only seen a single sample of this spam, with an attachment s547369.DOC which has a VirusTotal detection rate of 4/55. According to this Malwr Report it downloads a malicious binary from:
This binary has a detection rate of 4/53 and is the same payload as found in this spam run, leading to the Dridex banking trojan.