From Kurt Sexton
Date Tue, 26 Jan 2016 10:59:05 -0500
For the attention of Accounts Receivable,
We are attaching an up to date remittance advice detailing the latest payment on
Please contact us on the email address below if you would like your remittance sent
to a different email address, or have any queries regarding your remittance.
Credit Controller - Alpha Heating Innovation
t - 01732 783 019
f - 0844 871 8765
e - email@example.com
w - www.alpha-innovation.co.uk
Head Office: Alpha Heating Innovation - Nepicar House - London Road - Wrotham Heath
- Kent - TN15 7RS - 01732 783 000
National Distribution Centre: Alpha Heating Innovation â€“ Unit 7 Euroway â€“ Quarry
Wood Industrial Estate - Aylesford - Kent â€“ ME20 7UB - 01622 711 000
The names of the sender and reference numbers will vary. I have only seen two different variants of the attachment, in the format remittance_advice5963E9.doc (VirusTotal  ) but there are probably more. Analysis is pending, and at the moment I have not had time to decode the document that looks like this [pastebin]. It does seem to have some characterstics of a Dridex downloader.