From "DANE THORNTON" [email@example.com]Attached is a file Order_94602~1.doc which in all the samples I have seen has been attached incorrectly to the email, and it will either appear to be zero length or garbage. The payload is meant to be the Dridex banking trojan, but this is the latest of several incidents lately where the bad guys have screwed up. Shame.
Date Wed, 20 Jan 2016 16:31:21 +0800
Subject Emailed Order Confirmation - 94602:1