From: Terry CherryThe sender's name, references and attachments may vary. This appears to be a spam from Dridex 120, and it is a characteristic that there is a very large number of variants of the attachments. In this case, I analysed three different attachments with detection rate of about 2/55    and which according to these Malwr reports   , downloads a binary from the following locations:
Date: 11 January 2016 at 10:48
Subject: Kaseya Invoice - 1ED0C068
Dear Accounts Payable,
Thank you for your purchase of Kaseya Licenses. Attached please find our invoice for your purchase under the K2 Software Catalog.
Our bank details for wire transfer are included on the attached invoice.
Should you wish to submit payment via credit card, please contact our customer service department (email@example.com) for assistance with adding card details through our portal.
Please do not hesitate to let us know if you have any questions.
Thanks again for your patronage.
Kaseya Customer Invoicing
Corporate: +1.415.694.5700 X4946
All of these IPs should be considered to be malicious:
188.8.131.52 (LLHost Inc, Netherlands)
184.108.40.206 (JSC Server, Russia)
220.127.116.11 (McHost.ru, Russia)
A binary named trap.exe with an MD5 of aab74722020e631147836fc009f9419d and a detection rate of 5/54 is downloaded. According to this Malwr report the executable phones home to:
18.104.22.168 (Hetzner, Germany)
The payload is the Dridex banking trojan.