From Alison Smith [ASmith056@jtcp.co.uk]
Date Thu, 04 Feb 2016 10:52:21 +0300
Subject "January balance £785"
Thank you for your recent payment of £672.
It appears the attached January invoice has been missed off of your payment. Could
you please advise when this will be paid or if there is a query with the invoice?
Registered in Scotland 29216
14 Carnoustie Place
Glasgow G5 8PB
Tel: 0141 429 1094
P Save Paper - Do you really need to print this e-mail?
The poor company being spoofed has already been hit by this attack recently  . The email address of the sender varies from message to message.
Attached is a file IN161561-201601.js which comes in at least five different versions (VirusTotal     ). This is a highly obfuscated script that looks like this [pastebin] and automated analysis of the various scripts         shows that the macro downloads from the following locations (there may be more):
This binary has a detection rate of 2/52 and phones home to:
126.96.36.199 (Clodo-Cloud / IT-House, Russia)
Note that the whole 188.8.131.52/21 block is a haven for malware, but it does also have some legitimate Russian customers. You might want to consider blocking the entire range if your users don't need to visit Russian websites. The payload is the Dridex banking trojan, and although it is unusual to see a plain .js file spammed out like this, it is consistent with botnet 220.