From: Gregg gale
Date: 30 March 2016 at 13:42
Subject: Additional Costs
Based on our contact (#084715), we're required to inform you about additional costs associated with your account, more information attached.
Reference numbers and sender names vary, the attachments are similar to the ones in this spam run. Various Malwr analyses for the samples I captured      show download locations at:
This binary has a detection rate of 7/56. Analysis of the binary    shows that it phones home to the same IPs reported here.