From: AL HUDA LTD [firstname.lastname@example.org]
Date: 30 March 2017 at 09:05
Subject: Re:Payment Remittance Copy
Signed by: triumftools.sk
As instructed by your customer for your payment,
Find attached formal remittance copy received from our bank and contact your client for payment confirmation. All payment details is in the attached HSBC TT-Copy.
Manager - Finance and Administration
TEL: (965) 24338094 -620
FAX: (965) 24332815 Mobile: (965) 600-11-868
Attached is a .GZ archive HSBC TT-Copy.pdf.gz (this assumes you have a program on your Windows PC that can handle .gz files). This contains a malicious executable doc9876543234500001.exe which currently has a VirusTotal detection rate of 32/60.
Analysis of the binary is pending. You can be certain that it is nothing good.