From firstname.lastname@example.orgThe invoice number is randomly generated. The attachment is a PDF file with a name matching the invoice number (e.g. 123-093702027-reg-invoice.pdf).
Date Wed, 19 Apr 2017 17:19:51 +0500
Subject Copy of your 123-reg invoice ( 123-093702027 )
Thank you for your order.
Please find attached to this email a receipt for this payment.
Help and support
If you are still stuck why not contact our support team? Simply visit our 123-reg
Support Centre and click on the Ask a Question tab.
Thank you for choosing 123-reg.
The 123-reg team.
This PDF file appears to drop an Office document according to VirusTotal results.
Hybrid Analysis shows the document dropping a malicious executable with a detection rate of 15/61. It appears to contact the following IPs (some of which contain legitimate sites):
184.108.40.206 (Affinity Internet, US)
220.127.116.11 (Alentus Corporation, US)
18.104.22.168 (Budapest University of Technology and Economics, Budapest)
22.214.171.124 (Strato AG, Germany)
126.96.36.199 (RamNode LLC, US)
The general prognosis seems to be that this is dropping the Dridex banking trojan.