Malware spam: "Tax Invoice IN092649"/ Karin Edwards [karin.edwards@batonlockuk.com]

This fake financial spam is not from Baton Lock Ltd but is instead a simple forgery with a malicious attachment.

From:    Karin Edwards [karin.edwards@batonlockuk.com]
Date:    20 January 2016 at 09:34
Subject:    Tax Invoice IN092649

Tax Invoice IN092649 from Baton Lock Ltd.

Best Regards
Karin Edwards
Baton Lock Ltd

Attached is a file Tax Invoice IN092649.DOC which comes in at least two different versions (VirusTotal results [1] [2]) which according to these Malwr reports [3] [4] downloads from:

www.lassethoresen.com/98jh6d5/89hg56fd.exe
www.helios.vn/98jh6d5/89hg56fd.exe

The dropped file is Dridex, the same as used in this campaign.