You know the drill by now...
First you get an email, something like this one, with a IP address url:
You are taken to a fake page, asking to download an exe file:
But the exe file, isn't all that it seems. Here's what VirusTotal had to say:
Currently detected as: Email.Malware.Sanesecurity.0709160x (0-3)