From: "Hood" (random from address)
Subject: Remittance Advice -FHAX74
Confidentiality and Disclaimer: This email and its attachments are intended for the addressee only and may be confidential or the subject of legal privilege.
If this email and its attachments have come to you in error you must take no action based on them, nor must you copy them, distribute them or show them to anyone.
Please contact the sender to notify them of the error.
This email and any attached files have been scanned for the presence of computer viruses. However, you are advised that you open any attachments at your own risk.
Please note that electronic mail may be monitored in accordance with the Telecommunications (Lawful Business Practices)(Interception of Communications) Regulations 2000.
The Attachment, for example FHAX74.xls contains a macro code to download extra malware onto
you system. The attachment filename is random.
Md5 hashes so far and report clean from VirusTotal:
Decoded macro here: (pastebin)
Sanesecurity signatures are blocking this one as:
Just to show you the sort of numbers involved in these virus runs... per hour... that one site is