Spoofed Email

Return-Path: [email protected]
Received: from mail.domain.org (LHLO mail.domain.org) (10.39.6.4) by
mail.domain.org with LMTP; Tue, 9 Aug 2016 10:10:49 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
by mail.domain.org (Postfix) with ESMTP id 62AE81F6C319
for <[email protected]>; Tue, 9 Aug 2016 10:10:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at domain.org
X-Spam-Flag: NO
X-Spam-Score: 0.772
X-Spam-Level:
X-Spam-Status: No, score=0.772 tagged_above=-10 required=4
tests=[BAYES_00=-1.9, FSL_HELO_NON_FQDN_1=0.001, HTML_MESSAGE=0.001,
RDNS_NONE=0.793, SPF_FAIL=0.001, TO_EQ_FM_DOM_SPF_FAIL=1.876]
autolearn=no autolearn_force=no
Received: from mail.domain.org ([127.0.0.1])
by localhost (mail.domain.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id JTDYbIW27SsZ for <[email protected]>;
Tue, 9 Aug 2016 10:10:47 -0700 (PDT)
Received: from HP-PC (unknown [117.234.160.151])
by mail.domain.org (Postfix) with ESMTP id E60D81F6C14B
for <[email protected]>; Tue, 9 Aug 2016 10:10:44 -0700 (PDT)
MIME-Version: 1.0
From: "Velma" <[email protected]>
Date: Tue, 09 Aug 2016 22:40:36 +0530
Message-ID: <e08236dba6-3254a5-0de0cc1905c3fc7=9b99f3f2+[email protected]>
Subject: Documents Requested
To: "joe_user" <[email protected]>
Content-Type: multipart/mixed; boundary=646410e1e4788045d1a5687535db8

--646410e1e4788045d1a5687535db8
Content-Type: multipart/alternative; boundary=646410e1e4788045d145687535db6

--646410e1e4788045d145687535db6
Content-Type: text/plain; charset=UTF-8

Dear joe_user,

Please find attached documents as requested.

Best Regards,
Velma

--646410e1e4788045d145687535db6
Content-Type: text/html; charset=UTF-8

<div dir="ltr">Dear joe_user,<div><br></div><div>Please find attached documents as requested.</div><div><br></div><div>Best Regards,</div><div>Velma</div></div>

--646410e1e4788045d145687535db6--
--646410e1e4788045d1a5687535db8
Content-Type: application/vnd.ms-word.document.macroEnabled.12; name="new doc(53).docm"
Content-Disposition: attachment; filename="new doc(53).docm"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_16399f9