Locky

https://www.virustotal.com/en/file/e84f2f9a4c065c735866bc5b3734e14fb5557e86c5e5a94aaa84f0766be33eb8/analysis/1504043003/

http://fluritreuhand.ch/6gdytf6GF.bin
http://146.120.110.46/imageload.cgi

Received: from [112.196.5.28] (HELO Lab1Main)
  by inbound.appriver.com (CommuniGate Pro SMTP 6.1.7)
  with ESMTP id 691331114 for user@domain; Tue, 29 Aug 2017 17:27:50 -0400
From: "user" <user@domain>
To: <user@domain>
Subject: Emailing: Payment_201708-201
Date: Wed, 30 Aug 2017 02:58:47 +0530
Message-ID: <iSXzxSLVQDnPGlUtvIMsRIyxLZcdhMO@domain>
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_0222_708E4B08.64D335A6"
X-Mailer: Microsoft Outlook 14.0
Content-Language: en-gb

This is a multipart message in MIME format.

------=_NextPart_000_0222_708E4B08.64D335A6
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit


Your message is ready to be sent with the following file or link
attachments:

Payment_201708-201


Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments.  Check your e-mail
security settings to determine how attachments are handled.

------=_NextPart_000_0222_708E4B08.64D335A6
Content-Type: application/octet-stream;
	name="Payment_201708-201.7z"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
	filename="Payment_201708-201.7z"

N3q8ryccAAQ1J+ORKA4AAAAAAAAjAAAAAAAAAOhIjNfgU5INn10ALBJGR+zLy7oqQuiK6+l+
R7wKW3GgOsGsDOY56ygaHLk2mkpu2kEsAz3KXcGuG6fYIqmGDolqlAZU5Ob0Mtg7lBySv4yB
py6210az0sUdag+nOk0gzZ8D/ShbI9JmF7sTOZKlJvM1Xn7Q7aTHoBxtLkmXG+RIOxMrKCpH
e7re6XbqZD/oFbR3+K3R4fJKskMq74829phxyPNYc29noP6AlvFXBvN6d7C6qEez5ed4QZJ3