2020-11-06 (Friday) - malspam pushing Formbook

Received: from gmail.com (unknown [156.96.62.91]) by [removed] for [removed];
	Fri,  6 Nov 2020 13:29:33 +0000 (UTC)
Reply-To: fortunatodaniel.johndeere@gmail.com
From: "ART IMPEX GROUP LLP" <admin@gmail.com>
To: [removed]
Subject: RE: New Purchase Order
Date: 06 Nov 2020 05:29:28 -0800
Message-ID: <20201106052928.25D9DB79A8E2FA5A@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_0012_1EF192BB.8A3242F2"
X-Recommended-Action: reject

This is a multi-part message in MIME format.

------=_NextPart_000_0012_1EF192BB.8A3242F2
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.=
w3.org/TR/html4/loose.dtd">

<HTML xmlns:o =3D "urn:schemas-microsoft-com:office:office"><HEAD>
<META name=3DGENERATOR content=3D"MSHTML 11.00.9600.16384"></HEAD>
<body style=3D"MARGIN: 0.5em">
<P style=3D"BACKGROUND: white; MARGIN: 0cm 0cm 0pt"><STRONG><SPAN style=3D'=
FONT-FAMILY: "Comic Sans MS"; COLOR: navy'>Dear Sir/Madam,<o:p></o:p></SPAN=
></STRONG></P>
<P style=3D"BACKGROUND: white; MARGIN: 0cm 0cm 0pt"><SPAN style=3D'FONT-SIZ=
E: 6.5pt; FONT-FAMILY: "Verdana","sans-serif"; COLOR: black'><o:p>&nbsp;</o=
:p></SPAN></P>
<P style=3D"BACKGROUND: white; MARGIN: 0cm 0cm 0pt"><STRONG><SPAN style=3D'=
FONT-FAMILY: "Comic Sans MS"; COLOR: navy'>I am re-sending this email as we=
 have not received any response from your&nbsp;firm regarding our pending P=
O.</SPAN></STRONG><SPAN style=3D'FONT-SIZE: 6.5pt; FONT-FAMILY: "Verdana","=
sans-serif"; COLOR: black'><o:p></o:p></SPAN></P>
<P style=3D"BACKGROUND: white; MARGIN: 0cm 0cm 0pt"><STRONG><SPAN style=3D'=
FONT-FAMILY: "Comic Sans MS"; COLOR: navy'>Please find attached NEW PURCHAS=
E ORDER.</SPAN></STRONG><SPAN style=3D'FONT-SIZE: 6.5pt; FONT-FAMILY: "Verd=
ana","sans-serif"; COLOR: black'><o:p></o:p></SPAN></P>
<P style=3D"BACKGROUND: white; MARGIN: 0cm 0cm 0pt"><STRONG><SPAN style=3D'=
FONT-FAMILY: "Comic Sans MS"; COLOR: navy'>If you have any comment regardin=
g the payment terms as mentioned, kindly notify us immediately.</SPAN></STR=
ONG><SPAN style=3D'FONT-SIZE: 6.5pt; FONT-FAMILY: "Verdana","sans-serif"; C=
OLOR: black'><o:p></o:p></SPAN></P>
<P style=3D"BACKGROUND: white; MARGIN: 0cm 0cm 0pt"><SPAN style=3D'FONT-SIZ=
E: 6.5pt; FONT-FAMILY: "Verdana","sans-serif"; COLOR: black'>&nbsp;<o:p></o=
:p></SPAN></P>
<P style=3D"BACKGROUND: white; MARGIN: 0cm 0cm 0pt"><STRONG><SPAN style=3D'=
FONT-FAMILY: "Comic Sans MS"; COLOR: navy'>Waiting for your prompt feedback=
</SPAN></STRONG><SPAN style=3D'FONT-SIZE: 6.5pt; FONT-FAMILY: "Verdana","sa=
ns-serif"; COLOR: black'><o:p></o:p></SPAN></P>
<P style=3D"BACKGROUND: white; MARGIN: 0cm 0cm 0pt"><STRONG><SPAN style=3D'=
FONT-FAMILY: "Comic Sans MS"; COLOR: navy'>Best Regards.</SPAN></STRONG><SP=
AN style=3D'FONT-SIZE: 6.5pt; FONT-FAMILY: "Verdana","sans-serif"; COLOR: b=
lack'><o:p></o:p></SPAN></P>
<P style=3D"BACKGROUND: white; MARGIN: 0cm 0cm 0pt"><STRONG><SPAN style=3D'=
FONT-FAMILY: "Comic Sans MS"; COLOR: navy'>Roman Cheremisin</SPAN></STRONG>=
<SPAN style=3D'FONT-SIZE: 6.5pt; FONT-FAMILY: "Verdana","sans-serif"; COLOR=
: black'><o:p></o:p></SPAN></P>
<P style=3D"BACKGROUND: white; MARGIN: 0cm 0cm 0pt"><SPAN style=3D'FONT-SIZ=
E: 6.5pt; FONT-FAMILY: "Verdana","sans-serif"; COLOR: black'>&nbsp;<o:p></o=
:p></SPAN></P>
<P style=3D"BACKGROUND: white; MARGIN: 0cm 0cm 0pt"><STRONG><SPAN style=3D'=
FONT-SIZE: 14pt; FONT-FAMILY: "Comic Sans MS"; BACKGROUND: white; COLOR: #9=
93300'>ART IMPEX GROUP LLP</SPAN></STRONG><SPAN style=3D'FONT-SIZE: 6.5pt; =
FONT-FAMILY: "Verdana","sans-serif"; COLOR: black'><BR></SPAN><STRONG><SPAN=
 style=3D'FONT-FAMILY: "Comic Sans MS"; BACKGROUND: white; COLOR: #993300'>=
130000, Aktau, 14 microdistrict, building &#8470;7</SPAN></STRONG>
<SPAN style=3D'FONT-SIZE: 6.5pt; FONT-FAMILY: "Verdana","sans-serif"; COLOR=
: black'><BR></SPAN><STRONG><SPAN style=3D'FONT-FAMILY: "Comic Sans MS"; BA=
CKGROUND: white; COLOR: #993300'>Republic of Kazakhstan</SPAN></STRONG><SPA=
N style=3D'FONT-SIZE: 6.5pt; FONT-FAMILY: "Verdana","sans-serif"; COLOR: bl=
ack'><BR></SPAN><STRONG><SPAN style=3D'FONT-FAMILY: "Comic Sans MS"; BACKGR=
OUND: white; COLOR: #993300'>Roman.Cheremisin@artimpexx.kz</SPAN></STRONG>
<SPAN style=3D'FONT-SIZE: 6.5pt; FONT-FAMILY: "Verdana","sans-serif"; COLOR=
: black'><BR></SPAN><STRONG><SPAN style=3D'FONT-FAMILY: "Comic Sans MS"; BA=
CKGROUND: white; COLOR: #993300'>www.artimpexx.kz</SPAN></STRONG><SPAN styl=
e=3D'FONT-SIZE: 6.5pt; FONT-FAMILY: "Verdana","sans-serif"; COLOR: black'><=
o:p></o:p></SPAN></P>
<P>&nbsp;</P></BODY></HTML>
------=_NextPart_000_0012_1EF192BB.8A3242F2
Content-Type: application/octet-stream; name="New Purchase Order.gz"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="New Purchase Order.gz"

- NOTE: The attachment has been removed from this message
- Attachment SHA256 hash: f5dd8897534cc33654993055789a6935b53e1ea61ae1c78e237e4f89253b8f3e
- Extracted Formbook EXE: 4a133d999625335790a3b0846e11e45b43d8b44b000aaac9bb2379f16a06903c
- Tweet with info about this paste: https://twitter.com/malware_traffic/status/1324751772943089666

------=_NextPart_000_0012_1EF192BB.8A3242F2--