ADP themed phishing

NOTE: Information is based on a sample of ADP themed phishing email seen on 2013-07-15

-------------------------------------------------------------------
From: "ADP_Netsecure@adp.com" <ADP_Netsecure@adp.com>
Subject: 2013 Anti-Fraud Secure Update
Attachment: "2013 Anti-Fraud Secure Update.zip"

Body:
 Dear Valued ADP Client,

We are pleased to announce that ADP Payroll System released secure upgrades to your computer.
A new version of secure update is available.
Our development division strongly recommends you to download this software update.
It contains new features:

    The certificate will be attached to the computer of the account holder, which disables any fraud activity
    Any irregular activity on your account is detected by our safety centre

Download the attachment. Update will be automatically installed by double click.
We value our partnership with you and take pride in the confidence that you place in us to process payroll
on your behalf. As always, your ADP Service Team is happy to assist with any questions you may have.

[This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, notify the sender immediately by return email and delete the message and any attachments from your system.]
-------------------------------------------------------------------

MD5s
ZIP: db0f32b419982fbf20c6b8984a65433d
EXE: 628c73e429c630c38ea1abbce22fbe29 - https://www.virustotal.com/en/file/5bb6fc85658f9228c5c98938635829f8999108a9386075698127006132dcfb2c/analysis/

GETs:
00002nd.rcomhost.com/WMs9Lz.exe
www.bansontrade.co.uk/ULiC.exe
www.artwork.1stpads.com	/ijiK.exe
rabbisconsult.com.au/oGRFY.exe

POSTs:
gfpshoppingcarts.net/forum/viewtopic.php
imhungrynow.com/forum/viewtopic.php
one2onebiznet.com/forum/viewtopic.php
greatstockfoodimages.com/forum/viewtopic.php