◎10/10

件名：Status of invoice A217数字4桁-数字2桁

From：FIRSTNAME LASTNAME <invoicing＠Toドメイン> (を偽装)

本文：

Hello,

Could you please let me know the status of the attached invoice? I appreciate your help!

Best regards,

FIRSTNAME LASTNAME

Tel: 206-575-8068 x 100

Fax: 206-575-8094

*NEW* invoicing＠Toドメイン

* Kindly note we will be closed Monday in observance of Labor Day *

 添付ファイル：A217数字4桁-数字2桁.html

htmlをBASE64エンコードして添付するパターン

html内にiframeで別のURLにアクセス

https://www.virustotal.com/#/file/b4b6674d2bbaa3dd4a5e5fb5abc1fa4ef1fa9774f8702ab1915596a16b982415/detection

https://www.virustotal.com/#/file/f2249daac1d424b64acaf07743f0284e32e30a34c3e45cacd55b887255a474f6/detection

https://www.virustotal.com/#/file/4994fc10933371d51a2c310ff60239d4103a2599bcc6cbe49c181e49ba7be8e0/detection

iframeでのリンク先

https://www.virustotal.com/#/url/1523a6c0feac11fc373543fbccd718b6e94d3f4a12c986788a48f9b3efb4257a/detection