I just love the subject line in this one. Wow, very creative syntax (though the misspelling of “declined” lessens the impact). I also got a second version, but the subject was much more prosaic. This blog says the links download malware.
Version 1:
Sender: Argelia Vogel (SterlingGroesbeck@myexcel.com)
Subject: The variant of the contract you’ve offered has been delcined.
Text:
After our legal department studied this contract carefully, they’ve noticed the following mismatches with our previous arrangements. We’ve composed a preliminary variant of the new contract, please study it and make sure that all the issues are matching your interests
Contract.doc 84kb (link leads to http://dsdinternational.net/images/dsrwk.htm?FMCGCYP=MH82W31MC&089=1RY6NFZN&YYA66YM=I2CU1XELWV0YSTMK632IUWPT4&HJEL=UQPI4T3&CAB4RT4=51LIGZMZ29T80052AXHWBSA9&04KZQW4=QK5T9UA8C8AXGGHZ8J&)
Best Wishes
Argelia Vogel
Fingerprint: 172d59c7-2d5b834b
Version 2:
Sender: Catharine Padgett (NiamhStabler@visi.net)
Subject: We’re breaking the contract
Text:
According to the violation of the paragraph §11.6.7 of our contract, we’re obliged to inform you that we’re breaking the contract with you. You can find the original letter with signatures and stamps attached as well as the legal basis for this step after you follow this link.
Contract.doc 119kb (link leads to http://pokerlogic.ca/forum/kysgw.htm?0JDH0=LXZKAZNARHOSCT&WHC=8JTSQ4KRSFYL&SGY=WKE20ZCFAN9K8HBUU1J9P2R&F82L6SE=L05FZB1O9DLWJ9DS3TJ16K3U&BVAGK=A8XB9J4T25TR6BP&Q8M7LF=IE342QA6JD4&J8Y=I8E58E20NMTR&)
Best Wishes
Catharine Padgett
Fingerprint: c0372849-28e1116b
Chestnut says
I just received variant #2 a few seconds ago, and had a quick Google to see how ‘popular’ this type of spam is, as I’d never come across it before. Wrongly typed email address, didn’t even have a URL for me to click through, nor did they have a virus-laden attachment.
Pitiful spam attempt.
Robert says
I couldn’t find much info on either version. Both of mine had links to click, though — the links were labeled “contract.doc”.
Cormamin says
We just got Varient #2 on our network as well. Thanks for the info!
dave says
This is still going around as of 17/10/12