Email with New_Order_PO3482045_pdf.jar attachment: “Greetings! Find attached our final Purchase order for March 2015″Inside the Jar file is a Windows Executable file (Note the dual extension trick): “Sha256 Hashes” There’s a Jar file attached to the email: “Malware Anti-Virus Reports” The email is sent to Ras Trading Co (Libya):Algeria St., near Kick off ShopsGaryunis Area, Benghazi, Libya.”]
Source: http://sanesecurity.blogspot.com/2015/03/devakimanager-of-importationras-trading.html