The Dridex bots are still not having a good day today. The 3rd malformed/damaged /broken malspam is an email with the subject of Statement pretending to come from Kelly Pollard kelly.pollard@carecorner.co.uk with a damaged attachment that is supposed to be a malicious word doc or XLS spreadsheet attachment which would try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Because the attachments are damaged they will not harm you but be aware that this is a perennial template pretending to be an invoice, booking, statement or similar document and there are always genuine malware versions being sent out each day. Some malformed or misconfigured email servers might attempt to fix the broken email and actually deliver a working copy. The damaged/broken attachment has a name something like Statement 012016.doc and cointains Dridex banking malware from http://149.156.208.41/~s159928/786585d/08g7g6r56r.exe.