JezK
Edit File: 1599283055.M330678P3899677.mocha3025.mochahost.com,S=10032,W=10279:2,S
Return-Path: <expdoc.cal@teamglobal.in> Delivered-To: finance.manager@jack.ngo Received: from mocha3025.mochahost.com by mocha3025.mochahost.com with LMTP id IP8yEm8fU18dgTsAaMJ/gg (envelope-from <expdoc.cal@teamglobal.in>) for <finance.manager@jack.ngo>; Sat, 05 Sep 2020 01:17:35 -0400 Return-path: <expdoc.cal@teamglobal.in> Envelope-to: finance.manager@jack.ngo Delivery-date: Sat, 05 Sep 2020 01:17:35 -0400 Received: from 231.smtpout2.netcore.co.in ([202.162.245.231]:52154 helo=smtpout102.netcore.co.in) by mocha3025.mochahost.com with esmtps (TLS1) tls TLS_DHE_RSA_WITH_AES_256_CBC_SHA (Exim 4.93) (envelope-from <expdoc.cal@teamglobal.in>) id 1kEQZu-00GW0y-Pb for finance.manager@jack.ngo; Sat, 05 Sep 2020 01:17:35 -0400 Received: from [118.179.149.2] (118.179.149.2) by TGLPLEX04.teamglobal.in (192.168.1.24) with Microsoft SMTP Server (TLS) id 15.0.1044.25; Sat, 5 Sep 2020 10:44:03 +0530 DKIM-Filter: OpenDKIM Filter v2.11.0 smtpout102.netcore.co.in 21F2BCBD849FD DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=teamglobal.in; s=default; t=1599283010; bh=7W/Fc8xeiPOUmbPDqH3Qb15IAFCQwwwnm9jukOX0Xxw=; h=Date:From:To:Subject; b=CpImQkFSEXlIOmjyKa9VKVCTrN+VImK85CpUzSrI7TNxYAk7C5ni2yJTTYsJ04W6D 9jALI8etKfydkTThm8SMoitsywCWWGuGJucIyIGwvjUPpuC5MQ6cyoZqjND7jXQwH/ stvNWwlvVU/qW89oxI7S+Zb0haYJt/BqXudlPTTo= X-Intloopheader: 0 Date: Sat, 5 Sep 2020 11:14:30 +0600 From: "Shinwari, Shukrullah" <expdoc.cal@teamglobal.in> To: "finance.manager@jack.ngo" <finance.manager@jack.ngo> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--537336933530342800916926225457742" Message-ID: <fcd1c4f21ffb4ef7a5aec2fbd607d8c9@TGLPLEX04.teamglobal.in> X-ClientProxiedBy: TGLPLEX03.teamglobal.in (192.168.1.12) To TGLPLEX04.teamglobal.in (192.168.1.24) X-SMTP44-MailScanner-Information: Please contact the ISP for more information X-SMTP44-MailScanner-ID: 5300446203E8F.AF33B X-SMTP44-MailScanner: Found to be infected X-SMTP44-MailScanner-From: expdoc.cal@teamglobal.in Subject: {Virus?} Financial Documents Review X-Cloudmilter-Processed: 1 X-Spam-Status: No, score=0.2 X-Spam-Score: 2 X-Spam-Bar: / X-Ham-Report: Spam detection software, running on the system "mocha3025.mochahost.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: Warning: This message has had one or more attachments removed (VR-9682 Medical report COVID-19.doc). Please read the "SMTP44-Attachment-Warning.txt" attachment(s) for more information. Financial Documents Review Content analysis details: (0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.3 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: your-organisation.com] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record 0.0 HTML_MESSAGE BODY: HTML included in message -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-Spam-Flag: NO ----537336933530342800916926225457742 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <html><p><b><font size=3D"+1" color=3D"red">Warning: </FONT>This message ha= s had one or more attachments removed (VR-9682 Medical report COVID-19.doc). Please r= ead the "SMTP44-Attachment-Warning.txt" attachment(s) for more information.</b><br /></p> <head> <meta http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8"> </head> <body> Financial Documents Review=20 <br> <br> <br> <br> <br> Shinwari, Shukrullah <br> shukrullah.shinwari@thejohanniter.org <br> <br> <br> <br> <pre> <!--[if !mso]><style>v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} shape {behavior:url(#default#VML);} </style><![endif]--><style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:#954F72; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Calibri",sans-serif; color:windowtext;} MsoChpDefault {mso-style-type:export-only; font-family:"Calibri",sans-serif;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> <div class=3D"WordSection1"> <p class=3D"MsoNormal">Dear Fatima Jan,<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">This is to kindly let you know that on 2<sup>nd</sup= > September 2020 around 09:00 Am I will come to your office to check = and review financial documents of Trauma and COVID19 projects for the month= of Aug 2020, this will help us to solve the issues on time and to mitigate the risk of over and under spending.<o:= p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Thanks for your time and support in advance.<o:p></o= :p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><span style=3D"color:#2E74B5"><o:p> </o:p></spa= n></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt;color:#44546A">With = Best Regards<o:p></o:p></span></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto;background:white"> <span style=3D"font-size:14.0pt;color:#44546A">Shukrullah Shinwari<o:p></o:= p></span></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto;background:white"> <b><span style=3D"font-size:14.0pt;color:#44546A">Senior Finance Officer<o:= p></o:p></span></b></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto;background:white"> <b><i><span style=3D"font-size:10.0pt;font-family:"Tahoma",sans-s= erif;color:#1F497D">Country Office</span></i></b><span style=3D"font-size:1= 0.0pt;font-family:"Tahoma",sans-serif;color:black"><o:p></o:p></s= pan></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto;background:white"> <span style=3D"font-size:10.0pt;font-family:"Tahoma",sans-serif;c= olor:black"><a href=3D"mailto:Shukrullah.shinwari@thejohanniter.org"><b><i>= <span style=3D"color:blue">Shukrullah.shinwari@thejohanniter.org</span></i>= </b></a><o:p></o:p></span></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto;background:white"> <span style=3D"font-size:10.0pt;font-family:"Tahoma",sans-serif;c= olor:#1F497D">Skype: shah.khan525</span><span style=3D"font-size:10.0pt;fon= t-family:"Tahoma",sans-serif;color:black"><o:p></o:p></span></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto;background:white"> <span style=3D"font-size:10.0pt;font-family:"Tahoma",sans-serif;c= olor:#1F497D">+93(0) 785 928 205</span><span style=3D"font-size:10.0pt;= font-family:"Tahoma",sans-serif;color:black"><o:p></o:p></span></= p> <p class=3D"MsoNormal"><img border=3D"0" width=3D"199" height=3D"45" id=3D"= Picture_x0020_1" src=3D"cid:image001.png@01D67F88.AE31FE00" alt=3D"JUH_Logo= _Rot-Schwarz_sRGB"><o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> </pre> </body> </html> ----537336933530342800916926225457742 Content-Type: text/plain; charset="ISO-8859-1"; name="SMTP44-Attachment-Warning.txt" Content-Disposition: attachment; filename="SMTP44-Attachment-Warning.txt" Content-Transfer-Encoding: quoted-printable This is a message from the MailScanner E-Mail Virus Protection Service ---------------------------------------------------------------------- The original e-mail attachment "VR-9682 Medical report COVID-19.doc" was believed to be infected by a virus and has been replaced by this warning message. If you wish to receive a copy of the *infected* attachment, please e-mail helpdesk and include the whole of this message in your request. Alternatively, you can call them, with the contents of this message to hand when you call. At Sat Sep 5 10:46:36 2020 the virus scanner said: McAfee6: VR-9682 Medical report COVID-19.doc/WordDocument Found the W97M= /Downloader.dbv trojan !!! Note to Help Desk: Look on the SMTP44 (pop7-replica-smtp43) MailScanner in = /var/spool/MailScanner/quarantine/20200905 (message 5300446203E8F.AF33B). --=20 Postmaster Your Organisation Name Here www.your-organisation.com For all your IT requirements visit: http://www.transtec.co.uk ----537336933530342800916926225457742--