Email regarding Western Union transaction contains the Oficla trojan

MX Lab intercepted a new trojan variant in emails with the subject “The transfer is available to withdrawl. Western Union.” regarding a money transaction. The email is sent from the spoofed address “Western Union <[email protected]>” and has the following message body:

Dear customer.

The amount of money transfer: 9864 USD.
Money is available to withdrawl.

You may find the MTCN and receiver’s details in document attached to this email.

Western Union.
Customer Service.

The trojan is known as Trojan.Win32.Oficla.ju (Kaspersky), Mal/Oficla-A (Sophos), Trojan-Downloader:W32/Oficla.HY (F-Secure).

Virus Total permlink and MD5: 3b3a8d2b86c5532ff8dfdaf4eb2b7789