MSGID: 2:221/360.0 5e67ae0e   
   PID: JamNNTPd/OS2 1.3 20191227   
   TID: GE/2 1.2   
   CHRS: UTF-8 2   
   TZUTC: 0200   
   I forgot to mention..  that the file arrived as:   
      
      
   invoice_867545.xls   ..but when sent to Virus total, it was a different name:   
      
     Results at VirusTotal:   
      
     6 engines detected this file   
      
     invoice_507574.xls   
     64.00 KB   
      
      
   BTW.. I sent it to Google Sheets (to see if I could peek at the payload   
   mechanism details  ..apparently it operates via a macro), but it seems to be   
   neutered there without any reason.   
      
      
     http://pics.rsh.ru/img/scam-invoice-0_xljlzkeh.jpg   
      
     http://pics.rsh.ru/img/scam-invoice-1_ow9bs085.jpg   
      
      
      
   --    
   Kad esat sagriezis maizi, to vairs nevarat salikt.   
      
   --- TB68.4.1/Win7   
    * Origin: nntp://rbb.fidonet.fi - Lake Ylo - Finland (2:221/360.0)   
   SEEN-BY: 1/123 19/10 90/1 103/705 154/10 203/0 221/0 1 6 360 227/114   
   SEEN-BY: 229/101 426 452 1014 240/5832 249/206 317 400 280/464 5003   
   SEEN-BY: 288/100 292/854 310/31 317/3 322/757 342/200 396/45 423/81   
   SEEN-BY: 423/120 712/848 770/1 2452/250   
   PATH: 221/360 1 280/464 229/426