The purported invoice attachment in this email is a .img file. You might be tempted to think the file is an image (that is, a picture), but .img files are actually disk images, which means they can contain other files. This particular example contains a malicious program.
If you receive an email with a suspicious attachment, do not forward it as is, even to report it or warn other people. Doing so leaves the attachment exposed where someone could accidentally click on it. If you want to safely report it to your departmental support staff or the Computer Help Desk, forward the email as an attachment instead, or better yet, use the Report Phishing button if you have it.
