Instead of attachments, it had malicious URLs in the message content that lead to the download of a malicious document named fedex.doc from hxxp://www.fedexdocs[.]top/fedex.doc or hxxp://www.fedexdocs[.]icu/fedex.doc.