I've had a couple of these; the HTML message containing the attachment even came with a Microsoft-ish blue colour scheme. As you say, it's easy to detect. NAV lit up like a Christmas-tree when it spotted it. Different name, though; identified as W32.Gibe.B@mm.