606
The malicious email itself is sent with a subject line referring to a receipt or to a fake document , with the pattern involving the words PDF , Scan , File , Copy or Document followed by an underscore and a string of at least four numbers - four example , one subject line seen by researchers was ' Copy _ 293636 ' Attached to this email is a PDF document containing an embedded DOCM file and a malicious Macro script .
 ( phishing: is sent,  The malicious email: tool, a fake document: tool, a receipt: trusted entity, the words PDF: trusted entity, Scan: trusted entity, Document: trusted entity, Copy: trusted entity, File: trusted entity) 
Locate the role in the text that participated in the event based on the event type and return it in the event list. 
 Option: Event type: phishing, data breach, ransom, discover vulnerability, patch vulnerability, Arguments type: vulnerable system, capabilities, vulnerability, number of victim, issues addressed, compromised data, damage amount, common vulnerabilities and exposures, victim, patch number, number of data, tool, discoverer, time, purpose, place, payment method, releaser, vulnerable system version, attacker, supported platform, patch, price, vulnerable system owner, trusted entity, attack pattern. 
Text: {0} 
Answer:
 ( phishing: is sent,  The malicious email: tool, a fake document: tool, a receipt: trusted entity, the words PDF: trusted entity, Scan: trusted entity, Document: trusted entity, Copy: trusted entity, File: trusted entity) 