However, we've rarely shown
how these documents were delivered to the targeted, i.e.
what the emails looked like.
For that kind of information, we can recommend you to visit a blog called
Contagio Malware Dump.
This blog, run by Mila & co analyses targeted attacks in detail, typically showing the original spoofed emails that started the attacks.
Some good examples below — some of them are quite convincing. Would you have opened the PDFs?



More at:
contagiodump.blogspot.com