Here are my definitions of each option:
Spam = Unwanted mail, advertisements, etc
Phishing = Link to a site, usually a fake replica of a legitimate site but with added implements that can be used to spy on you (how people become victims of identity theft
Malware = Usually a malicious piece of code that can be used to slow down your computer or to get a hold of your computer for some other malicious reason
Legitimate = Means that the sender is valid, you know who its coming from, and you know that you won't get attacked by the email
So based on this, I would say that the answer is B. Phishing