2016-11-08 Locky "Order NNNNN"

2016-11-08 #locky email phishing campaign "Order NNNNN"

Email sample:
-----------------------------------------------------------------------------------------------------------
From: DEE MATTOCKS <eml@fantasycastlebooks.com>
To: [REDACTED]
Subject: Order 1066097
Date: Tue, 08 Nov 2016 13:14:53 -0300

Please find document attached

Attachment: "pma1066097.zip"
-----------------------------------------------------------------------------------------------------------
- sender varies between emails, but is from always eml@<domain>
- subject is "Order <random number>"
- attached file "<random letters><random number>.zip" contains file "<3 letter><5-6 digits>-<4 digits>.wsf", a JScript downloader

The URLs, malware etc ... are same as in "Statement" campaign http://pastebin.com/VGvZafjs