2016-11-23 Locky "Emailing: LETTER xxx.pdf"

2016-11-23: #locky email phishing campaign "Emailing: LETTER xxx.pdf"

Email sample:
----------------------------------------------------------------------------------------------
From: "felton" <felton.hahmann@[REDACTED]>
To: [REDACTED]
Subject: Emailing: LETTER 064.pdf
Date: Wed, 23 Nov 2016 20:43:46 +0700

Please find attachment.

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

Attachment: LETTER 064.zip -> dr2gowvzp2ijj1n1bqak8diiym62tk54.js
----------------------------------------------------------------------------------------------
- sender address varies between emails, but sender domains is faked to be from same domain as recipent
- subject is "Emailing: LETTER <number>.pdf"
- attached file "LETTER <number>.zip" contains file "<32 lowercase letters and digits>.js" a JScript downloader

Downloaders, URLs, C2 etc ... is same as in campaign "Bill-xxxx" http://pastebin.com/WCYF3saq