2016-12-14 Locky "Attached document"

2016-12-14: #locky email phishing campaign "Attached document"

Email sample:
--------------------------------------------------------------------------------------------------------------
From: canon@[REDACTED]
To: [REDACTED]
Subject: Attached document
Date: Wed, 14 Dec 2016 07:51:45 -0700

Attachment: 7550_008.docm
--------------------------------------------------------------------------------------------------------------
- sender address is canon@<recipient's domain>
- subject is "Attached document"
- email body is empty
- attached file "<4 digits>_<3-4 digits>.docm" is Microsoft Word file containing autoopening macro that will download malware

Download URLs, malware etc.. is same as in "Booking Confrmation" campaign http://pastebin.com/WTbhCvD0