2016-12-12 Locky "Invoice number: xxxxx"

2016-12-12: #locky email phishing campaign "Invoice number: xxxxxx"
http://blog.dynamoo.com/2016/12/malwares-spam-invoice-number-947781.html

Email sample:
---------------------------------------------------------------------------------------------------------------
From: KARI BARTON <KARI.BARTON@monkey-poker.net>
To: [REDACTED]
Subject: Invoice number: 633365
Date: Mon, 12 Dec 2016 13:15:25 +0300

Please find attached a copy of your invoice.

Tel: 0800 170 7234
Fax: 0161 850 0404

For all your stationery needs please visit Stationerybase.

Attachment: 633365.docm
---------------------------------------------------------------------------------------------------------------
- sender varies between emails
- subject is "Invoice number: <5-6 digits>"
- attached file "<5-6 digits>.docm" (number same as in the subject line) is Microsoft Word file containing macro that will download the malware

Download locations, malware etc. is same as for "Attached, Copy, Emailing, File" campaign http://pastebin.com/7rvsVkSN