2016-11-08 Locky "Epson iPrint"

2016-11-08 #locky email phishing campaign "Epson iPrint"

Email sample:
-------------------------------------------------------------------------------------------------------------
From: BUD LAWLOR <bud.lawlor.60@jessewsmith.com}>
To: [REDACTED] <bud.lawlor.60@jessewsmith.com}>
Subject: Epson iPrint
Date: Tue, 08 Nov 2016 17:43:20 +0300

This file scanned using_Epson_iPrint.
Sent from Yahoo Mail on Android

Attached: "[SCAN]Epson_0152116862375.zip"
-------------------------------------------------------------------------------------------------------------
- the sender address varies between emails, but the it always has "}" at the end.
- recipient name is email address of the recipeint, but address part (between <>) contains the sender address instead
- attached file "[SCAN]Epson_<13 digits>.zip" contains file "<3 letters><5-6 digits>-<4 digits>.wsf", a JScript downloader

The URLs and malware etc... are same as in "Statement" camapign http://pastebin.com/VGvZafjs