2016-09-27 Locky "New Doc xxx_xxx.pdf"

2016-09-27 #locky email phishing camapign "New Doc xxx_xxx.pdf"

Email:
---------------------------------------------------------------------------------------------------------------
From: "Dolly" <Dolly99@[REDACTED]>
To: [REDACTED]
Subject: New Doc 5_68.pdf
Date: Tue, 27 Sep 2016 10:06:09 +0600

Scanned by CamScanner
Sent from Yahoo Mail on Android

Attached: "New Doc 5_68.pdf.zip"
--------------------------------------------------------------------------------------------------------------
- sender varies between emails, but pretends to came from same domain as recipient
- subject is "New Doc <number>_<number>.pdf
- attached file with name aligned with subject "New Doc <number>_<number>.pdf.zip" contain file <random char>.wsf a JScript downloader

The download sites, malware and C2 are same as in "Documents Requested" campaign http://pastebin.com/YpE51Vy3