2017-08-11 Locky ""Emailing: xxxxxxxxx.pdf""

2017-08-11: #Locky email phishing campaign "Emailing: xxxxxxxxx.pdf"
Samples: 519

Email sample:
-----------------------------------------------------------------------------------------------------------------
From: "Armand" <Armand@[REDACTED]>
To: [REDACTED]
Subject: Emailing: 970037364.pdf
Date: Fri, 11 Aug 2017 23:02:19 +0700

Your message is ready to be sent with the following file or link
attachments:

970037364.pdf


Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments.  Check your e-mail
security settings to determine how attachments are handled.

Attachment: 970037364.zip -> 20170811820.pdf
-----------------------------------------------------------------------------------------------------------------
- sender address is forged to look like coming from recepient's domain
- subject is "Emaling: <9-12 digits>.pdf"
- attached file "<8-12 digits>.zip" contains file "20170811<3 digits>.pdf", which contains embedded MS Word macro-enable file which will download malware

Download sites and malware is same in https://pastebin.com/V2FbZHXb