2016-12-16 Locky "Message from RNP00xxxxxxxxxx"

2016-12-16: #locky email phishing campaign "Message from RNP00xxxxxxxx"

Email sample:
---------------------------------------------------------------------------------------------------------------------
From: <donotreply@[REDACTED]>
Subject: Message from "RNP002CE0A34F45"
To: [REDACTED]
Date: Fri, 16 Dec 2016 18:45:34 +0700

This E-mail was sent from "RNP002CE0A34F45" (Aficio MP 2352).

Scan Date: Fri, 16 Dec 2016 18:45:34 +0700)
Queries to: [REDACTED]

Attachment: 20161216184534653_0004.docm
---------------------------------------------------------------------------------------------------------------------
- sender address is donotreply@<recepient's domain>
- subject is "Message fom "RNP00<10 hexa chars>"
- attached file "20161216<7-8 digits>_<3-4 digits>.docm" is a Microsoft Word document with malicious macro that will download malware

URLs, malware etc ... are same as in "Attached document" campaign http://pastebin.com/a24a6vcm