2016-12-05 Locky "Invoice INV0000xxxxxx"

2016-12-05 #locky email phishing campaign "Invoice INV0000xxxxxx"

Sample email:
------------------------------------------------------------------------------------------------------------------
From: "Aurora vickery" <Aurora72@isaca-ecuador.org>
To: aglass@packstation.de
Subject: Invoice INV00005986460
Date: Mon, 05 Dec 2016 22:21:16 +0330

Please find our invoice attached.

Attachment: Invoice_INV00005986460.xls
------------------------------------------------------------------------------------------------------------------
- sender varies between emails
- Subject is "Invoice INV0000<4-8 digits>"
- Attached file "Invoice INV0000<4-8 digits>" is a Microsoft Word XLSM file with macro downloader

The URLs, malware etc... are same as in "Emailing" / "no subject" campaigns http://pastebin.com/Yf0nnyrz