2016-11-24 Locky "Fax transmission"

2016-11-24 #locky email phishing campaign "Fax transmission"

Email sample:
--------------------------------------------------------------------------------------------------------------
From: IVR Service <emailsend@sarahgonzales.com>
To: [REDACTED]
Subject: Fax transmission: F-3333148084-2876144285-201611172648-1241.zip
Date: Thu, 24 Nov 2016 17:26:48 +0200

Please find attached to this email a facsimile transmission we
have just received on your behalf

(Do not reply to this email as any reply will not be read by
a real person)

Attachment: F-3333148084-2876144285-201611172648-1241.zip -> 626_BSAE_3532.wsf
--------------------------------------------------------------------------------------------------------------
- sender sdress varies between emails, but display name is "<iFax|Fax|NetFax|IVR> Service"
- subject is "Fax transmission: F-<10 digits>-<10 digits>-201611<6digits>-<4 digits>.zip"
- attached file "F-<10 digits>-<10 digits>-201611<6digits>-<4 digits>.zip" contains file "<3 digits>-<4-5 upcase letters>-<4 digits>.wsf

URLs, downloaders and malware are same as in "scan paper" campaign http://pastebin.com/kx8z9pLK