Malware spam: "Invoice from PASSION BEAUTY SUPPLY LTD" leads to Teslacrypt

Following on from this earlier spam run, this email has a malicious attachment that loads Teslacrypt ransomware.

From:    Monique Chen [ChenMonique412@magicleafstudio.com]
Date:    2 December 2015 at 19:22
Subject:    Invoice from PASSION BEAUTY SUPPLY LTD

Dear Customer ,

Please review the attached copy of your Invoice (number: IN78350434) for an amount of $470.49.


Thank you for your business

The attachment is named invoice_copy_78350434.zip and it contains a malicious script invoice_copy_BD2E45I62A129S.js which has a VirusTotal detection rate of 2/55. The script is obfuscated (see example) but according to these analyses [1] [2] downloads a malicious executable from:

74.117.183.84/76.exe?1

This has a detection rate of 3/55. The hosts contacts are the same as for the earlier spam run and I recommend you block them.