From: Kristina SalinasAttached is a malicious document with a random name. I have only seen one sample so far with a VirusTotal detection rate of 3/55. The Malwr report indicates that same behaviour as this earlier spam run which is dropping Nymaim ransomware.
Date: 15 December 2015 at 14:59
Subject: Rockspring Remittance Advice - WIRE
Please find attached your Remittance Details for the funds that will be deposited to your bank account on December 15th.
Rockspring Capital is now sending through the bank the addenda information including your remit information.
If you are not seeing your addenda information in your bank reporting you may have to contact your local bank representative.