From: Accounts [email@example.com]The email appears to come from within victim's own domain. The number in the subject varies, and is matched by the attachment name (e.g. Document No 4873206.zip). In turn this contains one of several malicious scripts (VirusTotal results      ). All the Malwr reports       all show an attempted download from:
Date: 10 March 2016 at 11:45
Subject: Document No 4873206
Thanks for using electronic billing
Please find your document attached
Happily this 404s, but it is likely that other scripts will have the same download locations as found here. The payload is the Locky ransomware, and it should drop an executable with a detection rate of 1/56.