From Gary Atkinson [Gary@garrardwindows.co.uk]Attached is a file 20121005154449756.zip which contains a randomly-named script. I have seen two samples so far (VirusTotal results  ). The Malwr reports   show the script downloads from the following locations:
Date Tue, 08 Mar 2016 12:09:33 +0300
Subject Emailing: 20121005154449756
Please find attached document as requested.
The downloaded binary appears to be Dridex and is the same as found in this spam run.