From: administrator [firstname.lastname@example.org]It pretends to come from within the victim's own domain, but this is a simple forgery. The reference number changes from email to email, attached is a ZIP file named consistently with the subject (e.g. FC_462982347.zip). This ZIP file contains a malicious script (typical detection rate 8/56) which then downloads Locky ransomware. According to these automated analyses      show the scripts downloading from the following locations (there are almost definitely more):
Date: 30 March 2016 at 11:09
Subject: Facture client N° FC_462982347 du 30/03/2016
Veuillez trouver ci-joint la facture pour le renouvellement de votre antivirus.
This dropped binary has a detection rate of 7/56. According to these analyses    it phones home to the same servers detailed in this earlier blog post.