From: admin [firstname.lastname@example.org]Attached is a document named in a similar format to 11-03-2016-6440705503.zip which contains a randomly-named malicious script. So far I have seen three versions of this script (VirusTotal results   ) which according to the Malwr reports    download a malicious binary from:
Date: 11 March 2016 at 09:02
Subject: Scanned image
Image data in PDF format has been attached to this email.
This is Locky ransomware, the same as dropped in this other spam run - that post also contains a list of C2s to block.