From: Effie LarsenAttached is a ZIP file containing elements of the recipient's email address, the word "profile" and a random number. Contained within are a variety of malicious .js scripts beginning with "profile".
Date: 12 July 2016 at 20:07
Please find attached the profile of Mr.Welch for a suitable role in your Organisation
Mexico Key Account Director
These two Hybrid Analysis reports   show download locations at:
This is somewhat consistent with the download locations for the earlier Locky ransomware spam as seen here. It is likely that the C2 servers are the same or at least overlap.