From: Mavis Howe [Howe.email@example.com]The name of the sender varies from email to email. The malicious attachment and payload seem very close to the one described here.
Date: 3 August 2016 at 13:32
Subject: Confirmation letter
I attached the employment confirmation letter I prepared.
Please check it before you send it out.