Malware spam: "Please see attached (scanned document) file for your invoice" leads to Locky

This fake financial spam leads to the Locky ransomware. Sender names, reference numbers and attachment names will vary.

From:    Kris Bentley [BentleyKris59113@annarborultimate.org]
Date:    8 March 2016 at 14:35
Subject:    FW: Invoice #098377-2016-03

Dear infon,

Please see attached (scanned document) file for your invoice.

Thank you for your business


Kris Bentley
Sales Manager

The payload appears to be identical to the one found in this spam run.