Updated

This one is dishing out crypt0 through a JS attachment in the phish.

Dear victim,

Attached please find the documents you requested..



King regards
Liza Hale
VP Analytic Services
Tue, 28 Jun 2016 08:25:45 +0300

Here's some info on this one:

MD5: 24966b6f6301fda044065aaf29a28158 (zip attachment)
MD5: 0e580534f13c21daf6466d433464a014 (the JS file in the attachment)