A Microsoft Office Mail attachment containing a malicious downloader was observed as part of a ransomware campaign. A remote attacker could send spam e-mails including a downloader and manipulate users to manually enable them. This would allow the malicious code to run and infect the target system.