In past campaigns, this type of attack uses a password-protected Excel 4.0 document. The message body contains a password that attackers use to tempt targets with to open the Excel document.