The email comes from an account of a known person whose email has already been compromised. In the email, it contains attachments disguised as PDF files.