Dance Foto (or a combination with numbers) attachment

We’re receiving quite a number of attachments from IMSS with the following names:

• DanceFoto34.zip
  
  
• Foto_Dance1.zip
  
  
• Foto3(DANCE).zip

Yep, FYI. This will be detected as TROJ_DLOADER.CSX.