This spam claims to be from the legitimate firm AquAid, but it isn't. Instead it comes with a malcious attachment. The email is a forgery, AquAid are not sending the spam, nor have their systems been compromised in any way.
From: Tracey Smith [email@example.com]
Date: 18 December 2014 at 07:24
Subject: Card Receipt
HiPlease find attached receipt of payment made to us todayRegardsTraceyTracey Smith| Branch AdministratorAquAid | Birmingham & Midlands CentralUnit 35 Kelvin Way Trading Estate | West Bromwich | B70 7TPTelephone: 0121 525 4533Fax: 0121 525 3502Mobile: 07795328895Email: firstname.lastname@example.orgAquAid really is the only drinks supplier you will ever need with our huge product range. With products ranging from bottled and mains fed coolers ranging up to coffee machines and bespoke individual one off units we truly have the right solution for all environments. We offer a refreshing ethical approach to drinks supply in that we support both Christian Aid and Pump Aid with a donation from all sales. All this is done while still offering a highly focused local service and competitive pricing. A personalised sponsorship certificate is available for all clients showing how you are helping and we offer £25 for any referral that leads to business.******************************
AquAid Franchising Ltd is a company registered in England and Wales with registered number 3505477 and registered office at 51 Newnham Road, Cambridge, CB3 9EY, UK. This message is intended only for use by the named addressee and may contain privileged and/or confidential information. If you are not the named addressee you should not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify the sender and delete the message and any attachments accompanying it immediately. Neither AquAid nor any of its Affiliates accepts liability for any corruption, interception, amendment, tampering or viruses occurring to this message in transit or for any message sent by its employees which is not in compliance with AquAid corporate policy.
In the sample I have seen, the attachment is called CAR014 151239.doc which is malicious, but only has a VirusTotal detection rate of 2/54. This particular document (note that there are usually several different documents in the spam run) contains this malicious macro [pastebin]. This macro downloads a malware executable from:
..which is saved as %TEMP%\YEWZMJFAHIB.exe - this has a marginally better detection rate of 3/53.
The ThreatExpert report shows connections to the following two IPs:
220.127.116.11 (1&1, US)
18.104.22.168 (Strato AG, Germany)
The Malwr report shows that it drops a DLL which is very poorly detected but is probably the Dridex banking trojan.
FOR RESEARCHERS ONLY: a copy of the malicious DOC attachment plus dropped files can be found here. Password is "infected". Only handle these if you know what you are doing.
UPDATE 2015-01-13This spam keeps coming back every few days or so. This time the attachment has a VirusTotal detection rate of 3/57 and the malicious macro it contains [pastebin] downloads from:
This file has a VirusTotal detection rate of 2/57. The Malwr report shows it phoning home to:
It also drops a DLL with a detection rate of 2/57.
UPDATE 2015-02-25Another version of this spam run is in progress, with these malicious macros   downloading from the following locations:
This malware is the same as used in this spam run.