From: AR.Support@efi.comAttached is a Word document Customer statement 0001031389 as on 02052015.DOC which comes in two different types with zero detection rates   containing two highly obfuscated modular macros   that actually just perform a ROT13 transformation on a couple of strings.
Date: 17 February 2015 at 10:22
Subject: Customer statement 0001031389 as on 02/05/2015
Dear EFI Customer,
Please find attached your statement for this month. If you need invoice
copies or have any questions you can reply to this e mail and we will
contact you at the earliest.
** Attention AP Department ** Effective April 25th our new remittance address will change to
the following. Please update your records. Thank you.
PO Box 742366
Los Angeles, CA. 90074-2366
Confidentiality notice: This message may contain confidential information. It is intended only for the person to whom it is addressed. If you are not that person, you should not use this message. We request that you notify us by replying to this message, and then delete all copies including any contained in your reply. Thank you.
Which decodes to:
This has a VirusTotal detection rate of 5/57. Automated analysis tools    shows the malware attempting to connect to:
188.8.131.52 (World Internetwork Corporation, Thailand)
184.108.40.206 (Microtech Tel, US)
220.127.116.11 (MWTV, Latvia)
According to the Malwr report this drops a DLL with a detection rate of 2/57 which is probably Dridex.