From: email@example.com [firstname.lastname@example.org]Attached is a file NWN Confirmation Letter.doc which I have so far seen in two different versions, both with low detection rates   which contain slightly different malicious macros   which then go and download a malicious binary from one of the following locations:
Date: 18 March 2015 at 08:34
Subject: Confirmation of Booking
This booking confirmation forms a binding contract between yourselves and NWN Media Ltd.
If you do not agree with any of the details above then please contact the named sales representative on the above number immediately.
NWN Media Ltd
These are saved as %TEMP%\zakilom86.exe and %TEMP%\Pikadlo64.exe respectively. The binaries are actually identical and have a VirusTotal detection rate of 5/57. According to the Malwr report this binary attempts to communicate with the following IPs:
18.104.22.168 (Relink Ltd, Russaia)
22.214.171.124 (Selectel Ltd, Russia)
126.96.36.199 (OVH, France)
188.8.131.52 (Clodo-Cloud / IT House, Russia)
184.108.40.206 (Digital Networks CSJC aka DINETHOSTING / Russia)
It then drops what appears to be another version of itself called edg1.exe onto the target system [VT 2/55] along with a malicious Dridex DLL [VT 3/55]