From: Allen, Claire [Claire.Allen@snapon.com]I have only seen one copy of this with an attachment SKETTDCCSMF14122514571.doc which contains this malicious macro [pastebin], which downloads a further component from:
Date: 24 February 2015 at 14:41
Subject: Copy invoices Snap on Tools Ltd
Attached are the copy invoices that you requested.
Your message is ready to be sent with the following file or link attachments:
Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled.
This executable has a detection rate of 5/57. Various automated analyses     show attempted communications to the following IPs:
18.104.22.168 (OOO Sysmedia, Russia)
22.214.171.124 (GoDaddy, US)
126.96.36.199 (23Media GmbH, Germany)
188.8.131.52 (Digital Ocean, UK)
184.108.40.206 (Goteborgs Universitet, Sweden)
220.127.116.11 (Deniz Toprak / B2 Net Solutions Inc., US)
18.104.22.168 (OVH, Czech Republic)
22.214.171.124 (Tata Indicom, India)
126.96.36.199 (O.M.C. Computers & Communications, Israel)
188.8.131.52 (23Media GmbH, Germany)
According to this Malwr report it drops another version of the downloader called edg1.exe [VT 4/57] and a malicious Dridex DLL [VT 2/57].