From: Mirjana Prgomet [email@example.com]There is no body text, but the only example I saw had an attachment name of report20520159260.doc which contained this malicious macro [pastebin] which downloads a malicious executable from:
Date: 20 May 2015 at 08:26
Subject: Uplata po pon 43421
This is saved as %TEMP%\eldshrt1.exe and has a VirusTotal detection rate of 3/56. There are probably other download locations with other variants of the document, but the payload should be the same in each case.
Automated analysis tools    indicate network traffic to the following locations:
18.104.22.168 (Selectel Network, Russia)
22.214.171.124 (Digital Ocean, US)
126.96.36.199 (Digital Ocean, Netherlands)
188.8.131.52 (Hetzner, Germany)
The Malwr report shows that it drops a Dridex DLL with a detection rate of 5/53.