From "[1NAV PROD RCS] " [firstname.lastname@example.org]Attached to the message is a file Order Confirmation RET-396716 230715.xml (it wasn't attached properly in the samples I saw) with a VirusTotal detection rate of 1/55, which in turn contains a malicious macro that looks like this [pastebin] which downloads an executable from one of the following locations (there are probably more):
Date Mon, 27 Jul 2015 18:49:16 +0700
Subject Order Confirmation RET-396716 Your Ref.: JL0815/1333 230715
Please find attached your Sales Order Confirmation
Note: This e-mail was sent from a notification only e-mail address that
cannot accept incoming e-mail. PLEASE DO NOT REPLY TO THIS MESSAGE.
This is saved as %TEMP%\ihhadnic.exe, and has a detection rate of 2/55. Automated analysis tools    show that it attempts to phone home to:
18.104.22.168 (PE Kartashev Anton Evgen'evich, Ukraine)