From "info@123print" <[firstname.lastname@example.org]Attached is a file 4077774.doc for which I have seen three variants    [Hybrid Analysis] which downloads a malicious executable from one of the following locations:
Date Thu, 09 Jul 2015 12:09:12 +0200
Subject Your order No. 3269637 has been despatched
Your order 3269637 has been despatched.
Please see attachment for details.
Those sites are hosted on 22.214.171.124 and 126.96.36.199 which are OVH parking IPs.
That executable has a detection rate of 8/54 and automated analysis tools    show traffic to 188.8.131.52 (OVH, France). The payload is the Dridex banking trojan.