From Harminder Saund [MinSaund77@secureone.co.uk]
Date Tue, 20 Oct 2015 16:08:53 +0700
Subject Purchase Order No: 48847
Attached is a copy of our Purchase Order number 48847
The sender's email address varies slightly, for example:
Attached is a file PO_48847.DOC which I have seen two different versions of so far (VirusTotal  ) each containing a slightly different malicious macro  . There are probably different versions of the document with different macros.
Automated analysis is pending, however the payload is most likely the Dridex banking trojan. Please check back for updates.
So far, three download location have been identified..
This file is downloaded as %TEMP%\shhg32c.exe and it has a VirusTotal detection rate of 4/56 (MD5 e4bb8a66855f6987822f5aca86060f2c). The Hybrid Analysis reports   indicate that it calls home to:
fat.uk-fags.top / 18.104.22.168 (Digital Ocean, Singapore)
I recommend that you block traffic to that IP.
The payload has been reported to be Shifu, not Dridex.