Attached is a file Advance Shipping Notification 0068352929.DOC which my sources (thank you, btw) say comes in four different versions, although I have only seen three (VirusTotal results   , Hybrid Analysis results   ) containing a macro that looks like this [pastebin]. The download locations are:
From ACUVUE_DEL [firstname.lastname@example.org]
Date Tue, 03 Nov 2015 12:26:17 +0200
Subject Delivery Confirmation: 0068352929
PLEASE DO NOT REPLY TO THIS E-MAIL. IT IS A SYSTEM GENERATED MESSAGE.
Attached is a pdf file containing items that have shipped
Please contact us if there are any questions or further assistance we can provide
This malicious binary has a VirusTotal detection rate of 6/54. That VT report and this Hybrid Analysis report show network communications to the following IPs:
188.8.131.52 (Digital Ocean, Singapore)
184.108.40.206 (Cablevision, US)
220.127.116.11 (Linode, US)
18.104.22.168 (Ho Chi Minh City Post and Telecom Company, Vietnam)
The payload is most likely to be the Dridex banking trojan.