Attached is a file Advance Shipping Notification 0068352929.DOC which my sources (thank you, btw) say comes in four different versions, although I have only seen three (VirusTotal results   , Hybrid Analysis results   ) containing a macro that looks like this [pastebin]. The download locations are:
From ACUVUE_DEL [firstname.lastname@example.org]
Date Tue, 03 Nov 2015 12:26:17 +0200
Subject Delivery Confirmation: 0068352929
PLEASE DO NOT REPLY TO THIS E-MAIL. IT IS A SYSTEM GENERATED MESSAGE.
Attached is a pdf file containing items that have shipped
Please contact us if there are any questions or further assistance we can provide
This malicious binary has a VirusTotal detection rate of 6/54. That VT report and this Hybrid Analysis report show network communications to the following IPs:
18.104.22.168 (Digital Ocean, Singapore)
22.214.171.124 (Cablevision, US)
126.96.36.199 (Linode, US)
188.8.131.52 (Ho Chi Minh City Post and Telecom Company, Vietnam)
The payload is most likely to be the Dridex banking trojan.