From firstname.lastname@example.orgThe attachment is EDMUN11118_181859.xls which comes in two different versions (VirusTotal results  ) which according to these Hybrid Analysis reports   download a file from one of the following locations:
Date Thu, 19 Nov 2015 16:20:40 +0300
Subject Invoice and VAT Receipt EDMUN11118_181859 [Account:EDMUN11118]
lapelsbadges.com//8i65h4g53/o97i76u54.exe [file not found]
This has a VirusTotal detection rate of 1/54 and that VirusTotal report indicates it phoning home to:
188.8.131.52 (Ministry Of Education, Thailand)
I strongly recommend that you block that IP address. The payload is the Dridex banking trojan.