From: Integrated Petroleum ServicesAttached is a file 20151126-291-transfer.xls (VT 1/53) containing this malicious macro [pastebin] which (according to this Malwr report) downloads from:
Sent: Friday, November 27, 2015 10:24 AM
Please find attached the transfer order sent on Friday 27.
This binary has a VirusTotal detection rate of 3/55. The payload is the same as found in this spam run.