From "Industrial Cleaning Materials (ICM)" [email@example.com]I have seen two version of the attachment order_2393.doc with VirusTotal results of 2/54   and the Malwr reports   show that they download a component from:
Date Thu, 03 Dec 2015 18:22:34 +0700
Subject ICM - Invoice #2393
Please find invoice 2393 attached.
Industrial Cleaning Materials
Unit 19 Highlode Ind Est
Stocking Fen Road
Tel: 01487 800011
fax 01487 812075
This has a VirusTotal detection rate of 1/53. The payload appears to be the same as the one in this spam run earlier today and looks like the Dridex banking trojan.