From: SANTAN [firstname.lastname@example.org]Both the "From" and "To" fields are fake. Attached is a document fax00065189.doc that I have seen two versions of (VirusTotal results  ). The Malwr reports for those two files   show that this is trying to deliver the Dridex banking trojan, as described here.
To: POLLY [email@example.com]
Date: 12 January 2016 at 10:55
Subject: Copy of our CREDIT NOTE number 00000962064
This message contains 1 pages in Microsoft Word format.