From: Addie CaldwellThe sender's name varies. So far I have seen three different versions of the attachment (in the format remit85752524.doc or similar) with VirusTotal detection rates in the range of 2/54    and the Malwr reports    show similar characteristics to this spam run plus this additional URL:
Date: 6 January 2016 at 10:31
Subject: Payment notification from Third Energy Services Limited
Payment notification from Third Energy Services Limited
Third Energy Services Limited
Registered in England & Wales. Registered number: 85752524.
Registered office: 7th Floor. Portland House, Bressenden Place, London, UK, SW1E 5BH
Tel: 01944 759904 ot 0207 0420 800
This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Third Energy. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone.
Please contact the sender if you believe you have received this email in error.
This IP is allocated to McHost.RU in Russia and can be considered as malicious. The payload is unknown, but is possible Dridex.