From: Rose Lu [email@example.com]
Date: 29 March 2016 at 02:30
Subject: Re: New Order P2016280375
Good Day,Please find enclosed our new order P2016280375 for your kind attention and prompt execution.I look forward to receiving your order acknowledgement in due course.Best regardsRose LuOffice ManagerSuzhou Eagle Electric Vehicle Manufacturing Co., Ltd.Add: No.99, Yin Xin Road, Guo Xiang Town, Suzhou, ChinaCell: +86 186 2520 8037Skype:rose.lu22Email:firstname.lastname@example.orgWeb: http://www.eagle-ev.comhttp://www.eg-ev.comhttp://szeagle.en.alibaba.comhttp://www.
Attached is a file New Order P201628037.docx which I have seen a single variant of, with a VirusTotal detection rate of 8/58. The Malwr report is inconclusive, but does appear to to show an OLE embedded object within the Word document. There are some interesting strings near the beginning of the object..
So, this looks like ransomware. Some inexpert fiddling with the contents of the OLE file yields an executable, and automated reports    show network traffic to the domain marchborn.no-ip.biz hosted on:
220.127.116.11 (Airtel, Nigeria)
I strongly recommend that you block traffic to that IP. In fact, the entire very large 18.104.22.168/12 is very sparsely populated and contains a small handful of legitimate Nigerian domains plus a load of Dynamic DNS domains (I've recommended blocking those before) so you might want to consider blocking those too.