"AMAZON.CO.UK - Your Amazon order" spam

Another fake Amazon spam with a malicious payload:

Date:      Wed, 30 Jul 2014 18:08:43 +0800 [06:08:43 EDT]
From:      "AMAZON.CO.UK" [ckggzphqu@Amazon.co.uk]
Subject:      Your Amazon order #853-9908013-4362599

Hello,

Thank you for your order. We'll let you know once your item(s) have dispatched.You can check the status of your order or make changes to it by visiting Your Orders on Amazon.co.uk.
Order Details

Order #853-9908013-4362599 Placed on July 26, 2014

Order details and invoice in attached file.

Need to make changes to your order? Visit our Help page for more information and video guides.

We hope to see you again soon.
Amazon.co.uk

 There's a ZIP file attached (in this case Order-853-9908013-4362599.zip) which unzips to a folder Order details with a malicious file ORDER-992-5188991-000933.exe which has a VirusTotal detection rate of 9/53. The Comodo CAMAS report shows that it downloads a further component from these following locations:

utilatas.com/333
sdi-ppe.com/333
shahlon.com/333
croydonsog.org/333
pc2print.co.uk/333
geo.num.edu.mn/333
hendredestate.co.uk/333
kelias.com/~anonimas/333
168.144.179.82/333
alperacarli.com/333
thecolabnetwork.com/333
www.deltaplus.com.sg/333
george-bergsig.co.za/333
qatthailand.com/333
deltaplus.com.sg/333
elegantscreens.com/333
drkeithrix.co.uk/333
w3stest.webuda.com/333
www.divine-paradise.com/333
www.langrace.com/333
avengingarden.com/333

This second executable has a VT detection rate of 5/54. I recommend blocking the following sites:
utilatas.com
sdi-ppe.com
shahlon.com
croydonsog.org
pc2print.co.uk
geo.num.edu.mn
hendredestate.co.uk
alperacarli.com
thecolabnetwork.com
deltaplus.com.sg
george-bergsig.co.za
qatthailand.com
deltaplus.com.sg
elegantscreens.com
drkeithrix.co.uk
w3stest.webuda.com
divine-paradise.com
langrace.com
avengingarden.com