Malicious "Employee Documents - Internal Use" spam spoofs victim's domain

This spam appears to come from the victim's own domain, but in fact doesn't and it leads to malware instead.

From:     victimdomain.com [INTERNAL@victimdomain.com]
To:     victim@victimdomain.com
Date:     23 September 2014 11:43
Subject:     Employee Documents - Internal Use

DOCUMENT NOTIFICATION, Powered by NetDocuments

DOCUMENT NAME: Employee Documents

DOCUMENT LINK: http://cystersi.wagrowiec.pl/bitusagezp/paqzdzsfjs.html

Documents are encrypted in transit and store in a secure repository

---------------------------------------------------------------------------------
This message may contain information that is privileged and confidential. If you received this transmission in error, please notify the sender by reply email and delete the message and any attachments.

In this case the link goes to cystersi.wagrowiec.pl/bitusagezp/paqzdzsfjs.html and then downloads a file from cystersi.wagrowiec.pl/bitusagezp/EmployeeDocuments.zip which unzips to a malicious executable EmployeeDocuments.scr. This is exactly the same payload as found in this spam run earlier today.