Malware spam: "Berendsen UK Ltd Invoice 60020918 117" / "donotreply@berendsen.co.uk"

UPDATE: a new spam run using this firm's name is active as of 24th February. For more information click here.

Berendsen is a wholly legitimate firm in the textiles and laundry business. They are not sending out this spam, nor have their systems been compromised in any way. Instead, this email is a forgery with a malicious Word document attached.

From:    donotreply@berendsen.co.uk
Date:    26 January 2015 at 06:43
Subject:    Berendsen UK Ltd Invoice 60020918 117

Dear Sir/Madam,

Please find attached your invoice dated 1st January.
All queries should be directed to your branch that provides the service. This detail can be found on your invoice.


Thank you.

___________________________________________________________
This e-mail and any attachments it may contain is confidential and
intended for the use of the named addressee(s) only. If you are not
the intended recipient, you have received it in error, please
immediately contact the sender and delete the material from your
computer system. You must not copy, print, use or disclose its
contents to any person. All e-mails are monitored for traffic data and
the content for security purposes.

Berendsen UK Ltd, part of the Berendsen plc Group.
Registered Office: 4 Grosvenor Place, London, SW1X 7DL.
Registered in England No. 228604

Attached is a malicious Word document with a zero detection rate which contains a malicious macro [pastebin], and this in turn downloads a binary from:

http://elektromarket.cba.pl/js/bin.exe

This executable is saved as %TEMP%\LAVUBDAJLCD.exe and has a VirusTotal detection rate of 2/57 (Norman AV identified it as Dridex).

Automated analysis [1] [2] [3] [4] is proving difficult, a contact suggests that Botnet 125 (which is behind this spam run) is having stability problems. Shame.