Malware spam: "Mick George Invoice 395687" / "Mick George Invoicing [mginv@mickgeorge.co.uk]"

This malformed spam is meant to have a malicious attachment:

From:    Mick George Invoicing [mginv@mickgeorge.co.uk]
Date:    6 March 2015 at 09:29
Subject:    Mick George Invoice 395687


Please find attached a copy of your invoice 395687.

If you have any queries regarding the invoice, please do not hesitate to co=
ntact us by emailing mginv@mickgeorge.co.uk<mailto:mginv@mickegeorge.co.uk>=
 or calling our finance department on 01480 499125.

Regards

Finance Team
MICK GEORGE[http://mickgeorgeskips.co.uk/wp-content/uploads/2014/08/image00=
1.jpg] (r)
T: 01480 499125
F: 01480 498077
www.mickgeorge.co.uk<http://www.mickgeorge.co.uk/>

Lancaster House, Meadow Lane, St Ives, Cambs, PE27 4YQ  [http://mickgeorges=
kips.co.uk/wp-content/uploads/2014/08/image003.jpg] <https://plus.google.co=
m/109160871896788819541/posts>    [http://mickgeorgeskips.co.uk/wp-content/=
uploads/2014/08/image004.jpg] <https://twitter.com/mickgeorgeltd>

Specialists in Earthworks * Aggregates * Skip Hire * Contaminated Land Serv=
ices & Remediation * Demolition * Contracting

Waste Management & Recycling * Landfill & Tipping Facilities * Asbestos Rem=
oval * Ready Mix Concrete & Floor Screeds

[Concrete signature]<http://mickgeorgeskips.co.uk/wp-content/uploads/2014/0=
8/Concrete-signature.jpg>

Disclaimer

This email and any attachments are intended only for the use of the individ=
ual or entity to which it is directed and may contain information that is p=
rivileged, confidential and exempt from disclosure under applicable law.

If you have received this email and you are not the intended recipient or t=
he employee or agent responsible for delivering this email to the intended =
recipient, please inform Mick George on +44 (0)1480 498099 and then delete =
the email from your system. If you are not a named addressee you must not u=
se, disclose, disseminate, distribute, copy, print or reply to this email.

Although Mick George Ltd routinely screens for viruses, addressees should s=
can this email and any attachments for viruses. Mick George Ltd makes no re=
presentation or warranty as to the absence of viruses in this email or any =
attachments. Please note for the protection of our clients and business, we=
 may monitor and read emails sent to and from our server(s).

Mick George Ltd

Something has gone wrong with the formatting, it is meant to look like this:

Please find attached a copy of your invoice 395687.
If you have any queries regarding the invoice, please do not hesitate to contact us by emailing mginv@mickgeorge.co.uk or calling our finance department on 01480 499125.
Regards
Finance Team
MICK GEORGE ®
T: 01480 499125
F: 01480 498077
www.mickgeorge.co.uk

Lancaster House, Meadow Lane, St Ives, Cambs, PE27 4YQ

Specialists in Earthworks • Aggregates • Skip Hire • Contaminated Land Services & Remediation • Demolition • Contracting
Waste Management & Recycling • Landfill & Tipping Facilities • Asbestos Removal • Ready Mix Concrete & Floor Screeds

Disclaimer
This email and any attachments are intended only for the use of the individual or entity to which it is directed and may contain information that is privileged, confidential and exempt from disclosure under applicable law.
If you have received this email and you are not the intended recipient or the employee or agent responsible for delivering this email to the intended recipient, please inform Mick George on +44 (0)1480 498099 and then delete the email from your system. If you are not a named addressee you must not use, disclose, disseminate, distribute, copy, print or reply to this email.
Although Mick George Ltd routinely screens for viruses, addressees should scan this email and any attachments for viruses. Mick George Ltd makes no representation or warranty as to the absence of viruses in this email or any attachments. Please note for the protection of our clients and business, we may monitor and read emails sent to and from our server(s).
Mick George Ltd
Registered no. 2417831 (England)

The email looks like a genuine email because it has been copied from a genuine email from this company, but Mick George Skips are not actually sending this out. Instead it is a simple forgery.

What you are meant to have attached is a Word document Invoice395687.DOC which comes in several varieties, but they all contain a malicious macro similar to this which (in this case) downloads a component from http://schlaghaufer.de/js/bin.exe

This malware and the payload it drops is identical to the one found in this fake IRS spam run earlier today.