Malware spam: "General Election 2015 Invoices" / "SIMSSL@st-ives.co.uk"

This unusually-themed spam leads to malware. It does not come from St Ives but is instead a simple forgery.

From: SIMSSL@st-ives.co.uk [mailto:SIMSSL@st-ives.co.uk]
Sent: Friday, June 05, 2015 9:53 AM
Subject: General Election 2015 Invoices

Dear Sir/Madam

Please find attached your invoice 62812 for GE2015

Please could payment be quoted with your constituency name/Invoice numbers

Our Bank Details are:
St Ives Management Services Limited
HSBC
Sort Code: 40-04-24
Account Number: 71419501
Account Name: St Ives Management Services Limited

Remittance advices should be emailed to simsAR@st-ives.co.uk

If paying by cheque, please kindly remit to the address below and not to 1 Tudor Street:

St Ives Management Services Limited
c/o Branded3
2nd Floor, 2180 Century Way
Thorpe Park
Leeds
LS 8ZB

If you have already paid by credit card then there is no need for you to make payment again.

For payment queries please contact Steven Wilde 0113 306 6966

For invoice queries please contact Emily Villiers 0207 902 6449

Kind Regards
SIMS Sales Ledger

This email is intended for the addressee only. It may be confidential and legally privileged. Unauthorised use, copying or disclosure of any of it may be unlawful. St. Ives plc does not accept liability for changes made to this message after it was sent. Any opinions expressed in this email do not necessarily reflect the opinions of St. Ives plc. If you have received this communication in error, please return the message to the sender by replying to it and delete the email immediately.

Whilst St. Ives plc has taken steps to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that this email and its attachments do not adversely affect their system or data. St. Ives plc accepts no responsibility in this regard and the recipient should carry out such virus and other checks, as is considered appropriate.

St. Ives plc reserves the right to read any e-mail or attachment entering or leaving its systems from any source without prior notice.

St. Ives plc registered in England & Wales no. 1552113

Registered office: One Tudor Street, London EC4Y 0AH 

I have only seen one sample so far, with a Word document 1445942147T0.doc attached containing this macro which tries to download a malicious executable from g6000424.ferozo[.]com/25/10.exe but this fails with a timeout. However, the payload will be the Dridex banking trojan.

UPDATE:
I was informed of another download location at elkettasandassociates[.]com/25/10.exe which downloads a malicious binary with a detection rate of 5/57.

Automated analysis tools [1] [2] [3] show network traffic to the following IPs:

203.151.94.120 (Internet Thailand Company Limited, Thailand)
31.186.99.250 (Selectel, Russia)
146.185.128.226 (Digital Ocean, Netherlands)
185.12.95.40 (RuWeb, Russia)

According to this Malwr report it drops a Dridex DLL with a detection rate of 3/57.

Recommended blocklist:
203.151.94.120
31.186.99.250
146.185.128.226
185.12.95.40

MD5s:
4287dfb5e191d92f34ae50e190eee214
e481e0a2f853a84c903aea752823e496