Malware spam: "Employee Documents – Internal Use" / Employee Documents(1928).xls

This spam appears to come from the "HR@" email address in the potential victim's own domain, but it is instead a simple forgery with a malicious attachment.

From: HR@victimdomain
To: victim@victimdomain
Subject: Employee Documents – Internal Use
Date: Mon, 23 Nov 2015 16:23:41 +0530

Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: Quoted-Printable

DOCUMENT NOTIFICATION, Powered by NetDocuments

DOCUMENT NAME: Employee Documents

DOCUMENT LINK: [Link removed]

Attached is a file Employee Documents(1928).xls although I have had some difficulty acquiring a copy. However, my sources tell me that there are three different versions downloading from the following locations:

kunie.it/u654g/76j5h4g.exe
oraveo.com/u654g/76j5h4g.exe
www.t-tosen.com/u654g/76j5h4g.exe

The downloaded binary has a detection rate of just 1/54. That VirusTotal report and this Hybrid Analysis report show network connections to the following IPs:

89.108.71.148 (Agava Ltd, Russia)
89.32.145.12 (Elvsoft SRV, Romania / Coreix, UK)
157.252.245.32 (Trinity College Hartford, US)

The payload is probably the Dridex banking trojan.

MD5s:
127f12a789c145ed05be36961376999e
c57bc09009a925a02fde6a6b58f988b3
bb62d7bc330a2e2452f773500428574c
a178d8d94238977b0c367dc761d9c7de

Recommended blocklist:
89.108.71.148
89.32.145.12
157.252.245.32