Malware spam: "Purchase Order 124658" / "Gina Harrowell [gina.harrowell@clinimed.co.uk]"

This fake financial spam is not from CliniMed Limited but is instead a simple forgery with a malicious attachment:

From     Gina Harrowell [gina.harrowell@clinimed.co.uk]
Date     Wed, 02 Dec 2015 01:53:41 -0700
Subject     Purchase Order 124658

Sent 2 DEC 15 09:18

CliniMed Ltd
Cavell House
Knaves Beech Way
Loudwater
High Wycombe
Bucks
HP10 9QY

Telephone 01628 850100
Fax 01628 850331

From:                    CliniMed Limited

Company Registration No: 01646927

Registered Office:       Cavell House, Knaves Beech Way,
                         Loudwater, High Wycombe, Bucks, HP10 9QY

The contents of this e-mail are confidential to the sender and the addressee. If
you are not the addressee, or responsible for delivering to the addressee, please
notify us immediately by telephoning our IT Support on 01628 850100 (UK) or +44 1628
850100 (international) and delete the message from your computer without copying
or forwarding it or disclosing its contents to any other party. CliniMed Limited
cannot accept any responsibility for changes made to this message after it was sent
and you should not rely on information given in the message without obtaining written
confirmation. It is the responsibility of the addressee to scan incoming mail for
viruses and CliniMed Limited accepts no liability or responsibility for viruses.
Opinions expressed in this e-mail are those of the sender and may not reflect the
opinions and views of CliniMed Limited.

Attached is a file P-ORD-C-10156-124658.xls which I have seen two versions of (VirusTotal results [1] [2]) which contain a malicious macro that looks like this [pastebin] which according to these automated analysis reports [3] [4] [5] [6] pulls down an evil binary from:

det-sad-89.ru/4367yt/p0o6543f.exe
vanoha.webzdarma.cz/4367yt/p0o6543f.exe

There may be other versions of the Excel document with different download locations, but the payload will be the same. This has a VirusTotal detection rate of 1/55  and those previous reports plus this Malwr report indicate malicious network traffic to the following IPs:

193.238.97.98 (PJSC Datagroup, Ukraine)
94.73.155.12 (Cizgi Telekomunikasyon Anonim Sirketi, Turkey)
89.32.145.12 (Elvsoft SRL, Romania / Coreix, UK)

The payload is probably the Dridex banking trojan.

MD5s:
9e1bac7de9a3d2640c8342ba885f9fac
ad78358aa34f2208cde5b63fa27987ef
6fa491ea0bab9f6213329c4c010b27fe

Recommended blocklist:
193.238.97.98
94.73.155.8/29
89.32.145.12