Malware spam: "Alpha Heating Innovation"

This fake financial email is not from Alpha Heating Innovation but is instead a simple forgery with a malicious attachment:

From     Kurt Sexton
Date     Tue, 26 Jan 2016 10:59:05 -0500
Subject     =?UTF-8?B?UmVtaXR0YW5jZSBBZHZpY2UgNTk2M0U5?=

For the attention of Accounts Receivable,

We are attaching an up to date remittance advice detailing the latest payment on
your account.

Please contact us on the email address below if you would like your remittance sent
to a different email address, or have any queries regarding your remittance.


Kind regards,
Kurt Sexton

Best Regards,

Kurt Sexton


Credit Controller - Alpha Heating Innovation



t - 01732 783 019

f - 0844 871 8765

e - stacey.tomsett@alpha-innovation.co.uk

w - www.alpha-innovation.co.uk



Head Office: Alpha Heating Innovation - Nepicar House - London Road - Wrotham Heath
- Kent - TN15 7RS - 01732 783 000

National Distribution Centre: Alpha Heating Innovation – Unit 7 Euroway – Quarry
Wood Industrial Estate - Aylesford - Kent – ME20 7UB - 01622 711 000

The names of the sender and reference numbers will vary. I have only seen two different variants of the attachment, in the format remittance_advice5963E9.doc (VirusTotal [1] [2]) but there are probably more. Analysis is pending, and at the moment I have not had time to decode the document that looks like this [pastebin]. It does seem to have some characterstics of a Dridex downloader.