Malware spam: " Invoice / Credit Note Express Newspapers (S174900)" / georgina.kyriacoumilner@express.co.uk

This fake financial spam is not from Express Newspapers but is instead a simple forgery with a malicious attachment:

From:    georgina.kyriacoumilner@express.co.uk
Reply-To:    hannah.johns@express.co.uk
Date:    20 January 2016 at 14:28
Subject:    Invoice / Credit Note Express Newspapers (S174900)

Please find attached Invoice(s) / Credit Note(s) from Express Newspapers.

If you have any queries with it, or to request that future documents get sent to a different email address for processing, please contact:

hannah.johns@express.co.uk or telephone 020 8612 7149.

N.B. Please do not reply to this email address as it is not checked.

Kind Regards,

Express Newspapers
Finance Dept - 4th Floor,The Northern & Shell Building
Number 10 Lower Thames Street, London EC3R 6EN

****************************************************************************
Any views or opinions are solely those of the author and do not necessarily represent those of Express Newspapers

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material.If you are not the intended recipient of this message please do not read ,copy, use or disclose this communication and notify the sender immediately. It should be noted that any review, retransmission, dissemination or other use of, or taking action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. E-mail communications may be monitored.
****************************************************************************
EXN2006 

Attached is a file S174900.DOC which comes in at least three different versions (VirusTotal results [1] [2] [3]) and the Malwr reports for those [4] [5] [6] shows the following download locations:

www.helios.vn/98jh6d5/89hg56fd.exe [404 error]
202.191.112.60/~n02022-1/98jh6d5/89hg56fd.exe
www.lassethoresen.com/98jh6d5/89hg56fd.exe

These are the same locations as seen here, but now the payload has changed to one with an MD5 of 34781d4f8654f9547cc205061221aea5 and a detection rate of 1/54. The malware still phones home to
216.224.175.92 (SoftCom America Inc, US) which I recommend you block.