See: https://www.hybrid-analysis.com/sample/46be29d8d8d8aa376c256619c8dff5ebc47fc6763cd15868a19eafd16fee45fc?environmentId=1
Re: https://urlquery.net/report.php?id=1454790509960
Re: https://www.virustotal.com/en/ip-address/64.6.238.47/information/
Re: https://www.threatcrowd.org/ip.php?ip=64.6.238.47
Avast seems to detect these droppers. Also Malware Macro Spam detections.
polonus