There are two embedded links in the email and an attachment (which is infected with macro scripts, see below).

Macro information:

Underlying code, four modules worth!