The email zip attachment contains an xls. This, if opened, contacts a url and downloads the dll, disguised as an image, which starts malware infection.
By opening the link in the email, you download a doc file that contacts a url from an internal list and download the dll, which starts the malware infection.