The two links in the message download a zip with an xls inside, which contacts three URLs from which the dll is downloaded, starting the malware infection.
The zip attachment of the message, written in Italian and English, contains an xls, which contacts a url from internal list and downloads the dll, staring malware infection.