SANS Internet Storm Centre has a couple of blog posts looking at the mechanics of a Word document and a PDF both of which are malicious payloads in a phishing email.
This is what you are up against!
Analyzing a Phishing Word Document – SANS Internet Storm Centre
Simple PDF Linking to Malicious Content – SANS Internet Storm Centre
