View difference between Paste ID: 6iXCNiNs and WQTYQ4fY

 *Email sample*
 
-_Subject_: Payment
+_Subject_: Final version of the report
 
 _Body_:
 
 Dear [NAME],
 
-Our records show that we have not yet received payment for the previous order #A-532173
+Lance Davis asked me to send you the attached Word document, which contains the final version of the report.
-Could you please send payment as soon as possible?
+Please let me know if you have any trouble with the file, and please let Lance know if you have any questions about the contents of the report.
 
-Please find attached file for details.
+
 Kind regards
 
-Yours sincerely
+Faith Leonard
-Jeremy Jackson
+Chief Executive Officer
-Operations Director (CEO Designate)
+
 
 In attachment a zip archive with a javascript file.
 
 Javascript sample - MD5: c4b65cb100b08a3e3b366ccf7c161dc9
-Javascript sample - MD5: b217ece3ecf33fd6fc624af5d25f0840
+VT: 1/55 - https://www.virustotal.com/en/file/3fe9169a286bcedc3c7ba1da0160dded07af0540211ed32c6144cc4435f4a42e/analysis/
-VT: 1/56 - https://www.virustotal.com/en/file/a7e93e059bf53885110dddb52b5029e4e5c0b35f98ab3981a26b80a47118905d/analysis/
+
 *Compromised domains (49)*:
-*Compromised domains (47)*:
+
 3141592.ru/ wyesvj
-98.131.20.17/ o41d3
+4k18.com/ u69f97
-bbmarilu.it/ f7x1378
+aberfoyledental.ca/ 6dil05
-bbvogliadimare.it/ h573kdg
+abligl.com/ 8v62l4i4
-bolanoid.ru/ vjqraq
+adbm.co.uk/ 1o2wejz
-btgnj.com/ a6308b
+angeelle.nichost.ru/ y6s1y9h
-caseificiodesantis.it/ bmvl5xz
+arogyaforhealth.com/ jujg6ru
-centrosportivoiunco.it/ c42en
+atlantaelectronics.co.id/ quv7rcc1
-cm-seia.pt/ 0q6d4ej
+babycotsonline.com/ ph42q6ue
 barum.de/ c2blg
-control-seduction.private.pl/ eu5c1q
+beautifulhosting.com.au/ rxn80
-darts-pr.ru/ 6m5hl
+bilgoray.com/ vi5sfu
-deangelis.co.uk/ 9189x
+bobbysinghwpg.com/ pdqcqlnr
-dice-design.com/ 9cotr5w
+boranwebshop.nl/ ggc7ld
-dugganinternational.ca/ jlv43q0
+bptec.ir/ kvk9leho
-edilperle.it/ b354kx0o
+cameramartusa.info/ xrfpm
-fastmoneyloan.info/ 0h1vsa63
+capitalwomanmagazine.ca/ 6k1oig
-fitnesclub.ru/ oc7xhbuc
+century21keim.com/ c7xb2xy
-folkchata.pl/ wmm4i0
+certifiedbanker.org/ obmv6590
-follyfoot.org/ todl3fc
+cg.wandashops.com/ evqbfwkx
-garnelenfarm.net/ jixh4iz
+clients.seospell.co.in/ fkn67zy
-genius-versand.de/ 9kme7u
+climairuk.com/ h32k491o
-hate-metal.com/ hre8fqo
+climatizareonline.ro/ azkqs
-hoosiernetwork.com/ 6oa4xhk
+
-hotstreams.ru/ o1cri71
+dentalshop4you.nl/ m22brjfz
-hudebiah.net/ uhpdylx4
+disneyexperience.com/ psyyhe
-ilbalconcino2011.it/ bzukq
+elviraminkina.com/ ojyq1
-ingstroymash.ru/ m92xv
+empiredeckandfence.com/ h2uppib
-itc.slav.dn.ua/ w4b7m0
+euro-support.be/ rdl3n7u
 focolareostuni.it/ 0k2ren
-marchandedidees.fr/ o1236qw
+freesource.su/ ijugasq1
-maydenehotelblackpool.com/ 4qjb81gs
+grantica.ru/ 6hjli
-modband.com/ a4jw2if
+honeystays.co.za/ siu2k
-mr2peter.de/ myu3a6ge
+ideograph.com/ k7qfsxx
-namifitnessclub.it/ c6y9dcms
+imetinyang.za.pl/ 74hd4by5
-newgeneration2010.it/ cx6uxxg5
+immoclic.o2switch.net/ styvuwti
-newpark.co.uk/ 54yp9
+jd-products.nl/ xjld131
-oavb.com/ 9hh3ybox
+
-potolok-profit.ru/ od0xz9xv
+margohack.za.pl/ wkiokl
 matvil8.freehostia.com/ 64tmb1
-saintkatherine.orthodoxy.ru/ 5uj4u6
+mycreativeprint.com/ mqib9te
-staffsolut.nichost.ru/ qimiiud
+oakashandthorn.charybdis.seedboxes.cc/ f7ge4y3k
-turniejkrzyz.za.pl/ fz0i11
+promoresults.com.au/ gx4al
-uas-aas.ca/ 4bwbk5
+
-usdavetrana.it/ c474o
+tip.ub.ac.id/ k2e32vh
-vonenidan.de/ kdwytr
+www.centroinfantilelmolino.com/ 60wfh
-www.johnlodgearchitects.com/ fx89v
+www.darkhollowcoffee.com/ oqlyd9m
-www.puertasjoaquin.com/ nl5tl
+www.ellicottcitypediatrics.com/ 7d6sdl
 www.keven.site.aplus.net/ fmlonxl
 
 *Sampled downloaded and decoded*:
-File Name: fksdOKooVkA.exe
+
-MD5: 8137DC850A9F2593F331A149D6CC17CF
+File Name: 9oaELw13vFr7w.exe
-VT 13/54 - https://virustotal.com/en/file/6f292ac37fb327ce7223f4e7d58b93f0f3038f279ac54348c2cef430aacc44d8/analysis/
+MD5: 4d48a039371d95e49b8ef7c4e2459946
 VT 4/56 - https://virustotal.com/en/file/e5a6828f732bea6b66c4f6d850b235f6c1f139b10f8d9f2c3760298cfd88c163/analysis/
 
 For this campaign the argument passed to the Locky dropper is no more 123 but 321. Credit to @siri_urz