Locky "annual report"

2016-07-27 #locky email phishing campaign "annual report"

Email sample:
-------------------------------------------------------------------------------------------------
From: "Rey Davis"
To: [REDACTED]
Subject: annual report

Hi [REDACTED],
Speaking of the event, I attached the annual report that we discussed about

Best regards
Rey Davis

22877c7aff391c0afa6677c54aa2d7d1b07976306a6e48b773545f79ee
-------------------------------------------------------------------------------------------------
Attachment: <random hexa characters>.zip

Attachement contains .wsf file named "annual report ~XXX~..wsf" containing JScript downloading malware from:

http://52257103.fn.freenet-hosting.de/ep9lm3q
http://abligl.com/rbj3r
http://admiral1.50webs.com/mpgul8
http://animeallday.cba.pl/cm0rbuk
http://arossmann.de/e62ybq4
http://bck.srtec.net/n41uek8
http://bitrrent.web.fc2.com/9rw09i0
http://brianzainformatica.it/2qsa3m1p
http://darkhollowcoffee.com/6t5evqq
http://darkhollowcoffee.com/wq6v3b
http://ejdadim.com/xf5j3u
http://elettromerid.it/~elettroftp/6z50q1
http://ferienwohnung-joos.de/b1bq2
http://fiditra.de/5ww1d4
http://fliesentm.de/rd7iy
http://fmkco.web.fc2.com/bxhn1w
http://france-etuves.fr/cnm6ud
http://giftskeys.ts9.ru/thz7yawf
http://grantica.ru/c5v3mr75
http://hayan60.inodea.co.kr/tdy618d7
http://herko125.0catch.com/o3qdd
http://loungebox.50webs.com/f636fo4
http://marcofloridia.interfree.it/dcmu4hf3
http://marquiselib.web.fc2.com/73s92vu
http://ovcharenko.atspace.com/gfpige
http://railroute.fr/hge4gk12
http://reciente.atspace.com/f9pv0fj
http://right-livelihoods.org/xvq5048y
http://vocaliveofficial.web.fc2.com/i7zzsb76
http://voisin-sa.com/~tecsidel/rafhsf
http://wizcad.co.za/ttpf40aw
http://www.aerreravasi.com/gc7mp
http://www.beck-kituzo.hu/r024m
http://www.blutjunkies.mynetcologne.de/k3rn1u23
http://www.epang.50webs.com/shthw2tv
http://www.fabricemontoyo.com/s7i2vy
http://www.fascicolodifabbricato.org/aohy2a3
http://www.homophon.com/8zztj69n
http://www.iperlatino.it/1npjv
http://www.jobvermittlung-dithmarschen.de/o1i9c9
http://www.maurop.it/e6e2y
http://www.ovadese.info/lcwfkz
http://www.pastificiodelduca.com/gd0h1
http://www.recuperifallimentari.com/8kmbnc4e
http://www.richtenberg.be/jalht8
http://www.simplybridalweddingmakeup.co.uk/e9ms6ul4
http://www.smees.be/t9ycja
http://www.twistcrew.eu/jptjrg
http://www.washio.com/mskow1ql

https://www.reverse.it/sample/1613cba6a9f06d0801293d40bb95cb3411919e509eab14704a2bdabfee850f0b?environmentId=100