Locky "mbv58gbv"

#locky campaign "mbv58gbv" 2016-07-20
Phishing emails, subject "Scanned image from <name>"
Attached .docm downloads from

http://accendojuris.com/mbv58gbv
http://alinmaagroup.com/mbv58gbv
http://australiandietitian.com/mbv58gbv
http://biopocasie.sk/mbv58gbv
http://dreamsigns.com.au/mbv58gbv
http://graficador.ch/mbv58gbv
http://gromantique.com/mbv58gbv
http://iceskochi.org/mbv58gbv
http://iclaw.co.il/mbv58gbv
http://makingitalia.net/mbv58gbv
http://nlazovic.mybesthost.com/mbv58gbv
http://rpgmakerdev.com/mbv58gbv
http://www.kujunduskuur.com/mbv58gbv
http://www.plantengineer.biz/mbv58gbv
http://zuerich-gewerbe.ch/mbv58gbv

Malware: https://www.reverse.it/sample/73ddabd4aa7ba984f5446038889d0c9ab5b378e5162aa06cbe9699bb82322a8a?environmentId=100