IcedID campaign spotted being spiced with Excel 4 Macros

IceID IOCs

Hashes
7152b279e52e2c6fc0f1cfdafcdccfb45285805de1600d47b28cddac9a1c2bb1
57494b5bbe886b1fa00dc81f3f835be03769ed2d7eddd7833991ef57d2c45a2d
072c80376261caa87677abfb9dfc268ef0ef49e1611c1c554368a3501231ad6e
f13f315f4c463e582676a253e6b1a3f487e4f98c2bc6bb40f072dae005020d9b
0bcf2c56c5d3a2c17d1789ac4f3e22b43279957864f30170183e235fa555b4fc
f151ec5b824c7c7eef1e2178c2701353cdf349ac32db5ba09d17474093f77abf
c29b93cf7a5134d0569d325fce06472e511c9f244781e05f9ec1efab261faa64
7a9f6247087a03c17273a1d44dc996d93035220d8fa01b7c7d6f29e73481397b
ac7ffe03290d646f0d6b2b70d72bdf5ddec6ea68518a46a43f6cadb8405d55c1
6962c82ca95e3804e022e42c91f1708f8912a7d798d9baccaaa13bc4a04065d3
62db4784c54b77efaacdc85bd6ef2eabb45dcd5f8eec6b3495047b74304fa004
cc804b05d5af7ba2fb752fee78584d8961261900645cc3ceecadd81c3408914b
27f39954ae5f9a1be4a456ed55dbd4b56194729ebb1f23f66c0bdb08ecdf3a20
cf3bff21932f3b9b0a615aa768b6458880b5bee596567b88fd9bc62949dd9ce1
a76722baf26a2d18dcee08a70df303b8cc330cddb3acc94719b57dd8c12f02cd
f561cc1cc2e6284a37479f53771fff1bab0af7fcf3257a6900489807d896d00f
51d5f805abac585c1cb686c3b87d1597a8ae66c0a3a83f15a5f3143a1197b8e4
249c42bf328ab7cc321da48fcc9d2ba3ffb8afb160776f961554adf8605f894e
d62bff7ef25d08b4d57333e3b7afd9ef8aba7ecdd5e5c2ccdb6351d3808e3e32
14b50bfa149def72f5dc08d27dfff8bd0204d8b8e28c0757327ea1189414c130
4531a5ed6fb4a6ff8bb556305f2a85dd8e3b6f5100c1188223725d50a75ba61d
a1c74b07693b5c505edf3682a1c0703229eff8e71b3d61718b59c06e993df226

URLs
missimokotov[.]space
metaflip[.]io
partsapp[.]com[.]br
usaaforced[.]fun
agenbolatermurah[.]com
tajushariya[.]com
columbia[.]aula-web[.]net