Locky "h78r3gfe"

2016-08-04 #locky email phising campaign "h78r3gfe" / "Emailing: ....."

Email sample (sender and recipient addresses are same):
-----------------------------------------------------------------------------------------------
From: [REDACTED]
To: [REDACTED]
Subject: Emailing: Invoice (598).pdf

[No message body]
-----------------------------------------------------------------------------------------------
Attachment: Invoice (598).pdf.docm, macro-enabled MSWord document with macros downloading from:

http://abi64.com/h78r3gfe
http://bikepaintpureworks.web.fc2.com/h78r3gfe
http://brupuoli.tempsite.ws/h78r3gfe
http://cigareta.prodejce.cz/h78r3gfe
http://composit.vtrbandaancha.net/h78r3gfe
http://customjets.net/h78r3gfe
http://Feuerwehr-Lauenfoerde.de/h78r3gfe
http://film-online.bejbiblues.cba.pl/h78r3gfe
http://ftp.bergamo.chiesacattolica.it/h78r3gfe
http://innal.com.mx/h78r3gfe
http://karnat.cba.pl/h78r3gfe
http://mbc.nekonikoban.org/h78r3gfe
http://nonpareil.web.fc2.com/h78r3gfe
http://potato.chottu.net/h78r3gfe
http://schello4u.de/h78r3gfe
http://tyouseikan.web.fc2.com/h78r3gfe
http://www.agriturismolapiana.net/h78r3gfe
http://www.artistsagainstwar.it/h78r3gfe
http://www.casarella.it/h78r3gfe
http://www.comunedicanischio.it/h78r3gfe
http://www.ekstraciuchy.pl/h78r3gfe
http://www.kishazy.hu/h78r3gfe
http://www.marinadiugento.it/h78r3gfe
http://yeniyuzyillions.org/h78r3gfe

encrypted malware, filesize 259255, sha256 367f083a0d2365f8f58bba38a286a408a1d04efee3df63935bb4756c9bbe3ae7