locky 10-31-17

Subject: Invoice INV0000XXX
sample: https://www.hybrid-analysis.com/sample/fbe6bada632f990fedad3a3382f94daca9bf32ecfc2a2a3e997a6b89829383b2?environmentId=100
Sample: https://www.hybrid-analysis.com/sample/9d2ce15fd9112d52fa09c543527ef0b5bf07eb4c07794931c5768e403c167d49?environmentId=100

#MS Word OLE download links
b510684253a4142aec0a3cf8f8bd13b551408917ac98cce6bde1a480ebc56532
christakranzl.at/eiuhf384
claridge-holdings.com/eiuhf384
aurea-art.ru/eiuhf384
dvprojekt.hr/eiuhf384
cornertape.net/eiuhf384

#Intermediate payload serving netcat and qtloader
7379c5f5989be9b790d071481ee4fdfaeeb0dc7c4566cad8363cb016acc8145e (nc.exe)
d97be402740f6a0fc70c90751f499943bf26f7c00791d46432889f1bedf9dbd2 (qtloader
hxxp://projex-dz.com/i8745fydd
hxxp://celebrityonline.cz/i8745fydd
hxxp://sigmanet.gr/i8745fydd
hxxp://apply.pam-innovation.com/i8745fydd
hxxp://bwos.be/i8745fydd
hxxp://zahntechnik-imlau.de/i8745fydd

#Final payload - locky
c00d79e7363f38b88cffe490b13986b153a4e89685808cb383ad1aa1c5dc7c3c (encoded locky)
9d2ce15fd9112d52fa09c543527ef0b5bf07eb4c07794931c5768e403c167d49 (locky binary)
hxxp://hobbystube.net/dkjshfg643