emotet 11-17-17

##Samples
Doc: https://www.hybrid-analysis.com/sample/bbce7972501609e4d640ab6034b06e9ca903f89841e56e21362f9ec690741337?environmentId=100
Payload: https://www.hybrid-analysis.com/sample/fc16abe6701e8ef4c8c1129c2e0a5f8e309ec3c3f3e54dc6b3f16b3f5b453a15?environmentId=100
Payload: https://www.hybrid-analysis.com/sample/bfb98b061e655b8e3f7f2fea8a27d5c23a9c1a2ba4ce8bd31802d1120425a184?environmentId=100

##Doc loader DL URLs
hxxp://theworkstationvizag.com/New-invoice-7141508/
hxxp://yak.com.ua/New-invoice-40699795/
hxxp://www.lp.imperial-des.ru/New-invoice-63657604/
hxxp://www.stchase.com/New-invoice-0464398/
hxxp://www.h-artist.com/New-invoice-994296
hxxp://www.serveiftaar.com/New-invoice-98534710/
hxxp://agilitydiagnostics.in/New-invoice-42196649/
hxxp://coachphivu.com/New-invoice-689066/
hxxp://ayurvedgram.in/New-invoice-980032611/
hxxp://mwmdigitals.com/New-invoice-0434554/
hxxp://mlmgmu.ru/New-invoice-4371708/
hxxp://bbcooking.club/New-invoice-668454670/
hxxp://makymaky.cz/wp-content/New-invoice-7256793/
hxxp://anzai.vip/New-invoice-884086/

hxxp://www.netblu.cl/Invoice-number-824814029/
hxxp://o-intention.co.jp/Invoice-number-299402870/
hxxp://theitaliantrainer.com/Invoice-number-54210099
hxxp://montrisuksa.ac.th/Invoice-number-506166/
hxxp://akucintabola.com/Invoice-number-7909021270/
hxxp://manutenzioniscifo.it/Invoice-number-344015819/
hxxp://newstribune.link/Invoice-number-387463074/
hxxp://chateaudemamere.com/Invoice-number-9028008/
hxxp://avanitech.in/Invoice-number-941320/

hxxp://enerswissag.com/wp-content/plugins/LLC/
hxxp://www.dealtol.com/LLC/
hxxps://juuve.nl/beatrixkwartier/wp-content/LLC/
hxxp://www.powercorp.co/LLC/
hxxp://ministere-metl.org/LLC/

hxxp://www.sohail-bhatti.myds.me/Invoice/
hxxp://www.linda.pk/Invoice/
hxxp://anuragrishi.com/Invoice/
hxxp://mhayat.com/Invoice/
hxxp://app-asia.com.sg/Invoice/
hxxp://hyperloopnederland.nl/Invoice/
hxxp://mundovirtual.pe/Invoice/
hxxp://www.mazya.biz/Invoice/
hxxp://grassmetal.ge/Invoice/

hxxp://lanalogistics.com/Download/
hxxp://www.jjtravels.online/Download/
hxxp://www.isdb-ppp.com/Download/
hxxp://bia2forum.com/Download/

hxxp://edubloggers.co.in/UPS.com/17-Nov-17-01-42-47/
hxxp://www.schermamanusardi.eu/UPS-Quantum-View/17-Nov-17-02-13-22/
hxxp://www.singhikhotel.com/wp-content/UPS-US/17-Nov-17-01-45-54/
hxxp://ajnaraambrosia.gq/UPS-Quantum-View/17-Nov-17-01-44-28/
hxxp://thietbimangcisco.com/UPS-View/17-Nov-17-01-18-37/
hxxp://promagna.ro/UPS.com/17-Nov-17-01-50-43/
hxxp://www.oftalmologiajvs.cl/UPS.com/17-Nov-17-12-59-29/
hxxp://antalyalabioplasti.com/UPS-US/17-Nov-17-06-12-08/

#additions from @James_inthe_box
http://www.oftalmologiajvs.cl/UPS.com/17-Nov-17-12-59-29/
http://www.sohail-bhatti.myds.me/Invoice

#additons from @dynamicanalysis
hxxp://www[.]racenews24[.]com/Invoice/

##Payload URLs
hxxp://dreambignet.com/XEVFWOQ/
hxxp://www.nguyenlieulamsocola.com/DqEaqx/
hxxp://mytravelzone.co.in/XsTr/
hxxp://www.lingyedesign.top/P/
hxxp://www.leepet.cn/EjJcBq/

##C2 proxies
217.13.106.249:8080
217.13.106.241:7080
167.114.98.61:8080
213.192.1.170:443
77.220.64.49:443

#additions from @techhelplistcom
194.88.246.242:443
217.13.106.16:8080
217.13.106.246:8080
45.73.17.164:8080