MICROSOFT phish running on ggentertainments[.]com

Found: 2018-07-16 17:15:04.083000
URL: http://ggentertainments.com/wp-settings/landscape/layouts/excel.zip
File: ggentertainments.com-layouts-excel.zip
Domain: ggentertainments.com
Target: MICROSOFT
Name                                               Size Date                 MD5                                excel/excel/excel/favicon.ico                      16958 2017-07-25 09:00:38  3dd5838b49ae9a7a757d70ab9eb7606d
    File appears in 2 kits  and under 4 different file names
excel/excel/excel/files/facebox.css                 1151 2017-07-25 06:10:38  8f642d8245a02cf0e5035aa5559ddecf
    File appears in 17 kits
excel/excel/excel/files/facebox.js.download         9532 2017-07-25 06:10:38  780047ee74f4c0eb6e615412f7bd7f72

excel/excel/excel/files/javascript1.js.download     3319 2017-07-25 06:10:38  40c424fed5b9fe47d4f4d304a05a47f5

excel/excel/excel/files/jquery.js.download         19227 2017-07-25 06:10:38  3387140bc81e200dd029fa77e4e05d6b

excel/excel/excel/files/jquery-1.js.download       91557 2017-07-25 06:10:38  4eff8949da0f668d0135725d477e838b

excel/excel/excel/img/126.gif                       3916 2017-07-25 09:06:48  753f86a8e86caf30d6f60a7b4cfd0ebb
    File appears in 3 kits
excel/excel/excel/img/163.png                       3962 2017-07-25 09:06:58  da57c3aabe74a950c0927e25250f0b1a
    File appears in 4 kits
excel/excel/excel/img/aliyun.png                    3446 2017-07-25 09:07:18  087c82a4241094c3878bfc83c42d7ba4
    File appears in 3 kits
excel/excel/excel/img/gmail.jpg                     5806 2017-07-25 09:07:28  a6887b278b1a95be4631d968ca962e72
    File appears in 4 kits
excel/excel/excel/img/hotmail.jpg                   2822 2017-07-25 09:07:40  15e04e940e247908fa740dcd2b0047e2
    File appears in 4 kits
excel/excel/excel/img/loadingtheimage.gif           2767 2017-07-25 09:07:52  7e99e1159a3686f6aa4f90043c554483
    File appears in 6 kits  and under 3 different file names
excel/excel/excel/img/mailserver.jpg               62577 2017-07-25 09:08:04  7efb31ecb73d501560604f17c18248c3
    File appears in 4 kits
excel/excel/excel/img/sina.jpg                      6194 2017-07-25 09:08:14  b61e745f5908aa3d14a3039683c72e10
    File appears in 3 kits
excel/excel/excel/img/yahoo.jpg                     5764 2017-07-25 09:08:24  26a48386d0805dc958640f1a10625759
    File appears in 4 kits
excel/excel/excel/index.php                          144 2016-03-11 04:42:24  0526c242a1f7b6117202fe21d47e31b1
    File appears in 192 kits  and under 4 different file names
excel/excel/excel/javascript/facebox/src/closelabel.png   168 2017-07-25 09:10:16  1192beca454829656c18d56a999cea8d
    File appears in 6 kits
excel/excel/excel/login.php                         4274 2017-10-09 08:48:58  02ac7d81f1d6e7c0e24e603cefcfb32e

excel/excel/excel/pdf.gif                            471 2017-07-25 09:16:20  27fd851632fb0c1f4bb27a282f69e23c
    File appears in 2 kits
excel/excel/excel/pdf.png                          74994 2017-07-25 08:52:22  7fdfda117955a2a410a2aed86a67561f
    File appears in 77 kits  and under 7 different file names
excel/excel/excel/pdf2013.png                      12290 2017-07-25 08:51:18  6e25b01acc4b3f0b7c69b3ce81ba670d
    File appears in 87 kits  and under 2 different file names
excel/excel/excel/script.php                        1317 2018-01-17 13:29:26  3caa7a1fec235a2731b5ffd20a937d83


3 Email addresses found:
    naayomide@gmail.com
    personalinfo231@gmail.com
    supertool@mxtoolbox.com (appears in 76 kits)



https://texasmalwareblog.blogspot.com   @phish_total