Trickbot

https://www.virustotal.com/file/fcd6e5efe363e429d7b285d740d62bc1a55490ce8f188c0d8f042972bc4b48f0/analysis/1504290458/

<mcconf>
<ver>1000044</ver>
<gtag>kas8</gtag>
<servs>
<srv>84.238.198.166:449</srv>
<srv>91.139.236.92:449</srv>
<srv>84.40.65.85:449</srv>
<srv>51.254.164.249:443</srv>
<srv>188.165.62.15:443</srv>
<srv>67.21.84.23:443</srv>
<srv>210.16.102.251:443</srv>
<srv>188.165.62.8:443</srv>
<srv>185.147.34.95:443</srv>
<srv>185.158.115.151:443</srv>
<srv>104.152.187.28:443</srv>
<srv>5.152.210.179:443</srv>
<srv>178.156.202.227:443</srv>
<srv>216.107.149.57:443</srv
><srv>194.87.237.129:443</srv>
<srv>194.87.235.164:443</srv>
<srv>93.95.97.180:443</srv>
<srv>194.87.238.42:443</srv
><srv>178.156.202.226:443</srv
><srv>185.117.73.4:443</srv>
</servs>
<autorun><module name="systeminfo" ctl="GetSystemInfo"/><module name="injectDll"/>
</autorun>
</mcconf>

Received: from [81.187.97.145] (HELO domain.1.0001.arsmtp.com)
  with ESMTP id 58185835 for user@domain; Fri, 01 Sep 2017 14:05:18 -0400
Received: from RemoteHostPc (localhost.localdomain [127.0.0.1])
	by local_computer_name_DOMAIN with ESMTP
	; Fri, 1 Sep 2017 19:04:52 +0100
dkim-signature: v=1; a=rsa-sha256; d=paypalmessage207.ml; s=default;
	c=simple/simple; q=dns/txt; h=From:To:Date:Message-ID:Subject;
	bh=37CXMM/f0RTxPTkkZxQHKWkpyw0zELFwD/ajROd3Uco=;
	l=100;
	b=Dr9xFPNy1zh0EfeIrUenZrtA2bhatIJ+eKcdBkoOqC3EZKKuB0YAkiICBqW5qTeUq7CfB3Km7kKGTUuNEphfSrHq6tOx7IL6Lmjxo+6xuk6t1oczbvGVJPD+3CLuyRXCT9UZD8PoZeuu8SdCxU+0dW56JY99vwZW9iEgs65FC6A=
Message-ID: <000001d32355$312b25e0$938171a0$@ml>
Date: Fri, 1 Sep 2017 19:04:52 +0100
From: PayPal Security Department informs <[email protected]>
To: <user@domain>
Subject: PayPal Security
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_0001_01D32355.30418930"
X-Priority: 3 (Normal)
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AdMjTM9mJWTAGsUMRHCeMV96Uiyz7w==
Content-Language: en-us

This is a multi-part message in MIME format.

------=_NextPart_000_0001_01D32355.30418930
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_0002_01D32355.30418930"


------=_NextPart_001_0002_01D32355.30418930
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit

Please download and view Microsoft Word attachment

Our records indicatethat you never did not answer to requests for additional information about this claim. We hope you view the attached file and solve the question amicably.


Sincerely!

Protection Services Department

PayPal does not tolerate fraud or illegal activities. Your request has been noted in the record of the PayPal user you recorded. If we find this user has violated our confidentiality we will make inquiries and take appropriate action. If this occurs, you may be contacted in the future about the status of this complaint.


------=_NextPart_001_0002_01D32355.30418930
Content-Type: text/html;
	charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<style>
<!--
 /* Font Definitions */
 @font-face
	{font-family:"Cambria Math";
	panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri","sans-serif"
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;}
@page Section1
	{size:612.0pt 792.0pt;
	margin:2.0cm 42.5pt 2.0cm 3.0cm;}
div.Section1
	{page:Section1;}
-->
</style>

<!--[if gte mso 9]><xml>
 <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapelayout v:ext=3D"edit">
  <o:idmap v:ext=3D"edit" data=3D"1" />
 </o:shapelayout></xml><![endif]-->
</head>
<body lang=3DEN link=3Dblue vlink=3Dpurple>
<div class=3DSection1>
<p class=3DMsoNormal><span lang=3DEN-US>Please download and view Micr=
osoft Word attachment<o:p></o:p></span></p>

<p class=3DMsoNormal><span lang=3DEN-US><o:p></o:p></span></p>

<p class=3DMsoNormal><span lang=3DEN-US>Our records indicatethat you =
never did not answer to requests for additional information about this=
 claim. We hope you view the attached file and solve the question amic=
ably.<o:p></o:p></span></p>

<p class=3DMsoNormal><span lang=3DEN-US><o:p></o:p></span></p>

<p class=3DMsoNormal><span lang=3DEN-US><o:p></o:p></span></p>

<p class=3DMsoNormal><span lang=3DEN-US>Sincerely=
!<o:p></o:p></span></p>

<p class=3DMsoNormal><span lang=3DEN-US><o:p></o:p></span></p>

<p class=3DMsoNormal><span lang=3DEN-US>Protection Services Departmen=
t<o:p></o:p></span></p>

<p class=3DMsoNormal><span lang=3DEN-US><o:p></o:p></span></p>

<p class=3DMsoNormal><span lang=3DEN-US>PayPal does not tolerate frau=
d or illegal activities. Your request has been noted in the record of =
the PayPal user you recorded. If we find this user has violated our co=
nfidentiality we will make inquiries and take appropriate action. If t=
his occurs, you may be contacted in the future about the status of thi=
s complaint<o:p></o:p></span></p>

</div>
</body>
</html>

------=_NextPart_001_0002_01D32355.30418930--
------=_NextPart_000_0001_01D32355.30418930
Content-Type: application/x-msdownload;tname="=?UTF-8?B?UGF5UGFsMTUzMjM1MjE1NjU3XzIxNjguZG9j?="
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="=?UTF-8?B?UGF5UGFsMTUzMjM1MjE1NjU3XzIxNjguZG9j?="

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAACAAAAeQAAAAAA
AAAAEAAAfAAAAAIAAAD+////AAAAAHgAAACAAAAA////////////////////////////////
////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////