Dec 2017 Campaigns

12/1/2017,Malicious email campaign morning,"<digits>_Invoice_<digits>"; 'doc' (is 7z) -> vbs -> globeimposter ransomware,Attachment,3192
12/1/2017,Malicious email campaign morning,"Re: <username>|Fw: <username";  passworded doc -> link -> sigma ransomware,Attachment,20
12/4/2017,Malicious email campaign morning,"Emailing:  <digits>"; 7z -> vbs -> globeimposter ransomware,Attachment,542
12/4/2017,Malicious email campaign morning,"CC Confirmation"; 7z -> vbs -> globeimposter ransomware,Attachment,562
12/5/2017,Malicious email campaign morning,"Message from "G10PR0024379.<domain>"; 7z -> vbs -> globeimposter ransomware,Attachment,374
12/5/2017,Malicious email campaign morning,"Scan Data"; 7z -> vbs -> globeimposter ransomware,Attachment,1800
12/6/2017,Malicious email campaign morning,"RE: FYI invoice status"; doc -> hancitor -> pony -> evilpony -> icedid trojan,Link,814
12/7/2017,Malicious email campaign morning,"Invoice INV0000<digits>|INV0000<digits>"; 7z -> vbs -> globeimposter/trickbot,Attachment,392
12/7/2017,Malicious email campaign morning,All subjects contain "fattura"; xls -> pandabanker,Attachment,11
12/7/2017,Malicious email campaign morning,"New Fax Message from <digits>"; doc -> hancitor -> pony -> evilpony -> icedid trojan,Attachment,759
12/7/2017,Malicious email campaign morning,"Scan"; doc -> trickbot trojan, attachment was inline, so showed up as b64 inline,Attachment,994
12/8/2017,Malicious email campaign morning,"Emailed Invoice - <digits>"; doc -> trickbot,Attachment,107
12/11/2017,Malicious email campaign morning,"Emailing: <characters> 11.12.2017"; doc -> globeimposter ransomware, attachment was inline, so showed up as b64 inline,Attachment,298
12/11/2017,Malicious email campaign morning,"New incoming fax from <phone number> on Mon, 11 Dec 2017 <timestamp>"; doc -> hancitor -> pony -> evilpony -> pandabanker trojan,Link,81
12/11/2017,Malicious email campaign morning,"Invoice <chracters>"; 7z -> vbs -> globeimposter/trickbot,Attachment,188
12/12/2017,Malicious email campaign morning,"Invoice RE-2017-12-12-<digits>|Your Payment - <digits>"; doc -> trickbot,Attachment,815
12/13/2017,Malicious email campaign morning,"Status of invoice <characters>"; doc -> trickbot,Attachment,106
12/13/2017,Malicious email campaign morning,"Message from KM_<digits>e"; doc -> globeimposter ransomware,Attachment,366
12/13/2017,Malicious email campaign morning,"New incoming fax from <phone number>"; doc -> hancitor -> pony -> evilpony -> icedid banking trojan,Link,414
12/15/2017,Malicious email campaign morning,"Scan"; doc -> globeimposter ransomware, attachment was inline, so showed up as b64 inline,Attachment,275
12/18/2017,Malicious email campaign morning,"LogMeIn Audit Notification - Payment Declined";  doc -> hancitor -> pony -> evilpony -> pandabanker trojan,Attachment,365
12/18/2017,Malicious email campaign morning,"12月度発注書送付"; xls -> exe -> ifsb trojan,Attachment,47
12/19/2017,Malicious email campaign morning,"Voice Message from (Outside Caller (1m <digits>s)|digits <digits>)"; 7z -> vbs -> globeimposter ransomware,Attachment,1031
12/19/2017,Malicious email campaign morning,"Your tracking information for package <digits> is available!";   doc -> hancitor -> pony -> evilpony -> pandabanker trojan,Link,1049
12/20/2017,Malicious email campaign morning,"Purchase Order <digits>"; 7z -> vbs -> globeimposter ransomware,Attachment,1042
12/21/2018,Malicious email campaign morning,"You have received a fax message"; doc -> trickbot,Attachment,9
12/22/2017,Malicious email campaign morning,"Emailing:  IMG_<digits>"; 7z -> vbs -> globeimposter ransomware,Attachment,2459
12/22/2017,Malicious email campaign morning,"Outstanding Statement"; 7z -> vbs -> globeimposter ransomware,Attachment,1963
12/26/2017,Malicious email campaign morning,"CCE26122017_<digits>"; 7z -> vbs -> globeimposter ransomware,Attachment,562
12/27/2017,Malicious email campaign morning,"Fwd: 12月度発注書送付"; xls -> urlzone,Attachment,15
12/27/2017,Malicious email campaign morning,"Invoice_<digits>"; 7z -> vbs -> globeimposter ransomware,Attachment,1598
12/27/2017,Malicious email campaign morning,"You have received a fax message"; doc -> trickbot,Attachment,4
12/28/2017,Malicious email campaign morning,"CCE28122017_<digits>"; 7z -> vbs -> globeimposter ransomware,Attachment,1909
12/28/2017,Malicious email campaign morning,"Copy_<digits>"; 7z -> vbs -> globeimposter ransomware,Attachment,742
12/29/2017,Malicious email campaign morning,"Scan"; 7z -> vbs -> globeimposter ransomware,Attachment,1268