emotet 2017-12-05

#emotet
0901ac61da3981fbb9d187065072b203
Invoice #0450032312.doc

Macro runs VBA.shell command

That command contains these urls in it
http://narcoticosanonimosbolivia.org/vljtyr/
http://whiteelephanttech.com/kc/
http://cualcrisis.com/boJ/
http://lovesea.pl/VZRragm/

which all lead to this file
792c0af01d9eec3baf85baecd0735ff0