locky 10-24-17

Subject: "Scan Data"
From: documents@your domain, no-reply@your domain, copier@your domain

Sample: https://www.hybrid-analysis.com/sample/4ec8e87ab7b7e5773dea9d29da4a28cbe930f167e44426546650796c8215d886?environmentId=100
Sample: https://www.hybrid-analysis.com/sample/080ac80aa4da28f59ba7c5726dfd44f1118f1b11490147a2080992517813bccf?environmentId=100
Sample: https://www.hybrid-analysis.com/sample/9b5e1f378cbaf5d454e0f5517d342c87cd4561ef75c6ce6e980df43992aaced4?environmentId=100

#DDEAuto downloader:
hxxp://bwos.be/JHhdg33
hxxp://boydcanvas.com/JHhdg33

#pshell downloader:
hxxp://aurea-art.ru/incrHG32
hxxp://castellodimontegioco.com/incrHG32
hxxp://nl.flipcapella.com/incrHG32
hxxp://dotecnia.cl/incrHG32
hxxp://christakranzl.at/incrHG32

#locky intermediate downloader:
toundlefa.net

f62927dfc5929708672cec0c221aa876feca3b29474720cbd4f162d08439c4a7
9a91236480ecf0cb52b2d85d77e717bf673c7a2fc444527480063abcd772cd22
6a1c0e9176276220d62d979e2caaddb44c12787e5b3c2351e6a42678efeeb582