March 7 2018 Emotet indicators of phishing

March 7 2018 Emotet indicators of phishing
Some of these sites came in late March 6 2018

From addresses
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

Subject
New order
Document needed
Invoice
Outstanding Invoices
Invoice receipt
Open Past Due Orders
Paid Invoice
Past Due Invoice

No payload http://www.se-beach-karting.at/Overdue-payment/
No payload http://www.cultravel.it/Invoice-Number-01350/
No payload http://стоматология-на-алексеева.рф/Service-Invoice
No payload http://rebus-metod.net/2-Past-Due-Invoices/
No payload http://автогазсервис34.рф/Summit-Companies-Invoice-483821/
No payload http://educational.academy/Sales-Invoice/

Unverified URLs
http://khabarovskstroy27.ru/Past-Due-Invoice/
http://spastikengellilerfederasyonu.com/Important-Please-Read/
http://agrologsa.com/XGT4x/
http://restaurantemexicanofrida.com/Paid-Invoices/
http://website1.italix.info/wp-content/UPS-Express-Domestic/Mar-06-18-08-48-54/

The sites below serve the same payload file, just different file names
https://www.virustotal.com/en/file/11837a032823b811d66754917b7ae99ec2315ea5b7bfd659a2c16625e94bd099/analysis/1520435368/
https://www.hybrid-analysis.com/sample/11837a032823b811d66754917b7ae99ec2315ea5b7bfd659a2c16625e94bd099?environmentId=100

Site Active file:Invoices attached.doc
http://kil-more.net/Open-Past-Due-Orders/

Site Active file:Past Due Invoices.doc
http://web-courses.com.au/Invoices-Overdue/

Site Active file:Paid Invoices.doc
http://strawberryfields.info/Invoice-Corrections-for-82746759/

Site Active file:Paid Invoice & Credit Card Receipt.doc
http://kil-more.net/Open-Past-Due-Orders/

Site Active file:Outstanding Invoices.doc
http://rkn-it.net/Invoice-for-you/

Site Active file:Outstanding Invoices.doc
http://www.stocksport-natternbach.at/Service-Report-64203/

The sites below have a different payload than the sites above
https://www.virustotal.com/en/file/9ff75bc185bcb9f01cac41dd0679cd260fea02b9145c95230e2c08c3f8bc3452/analysis/1520444572/
Site Active File:Service Invoice.doc
http://gustavorique.com.br/Invoice-for-f/l-03/07/2018/

Site ACtive File:Service Invoice.doc
http://anuradhaseneviratna.com/Outstanding-Invoices/