locky 10-24-17

Subject "Your Invoice NNNNNN"

VT: https://www.virustotal.com/#/file/ea77730c72da80c9f375b8474ff73af189429a0d1e4b92c6af7341391f73edae/detection
Sample: https://www.hybrid-analysis.com/sample/ea77730c72da80c9f375b8474ff73af189429a0d1e4b92c6af7341391f73edae?environmentId=100

#DDEAuto downloader:
transmercasa.com/JHGGsdsw6
urcho.com/JHGGsdsw6
upgrademypc.ie/JHGGsdsw6

#pshell downloader:
hxxp://tatianadecastelbajac[.]fr/kjhgFG
hxxp://video.rb-webdev[.]de/kjhgFG
hxxp://themclarenfamily[.]com/kjhgFG

#locky intermediate downloader:
gdiscoun.org

#.enc post / check-in
webhotell.enivest.no