View difference between Paste ID: WQTYQ4fY and Zgm1gybW

 *Email sample*
 
-_Subject_: Re:
+_Subject_: Payment
 
 _Body_:
 
-Dear ...:
+Dear [NAME],
 
-Please find attached our invoice for services rendered and additional disbursements in the above-
+Our records show that we have not yet received payment for the previous order #A-532173
-mentioned matter.
+Could you please send payment as soon as possible?
 
-Hoping the above to your satisfaction, we remain.
+Please find attached file for details.
 
-Sincerely,
+
-Doyle Alvarado
+Yours sincerely
-Divisional Finance Director
+Jeremy Jackson
 Operations Director (CEO Designate)
 
-In attachment a zip archive with a javascript file. No difference from previous campaign [1] spotted.
+
 In attachment a zip archive with a javascript file.
-Javascript sample - MD5: b83ef684529156e0bce902dc8da9c72e
+
-VT: 2/56 - https://virustotal.com/en/file/58854ba6819996ab0700f4ccb95ed7b8cc72ff57ac6b89f3d4c93ef6a6219d70/analysis/
+Javascript sample - MD5: b217ece3ecf33fd6fc624af5d25f0840
 VT: 1/56 - https://www.virustotal.com/en/file/a7e93e059bf53885110dddb52b5029e4e5c0b35f98ab3981a26b80a47118905d/analysis/
 
 *Compromised domains (47)*:
-akdenizozalit.com/ ixoxi
+
-allchannel.net/ lue6c4
+98.131.20.17/ o41d3
-aloprint.com/ bk0f2
+bbmarilu.it/ f7x1378
-arabian-star.com/ nay7jq7
+bbvogliadimare.it/ h573kdg
-beluxfurniture.com/ 0jcxx
+bolanoid.ru/ vjqraq
-clerici.info/ g1sd5d59
+btgnj.com/ a6308b
-depaardestal.nl/ z5htsm
+caseificiodesantis.it/ bmvl5xz
-ding-a-ling-tel.com/ bazk3kao
+centrosportivoiunco.it/ c42en
-easysupport.us/ fl85xie
+cm-seia.pt/ 0q6d4ej
-ekonova.nazwa.pl/ wc0coj
+cond.gribochechki.ru/ zibni
-ft.dol.za.pl/ ymsikgp7
+control-seduction.private.pl/ eu5c1q
-fuji-mig.com/ awcigpa1
+darts-pr.ru/ 6m5hl
-futuretech-iq.net/ koqpy
+deangelis.co.uk/ 9189x
-handicraftmag.com/ mrihc
+dice-design.com/ 9cotr5w
-heavenboundministry.com/ i7a59qj
+dugganinternational.ca/ jlv43q0
-hrlpk.com/ s5ibqz1
+edilperle.it/ b354kx0o
-hyip-all.com/ 9qwmc65
+fastmoneyloan.info/ 0h1vsa63
-iminlife.com/ cqoanbzr
+fitnesclub.ru/ oc7xhbuc
-infocuscreative.net/ didt48j
+folkchata.pl/ wmm4i0
-innatesynergy.com/ mrgdve3
+follyfoot.org/ todl3fc
-jasoncoroy.com/ szlzqni
+garnelenfarm.net/ jixh4iz
-kitchenconceptagra.com/ 5s9xb7j
+genius-versand.de/ 9kme7u
-komplettraeder-24.de/ w61qx92
+hate-metal.com/ hre8fqo
-marxforschung.de/ tt18a
+hoosiernetwork.com/ 6oa4xhk
-modelestrazackie.za.pl/ zfww8nx
+hotstreams.ru/ o1cri71
-otolocphat.com/ bv2n241r
+hudebiah.net/ uhpdylx4
-passagegoldtravel.com/ bqugo3qb
+ilbalconcino2011.it/ bzukq
-pawelbuczynski.za.pl/ z1q8u
+ingstroymash.ru/ m92xv
-percorsipsicoarte.com/ 6gz707c
+itc.slav.dn.ua/ w4b7m0
-pub-voiture.com/ dcsjrjm
+karl-lee.se/ x23ft
-racedayworld.com/ 808k8pd
+marchandedidees.fr/ o1236qw
-reginamargherita96.net/ hhtvomcw
+maydenehotelblackpool.com/ 4qjb81gs
-rzezba-bierowiec.za.pl/ y7fbo1a
+modband.com/ a4jw2if
-samrhamburg.com/ jrh9b
+mr2peter.de/ myu3a6ge
-scpremiumbikes.com/ 3y1b0n4s
+namifitnessclub.it/ c6y9dcms
-searchforamy.com/ 1fz0k9kp
+newgeneration2010.it/ cx6uxxg5
-stbb.pt/ z59ifwj
+newpark.co.uk/ 54yp9
-stckwt.net/ p4jlk
+oavb.com/ 9hh3ybox
-testfacility.awsome.pl/ zc73v
+potolok-profit.ru/ od0xz9xv
-totalsportnetwork.com/ kpbrp2mq
+redpower.com.au/ xlkdld
-ugmp.nazwa.pl/ xkhhf2n
+saintkatherine.orthodoxy.ru/ 5uj4u6
-unitedprogamers.za.pl/ ylxt67
+staffsolut.nichost.ru/ qimiiud
-vantagenetsvc.com/ a7xssz
+turniejkrzyz.za.pl/ fz0i11
-vinabuhmwoo.com/ 69udv
+uas-aas.ca/ 4bwbk5
-wasearch.us/ 6mm3hk
+usdavetrana.it/ c474o
-wbksis.com/ 5mxl28il
+vonenidan.de/ kdwytr
-yourworshipspace.com/ a3py3w
+www.johnlodgearchitects.com/ fx89v
 www.puertasjoaquin.com/ nl5tl
 
 *Sampled downloaded and decoded*:
-File Name: 1pqsLqX45.exe
+
-MD5: 0bf7315a2378d6b051568b59a7a0195a
+File Name: fksdOKooVkA.exe
-VT 7/55 - https://virustotal.com/en/file/653fb7c2c76c68d7a71307863f5025ee0f28faf850ca91e1581e3746695ecd55/analysis/
+MD5: 8137DC850A9F2593F331A149D6CC17CF
 VT 13/54 - https://virustotal.com/en/file/6f292ac37fb327ce7223f4e7d58b93f0f3038f279ac54348c2cef430aacc44d8/analysis/