View difference between Paste ID: p1FzZ36E and Zgm1gybW

 *Email sample*
 
-_Subject_: Re:
+_Subject_: Updated
 
 _Body_:
 
-Dear ...:
+Dear [NAME],
 
-Please find attached our invoice for services rendered and additional disbursements in the above-
+Attached please find the documents you requested..
-mentioned matter.
+
 
-Hoping the above to your satisfaction, we remain.
+
 King regards
-Sincerely,
+Kaitlin Walton
-Doyle Alvarado
+Financial Director - Multinational Group
-Divisional Finance Director
+Mon, 27 Jun 2016 20:16:52 -0200
 
 
-In attachment a zip archive with a javascript file. No difference from previous campaign [1] spotted.
+In attachment a zip archive with a javascript file.
 
-Javascript sample - MD5: b83ef684529156e0bce902dc8da9c72e
+Javascript sample - MD5: 37897ae64a236238d7eaf00021b78849
-VT: 2/56 - https://virustotal.com/en/file/58854ba6819996ab0700f4ccb95ed7b8cc72ff57ac6b89f3d4c93ef6a6219d70/analysis/
+VT: 4/55 - https://www.virustotal.com/it/file/e52bcee840a8e6270a25d6e9a93984409e29a9e84970f105e99960ce9d2910d7/analysis/
 
 *Compromised domains (47)*:
 
-akdenizozalit.com/ ixoxi
+933666.net/ 7q4e3lyp
-allchannel.net/ lue6c4
+addonworks.com/ ncwx0b
-aloprint.com/ bk0f2
+allchannel.net/ nk5jbh
-arabian-star.com/ nay7jq7
+aloprint.com/ f216w5
-beluxfurniture.com/ 0jcxx
+apotekroxy.com/ slc93v1
-clerici.info/ g1sd5d59
+asliaypak.com/ 355ip
-depaardestal.nl/ z5htsm
+bani-shehr.org/ fzvog
-ding-a-ling-tel.com/ bazk3kao
+cnn-generics.com/ k0m9wru
-easysupport.us/ fl85xie
+cond.gribochechki.ru/ 3sh2zhp
-ekonova.nazwa.pl/ wc0coj
+easysupport.us/ i62i9r
-ft.dol.za.pl/ ymsikgp7
+ecomuseedelau-dela.net/ w2mb4
-fuji-mig.com/ awcigpa1
+empiredeckandfence.com/ x0xio
-futuretech-iq.net/ koqpy
+fitmag.org/ sts28g
-handicraftmag.com/ mrihc
+fpg.com.my/ t5dsdw
-heavenboundministry.com/ i7a59qj
+fuji-mig.com/ drl01
-hrlpk.com/ s5ibqz1
+futuretech-iq.net/ n9x1p2b4
-hyip-all.com/ 9qwmc65
+handicraftmag.com/ sriu1n1f
-iminlife.com/ cqoanbzr
+hrlpk.com/ soaoxmo8
-infocuscreative.net/ didt48j
+hudebiah.net/ ibmw1psh
-innatesynergy.com/ mrgdve3
+hyip-all.com/ b42yt4a
-jasoncoroy.com/ szlzqni
+iminlife.com/ ggu0m1s
-kitchenconceptagra.com/ 5s9xb7j
+infocuscreative.net/ i1paaw59
-komplettraeder-24.de/ w61qx92
+ingstroymash.ru/ al8z1
-marxforschung.de/ tt18a
+innatesynergy.com/ sjkxwu
-modelestrazackie.za.pl/ zfww8nx
+innogenap.com/ tyob8uor
-otolocphat.com/ bv2n241r
+livecamstrippers.com/ 4y98s3ha
-passagegoldtravel.com/ bqugo3qb
+olgastudio.ro/ zw0g38
-pawelbuczynski.za.pl/ z1q8u
+pakar.com.my/ waohxzq
-percorsipsicoarte.com/ 6gz707c
+passagegoldtravel.com/ ffi5dton
-pub-voiture.com/ dcsjrjm
+potolok-profit.ru/ maill2sw
-racedayworld.com/ 808k8pd
+pub-voiture.com/ hvik6d
-reginamargherita96.net/ hhtvomcw
+racedayworld.com/ 86ks8fhf
-rzezba-bierowiec.za.pl/ y7fbo1a
+sevvalsenturk.com/ 41l8xj
-samrhamburg.com/ jrh9b
+srilaktours.com/ 3sh2zhp
-scpremiumbikes.com/ 3y1b0n4s
+subang.go.id/ ui64jy0
-searchforamy.com/ 1fz0k9kp
+summasolution.net/ t12u2h
-stbb.pt/ z59ifwj
+systemalu.com/ he9g1
-stckwt.net/ p4jlk
+techproconsult.com/ m2q3u
-testfacility.awsome.pl/ zc73v
+titaniumequities.com/ t44df6bl
-totalsportnetwork.com/ kpbrp2mq
+totalsportnetwork.com/ niohzxc
-ugmp.nazwa.pl/ xkhhf2n
+u-flats.com/ 3q55hs7c
-unitedprogamers.za.pl/ ylxt67
+vantagenetsvc.com/ bbeleqj9
-vantagenetsvc.com/ a7xssz
+vinabuhmwoo.com/ 9w9pgdi
-vinabuhmwoo.com/ 69udv
+wbksis.com/ 5r167if
-wasearch.us/ 6mm3hk
+webcam-newzealand.info/ 7ikowb
-wbksis.com/ 5mxl28il
+williamsbreak.com/ vvekuwj
-yourworshipspace.com/ a3py3w
+yourworshipspace.com/ aj33f
 
 *Sampled downloaded and decoded*:
 
-File Name: 1pqsLqX45.exe
+File Name: u9U6k2s20gNVR.exe
-MD5: 0bf7315a2378d6b051568b59a7a0195a
+MD5: 24729418d1cc26644c2aac3144946857
-VT 7/55 - https://virustotal.com/en/file/653fb7c2c76c68d7a71307863f5025ee0f28faf850ca91e1581e3746695ecd55/analysis/
+VT 15/56 - https://www.virustotal.com/it/file/927045894644c63d2df702ca6121fd6d3464fd5efd661d91726d6e3e662e9a49/analysis/