Hancitor UPS delivery status change phish September 26, 2017

From: UPS Quantum View Inc <[email protected]>
Subject: Delivery status change
Downloaded Document name: notice_<6 didits>.doc
Document SHA256: 8217c97d7c305c4bb07ad6696121330c4283846c5aa261a5e456f557c8b0e78c

Phishing URLs
Make note that phishing is randomizing the three XXX /print.php?XXX=
arizonadockanddoor.com/[email protected]
dockrepair.com
ladockanddoor.com
lasvegasdockanddoor.com
losangelesdockanddoor.com
phoenixdockanddoor.com
sandiegodockanddoor.com
santafespringsdockanddoor.com
tampabayblueprints.com
webphoriatech.net
webphoriatech.org
webphoriatechnologies.com
valenciadockanddoor.com
losangelesconveyor.com

C2 domains
http://rinhedtterfo.com/ls5/forum.php
http://tatoftfortwa.ru/ls5/forum.php
http://robrofrestoft.ru/ls5/forum.php

Malware Delivery URLs
http://necova.gr/wp-content/plugins/broken-link-checker/3
http://www.mutznutz.ie/wp-content/plugins/bootstrap-shortcodes/3
http://morinomiya.ac.jp/wp-content/plugins/wordpress-https/3
http://www.bestguysoncam.com/wp-content/plugins/rss_to_draft/3
http://www.businessmarketinganswers.com/wp-content/plugins/enable-site-ping-wpmu/3
http://www.icarusplays.com/Aspire_files/afxtoz/3
File1 SHA256 df20da3f0ca5b2cb62faa37e1003831b08cf94cf06282f632dcda4095fa3ab32
File2 SHA256 8262a39ab3d7c87b14abe04a8eedd82f4f3dde4c68a10409623633274a61a21d
File3 SHA256 9aa514be110555806c1b5a5b5964b09249c368209c15b5c4d90057fa979fed40