Hancitor Sep 28

https://www.virustotal.com/file/ce65eaca0d86a6b00680e428f2901e3b4f0a822ebff39b1dfaca3c7387d9b52f/analysis/1506615030/
https://packettotal.com/cgi-bin/view-analysis.cgi?id=60a13a2402d2c907b0781dc40267bc9e

doc dl links:
http://livenrich.org.cn/vs.php?zew=
http://livenrichjuice.net/vs.php?ell=
http://livenrichjuice.info/vs.php?mvr=
http://livenrich.org.cn/vs.php?zig=

malware dl links:
http://domainedupech.com/wp-content/plugins/tinymce-advanced/1
http://domainedupech.com/wp-content/plugins/tinymce-advanced/2
http://domainedupech.com/wp-content/plugins/tinymce-advanced/3

hancitor c2:
http://renbimado.com/ls5/forum.php
http://bableftteret.ru/ls5/forum.php
http://fowastaso.ru/ls5/forum.php

pony c2:
http://renbimado.com/mlu/forum.php
http://bableftteret.ru/mlu/forum.php
http://fowastaso.ru/mlu/forum.php

evilpony c2:
http://renbimado.com/d2/about.php
http://bableftteret.ru/d2/about.php
http://fowastaso.ru/d2/about.php

zloader c2:
http://utrabbifi.com/bdl/gate.php
http://wrondintsitrom.com/bdl/gate.php

zloader rc4 key:
TyweJ848wWb7o0JfQMfY6pyd6YEp0pI2