2017-09-22 Locky "Your Invoice"

2017-09-22: #locky email phishing campaign "Your Invoice # NNNNNN"

Email sample:
----------------------------------------------------------------------------------------------------------------
From: "Janie" <Janie.Hallen@vwgolfmk4.ro>
Subject: Your Invoice # 87077
Date: Fri, 22 Sep 2017 15:34:34 +0300

Your Invoice is attached. =20

If you feel you have received this email in error, please reply to this email to inform us of any necessary corrections.

Attached: Invoice_file_704037.7z -> Invoice_file_37567.vbs
----------------------------------------------------------------------------------------------------------------
- email does not contain To: header
- subject "Your Invoice # <5-6 digits>"
- attached file "Invoice_file_<5-6 digits>.7z" contains file "Invoice_file_<5-6 digits>.vbs", a VBScript downloader

Download sites:
http://aerotransfer.cl/jhdsgvc74
http://aldridgestudios.com/jhdsgvc74
http://alibristolphotography.com/jhdsgvc74
http://allesandradesigns.com/jhdsgvc74
http://amatuermatch.org/jhdsgvc74
http://amesatarragona.com/jhdsgvc74
http://ammannati.it/jhdsgvc74
http://anderlaw.com/jhdsgvc74
http://andresarlemijn.nl/jhdsgvc74
http://andza.lv/jhdsgvc74
http://animal-naturals.net/jhdsgvc74
http://antwerpiastamps.be/jhdsgvc74
http://appartement-sailer.at/jhdsgvc74
http://arc-conduite.com/jhdsgvc74
http://ar-inversiones.com/jhdsgvc74
http://arktupala.com/jhdsgvc74
http://ideathlike.net/p66/jhdsgvc74

Malware:
- locky, offline ,ykcol variant
- SHA256: 3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac, MD5: 693ef59145aa6b9e329f91538855ef64
- VT: https://www.virustotal.com/file/3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac/analysis/1506082671/
- HA: https://www.hybrid-analysis.com/sample/3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac?environmentId=100