2019-03-19 Trickbot IOCs

I received about 25 emails with the following Word document attached:

Word Document named:
713-288-4192.doc
61f1a99292a199f867b168b76fc8cc74

When opened, Word prompts to activate an ActiveX object.
After allowing it, a script in the document calls out to:
http://pastebin.com/raw/nQ4yJ47k

The resulting payload is Trickbot.