Locky "7h8gbiuomp"

2016-07-25 2nd round #locky phishing email campaign "7h8gbiuomp"

Subject:  Emailing: Document 25-07-2016, 19 91 02
Body:
---------------------------------------------------------------------------------
Your message is ready to be sent with the following file or link
attachments:

Document 25-07-2016, 46 07 70


Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments.  Check your e-mail
security settings to determine how attachments are handled.
---------------------------------------------------------------------------------
Attachment: Document 25-07-2016, 46 07 70.docm

VBA code downloads from:
http://0urkarachi.atspace.com/7h8gbiuomp
http://czemarserwis.home.pl/7h8gbiuomp
http://djk-st-arnual.de/7h8gbiuomp
http://finaledithon.web.fc2.com/7h8gbiuomp
http://r-p-b.de/7h8gbiuomp
http://tpllaw.com/7h8gbiuomp
http://vplegat.dk/7h8gbiuomp
http://www.ciapparelli.com/7h8gbiuomp
http://www.foto-aeree.it/7h8gbiuomp
http://www.gruetzi.es/7h8gbiuomp
http://www.louislechien.net/7h8gbiuomp
http://www.motoslittetrecime.com/7h8gbiuomp
http://www.sistronic.com.co/7h8gbiuomp
http://www.vakantiehuisjeameland.nl/7h8gbiuomp
http://www.westline.it/7h8gbiuomp

Malware: 3d8c754b6620c68d7c5f2bfe69a609282fc595220d7203fdaf30a9582e2882f6