New Locky distribution sites - 28/06/2016

*Email sample*

_Subject_: report

_Body_:

Hi [NAME],

Ive attached the report you asked me to send.


Regards

Dee Christensen
Director, Digital Communications


In attachment a zip archive with a javascript file.

Javascript sample - MD5: 2D122C016B7D9EC8D9F76045B893AD87
VT: 4/56 - https://www.virustotal.com/it/file/0540242952c50991f91a2b45af1d3cd089a83a2827d3e1ad83298d0cdfccafb5/analysis

*Compromised domains (44)*:

300tomoli.it/ j8m7ktu
4k18.com/ dfg4ad
adbm.co.uk/ q2bmmhz
atlantaelectronics.co.id/ xe1370n
bbmarilu.it/ hkl9d
bbvogliadimare.it/ il4cc3e
bibliadarkorbit.za.pl/ i59j41zo
bisericaromaneasca.ro/ trslckn
bobbysinghwpg.com/ x42honx
bordur32.ru/ re23zcb7
centrosportivoiunco.it/ e8uxd
certifiedbanker.org/ qjxfba
cond.gribochechki.ru/ 1vmcl8l
depaardestal.nl/ 3vfr61
dobramu.za.pl/ 4pc3kd9p
dragon.obywateleuropy.eu/ 4u22bfst
dugganinternational.ca/ ksx6dv7
edilperle.it/ d1mys2g
euro-support.be/ xaf5349p
focolareostuni.it/ oqtkiw
ft.driftactive.za.pl/ 7b03ffv
fuckcraft.xorg.pl/ 8cn8zeo
hate-metal.com/ kgp8v
hudebiah.net/ nskx4
ilbalconcino2011.it/ e4ao4kky
ingstroymash.ru/ cwiivhxu
jd-products.nl/ t57vc86
marxforschung.de/ 0e7ac
mr2peter.de/ o5ci15o
mycreativeprint.com/ w3d7z6
namifitnessclub.it/ f6hi6k
newgeneration2010.it/ gupwqe1
potolok-profit.ru/ q39aie
sprintbus.com.pl/ 9h7b0qnx
staffsolut.nichost.ru/ jwz8i9
stbb.pt/ 40gnvp9a
tanie-pranie.za.pl/ 9e607
tip.ub.ac.id/ v9wcojln
turniejkrzyz.za.pl/ he2013lf
usdavetrana.it/ dn81o
vonenidan.de/ m3mmis
www.centroinfantilelmolino.com/ qtuuvm2
www.johnlodgearchitects.com/ haqew
www.pececitos.com/ 9ehkrke

*Sampled downloaded and decoded*:

File Name: CJCjEAwT.exe
MD5: 3CF3E98A804A99F9BE9EF850A7C568B3
VT 10/56 - https://www.virustotal.com/it/file/d636c3aa1179e8eb4494fa0aa9549d78a02c5bf75e4d23c312d431e228c8ed9a/analysis