2018-07-03 Hancitor Malspam

gistfile1.txt

MD5 of "invoice_<random number string>.doc: 916F1A229B73D5720AA51E596BE52EE5

Count of unique URLs in all the sample of emails:
-------------------------------------------------
8 dudz.biz
7 golfdudz.biz
5 golfdudz.com
4 johnstontrav.com
5 kickasstrophe.org
3 mmmfrecklespbctw.com
10 myidaz.com
8 positivereinforcementdogtraining.com
2 singleadultstravel.org
8 singleadulttravel.com
3 teachingpositively.com
7 thezeilerfamily.com
6 trainingpositively.com
10 victoriastilwellacademy.com
9 vspdt.net
5 vspdt.org

All links from the sample of emails:
------------------------------------
hxxp://johnstontrav[.]com/?545F=BrIyG0GNEEFSOJ0QIGYQYNCA3LUw
hxxp://golfdudz[.]com/?8JNe=FAFOUBQYGMPRBuUB0QIGYQYNCA3LUw
hxxp://vspdt[.]net/?2D1I=mT84GSk8[.]446*$550QIGYQYNCA3LUw
hxxp://johnstontrav[.]com/?5j=PBUwGOKvGAXBFSBO0QIGYQYNCA3LUw
hxxp://trainingpositively[.]com/?8K3D=FSAGJvISWD0QIGYQYNCA3LUw
hxxp://thezeilerfamily[.]com/?13Ei8=ECUB1TWyUBNXQHIANQIGG0CQi
hxxp://myidaz[.]com/?2iW8j=XVBOBGLTFOICD3QHIANQIGG0CQi
hxxp://johnstontrav[.]com/?1rIX2=mBFAYDGABO0QIGYQYNCA3LUw
hxxp://singleadulttravel[.]com/?0t=XVByVOJDGNIRVYQHIANQIGG0CQi
hxxp://trainingpositively[.]com/?6dA=XV7pGTeH[.]75199720QIGYQYNCA3LUw
hxxp://dudz[.]biz/?3r=YDIAKvBSCBfXQHIANQIGG0CQi
hxxp://vspdt[.]net/?73=AVTJFSXGBuXMZ$0QIGYQYNCA3LUw
hxxp://thezeilerfamily[.]com/?6W50r=ZJQHDBXU0QIGYQYNCA3LUw
hxxp://thezeilerfamily[.]com/?03GUg=Q][.]MlPVy[.]58306]]0QIGYQYNCA3LUw
hxxp://trainingpositively[.]com/?0zNe=FAFO3DTUD2QHIANQIGG0CQi
hxxp://vspdt[.]org/?1p2=AHPSOH0QIGYQYNCA3LUw
hxxp://teachingpositively[.]com/?6RH=FzTOFS0QIGYQYNCA3LUw
hxxp://positivereinforcementdogtraining[.]com/?4vYbd=PSm4S*lw3[.]*$93990QI
hxxp://vspdt[.]net/?5A57=UAZOG3IRTxYOmAfWQHIANQIGG0CQi
hxxp://vspdt[.]net/?5c=GFTBGWmPQASOD0QHIANQIGG0CQi
hxxp://singleadulttravel[.]com/?7tIv3=ZJa8IDd6[.]44370950QIGYQYNCA3LUw
hxxp://trainingpositively[.]com/?0I6aJ=GNVGFT?w1[.]7396640QIGYQYNCA3LUw
hxxp://dudz[.]biz/?1825e=DKTxXUD0QHIANQIGG0CQi
hxxp://golfdudz[.]biz/?3I41u=YLj8EIr7[.]44397440QIGYQYNCA3LUw
hxxp://vspdt[.]net/?4Ids2=GATDiWQHGHCU0QIGYQYNCA3LUw
hxxp://golfdudz[.]com/?67cU7=YBYFGRA(0QIGYQYNCA3LUw
hxxp://myidaz[.]com/?03Ra=YARRBSYOEFg70QIGYQYNCA3LUw
hxxp://victoriastilwellacademy[.]com/?6332J=SQGMRHGKNXQHIANQIGG0CQi
hxxp://dudz[.]biz/?3WQAv=QAUSUD1TTwGJmBSIGF0QIGYQYNCA3LUw
hxxp://thezeilerfamily[.]com/?01iS=GJQDGZCFlPBOCBfXQHIANQIGG0CQi
hxxp://myidaz[.]com/?8ZLO=FOQZYKmQV1QHIANQIGG0CQi
hxxp://vspdt[.]org/?16i=UBCUiPNz9@QHIANQIGG0CQi
hxxp://victoriastilwellacademy[.]com/?0xU4=GATDiWYKmQV1QHIANQIGG0CQi
hxxp://kickasstrophe[.]org/?42eKh=TrCKBOCRQUYA0QIGYQYNCA3LUw
hxxp://golfdudz[.]biz/?25aTY=SRTDFSmU0QIGYQYNCA3LUw
hxxp://myidaz[.]com/?8W=j7XSPIAL[.]79297800QIGYQYNCA3LUw
hxxp://singleadultstravel[.]org/?07=GIQHJTAGCVYR0QIGYQYNCA3LUw
hxxp://vspdt[.]org/?051pj=HJmPYRYK0QIGYQYNCA3LUw
hxxp://positivereinforcementdogtraining[.]com/?7szIN=mLQQ985k[.]92915730QI
hxxp://teachingpositively[.]com/?0uSE=FVSI0QIGYQYNCA3LUw
hxxp://vspdt[.]net/?18=mPUR2TUwGOQA0QIGYQYNCA3LUw
hxxp://trainingpositively[.]com/?2z3ma=RQdqXGGSz90QIGYQYNCA3LUw
hxxp://golfdudz[.]biz/?244=GRBqTOGO0QIGYQYNCA3LUw
hxxp://teachingpositively[.]com/?5iyo0=GMEH2TQzYDGJDZQHIANQIGG0CQi
hxxp://mmmfrecklespbctw[.]com/?53047=mAZOlt7m[.]48387970QIGYQYNCA3LUw
hxxp://thezeilerfamily[.]com/?01=QMCBJvCKYO0QIGYQYNCA3LUw
hxxp://dudz[.]biz/?05j4X=OzmzBS0QIGYQYNCA3LUw
hxxp://victoriastilwellacademy[.]com/?77q7=VE57]$p9[.]667]*440QIGYQYNCA3LU
hxxp://vspdt[.]org/?556y4=QQYBVS0QIGYQYNCA3LUw
hxxp://singleadultstravel[.]org/?4Eo4=UAZOG3FUVyGDV1QHIANQIGG0CQi
hxxp://dudz[.]biz/?0bHe=FPBOGBLDXUmBTRfWQHIANQIGG0CQi
hxxp://singleadulttravel[.]com/?4Ee6u=CuGyABBSQZmUVBD0QHIANQIGG0CQi
hxxp://dudz[.]biz/?6L2t3=TQUMUBNYQHIANQIGG0CQi
hxxp://victoriastilwellacademy[.]com/?260=YKBEBqBSGWGIlHHyBq0QIGYQYNCA3L
hxxp://myidaz[.]com/?7OU5=GIUCmPY1msZOD3QHIANQIGG0CQi
hxxp://vspdt[.]org/?7Po3O=YHmQY1CVUtGS0QIGYQYNCA3LUw
hxxp://vspdt[.]net/?81Q=YNQZYKRRCFQU0QIGYQYNCA3LUw
hxxp://dudz[.]biz/?8RA=BqYWIPZTTOD2QHIANQIGG0CQi
hxxp://singleadulttravel[.]com/?40DEP=UAQDY1msZOD3QHIANQIGG0CQi
hxxp://kickasstrophe[.]org/?6fAup=BOFRGKKvXUBSV2QHIANQIGG0CQi
hxxp://thezeilerfamily[.]com/?2U1c4=BOFRCK2TSICVDSD0QHIANQIGG0CQi
hxxp://victoriastilwellacademy[.]com/?2E70L=ETIKmzmv[.]55504860QIGYQYNCA3L
hxxp://vspdt[.]net/?7gYb8=UATtiyVDV2QHIANQIGG0CQi
hxxp://singleadulttravel[.]com/?0aYYe=SVZFZPZH[.]95034160QIGYQYNCA3LUw
hxxp://positivereinforcementdogtraining[.]com/?04Y=ZHmPlU0QIGYQYNCA3LUw
hxxp://golfdudz[.]biz/?8Am5=CzY1IVHHFODZQHIANQIGG0CQi
hxxp://kickasstrophe[.]org/?5lX=UzTTVyFSMDYUmsBOV1QHIANQIGG0CQi
hxxp://positivereinforcementdogtraining[.]com/?8J4=YHmQY1APD0QHIANQIGG0C
hxxp://golfdudz[.]biz/?8Va5t=YKRRKDRHBS0QIGYQYNCA3LUw
hxxp://thezeilerfamily[.]com/?4ko6x=YOl6NH8d2[.]8978500QIGYQYNCA3LUw
hxxp://positivereinforcementdogtraining[.]com/?7KID=EyFDF$56[.]97960560QIG
hxxp://victoriastilwellacademy[.]com/?34Jg=CEQHTBJDBOUyYR0QIGYQYNCA3LUw
hxxp://singleadulttravel[.]com/?6z0Y5=RQBKG0XVUOUR0QIGYQYNCA3LUw
hxxp://singleadulttravel[.]com/?1Ki=YNluMTmClPDWQHIANQIGG0CQi
hxxp://victoriastilwellacademy[.]com/?3E10s=YJYL2TCVYKNYQHIANQIGG0CQi
hxxp://golfdudz[.]biz/?8p=APEJAK0QIGYQYNCA3LUw
hxxp://myidaz[.]com/?4Uj=BsAUBRCKNYQHIANQIGG0CQi
hxxp://kickasstrophe[.]org/?7l=lQGKVZQHIANQIGG0CQi
hxxp://myidaz[.]com/?6joU=mECrGOmBNXQHIANQIGG0CQi
hxxp://trainingpositively[.]com/?64we=YFFSCAHRjG290QIGYQYNCA3LUw
hxxp://johnstontrav[.]com/?7E8V=GIlrYU0TCqXOFK0QIGYQYNCA3LUw
hxxp://victoriastilwellacademy[.]com/?8S72Y=GMZ[.]54PS[.]90816150QIGYQYNCA3L
hxxp://golfdudz[.]com/?3JJEB=BOCEYJ2LFOmBYR0QIGYQYNCA3LUw
hxxp://myidaz[.]com/?03D2o=YHiWUDmwBO0QIGYQYNCA3LUw
hxxp://positivereinforcementdogtraining[.]com/?07U=mPY1QIUtTU0QIGYQYNCA3
hxxp://positivereinforcementdogtraining[.]com/?4rE8=TEBuYJXA*[.]@0QHIANQIG
hxxp://kickasstrophe[.]org/?61EN=FTGSCQSQh44@QHIANQIGG0CQi
hxxp://victoriastilwellacademy[.]com/?34=WIEBDTNz3[.]]]81080QIGYQYNCA3LUw
hxxp://dudz[.]biz/?4VI=BFBuCSV1QHIANQIGG0CQi
hxxp://victoriastilwellacademy[.]com/?6MugU=QETtUy0DFOQzNYQHIANQIGG0CQi
hxxp://positivereinforcementdogtraining[.]com/?6f57=YBTDGWBqBOXG0QIGYQYN
hxxp://myidaz[.]com/?13V6E=QNQDFSMDmCPPFSV2QHIANQIGG0CQi
hxxp://myidaz[.]com/?24oh=jODR76VE[.]76782170QIGYQYNCA3LUw
hxxp://golfdudz[.]com/?8B723=AAWK87RL2[.]5140650QIGYQYNCA3LUw
hxxp://vspdt[.]net/?2D=VNY]50mM[.]88251830QIGYQYNCA3LUw
hxxp://golfdudz[.]com/?865=m582Szh51[.]6735380QIGYQYNCA3LUw
hxxp://golfdudz[.]biz/?5RUK=Z?Uqt8WM2[.]4883900QIGYQYNCA3LUw
hxxp://singleadulttravel[.]com/?3Z355=CQEJ0TWEFSNYQHIANQIGG0CQi
hxxp://mmmfrecklespbctw[.]com/?3NeE8=FPlSHSmB4@QHIANQIGG0CQi
hxxp://mmmfrecklespbctw[.]com/?1kll3=YCRQiWFQEGmRV1QHIANQIGG0CQi

Callbacks from maldoc:
----------------------
hxxp://api[.]ipify[.]org/ (GET)
hxxp://lingrewlighrat[.]com/4/forum[.]php (POST)
hxxp://aerotransgroup[.]com[.]au/wp-content/plugins/breadcrumbs/1 (GET)
hxxp://lingrewlighrat[.]com/mlu/forum[.]php (POST)
hxxp://aerotransgroup[.]com[.]au/wp-content/plugins/breadcrumbs/2 (GET)
hxxp://aerotransgroup[.]com[.]au/wp-content/plugins/breadcrumbs/3 (GET)
hxxp://lingrewlighrat[.]com/d2/about[.]php (POST)
hxxp://fiveamwakeupcall[.]com[.]au/wp-content/plugins/growmap-anti-spambot-plugin/2 (GET)
hxxp://lingrewlighrat[.]com/4/forum[.]php (POST)