[ikolor]

next ..

https://www.virustotal.com/en/file/0f2c ... 445443584/

[FafZee]

drop: https://www.virustotal.com/en/file/4a09 ... /analysis/
and contacts:
"id0000058.documents-ideas.pw 31.184.234.36",
"ynvdudh.msudate.pw 31.184.234.36",
"ynvdudhnyxdvqlqab.com ",
"id0000058.documents-freedom.pw 31.184.234.36",
"id0000058.pulse-manager.pw 31.184.234.36"

[EP_X0FF]

next ..

https://www.virustotal.com/en/file/0f2c ... 445443584/

bedia1.exe - MSIL/Golroted
dugefia2.exe - MSIL/Golroted
bejodea.exe.exe - MSIL obfuscated dropper-injector (zombified vbc.exe type) for modified MailPassView program.
Doc3.doc - Office macro virus O97M/Donoff
Doc5.doc - Office macro virus O97M/Donoff
Doc6.doc - Office macro virus O97M/Donoff

Thread split.