Malware spam: "Express Parcel service" leads to Locky

This spam has a malicious attachment:

From:    Marla Campbell
Date:    19 September 2016 at 09:09
Subject:    Express Parcel service

Dear [redacted], we have sent your parcel by Express Parcel service.

The attachment includes the date and time of the arrival and the lists of the items you ordered. Please check them.


Thank you.

Attached is a randomly named ZIP file containing a malicious .js script in the format Express Parcel service ~0A1B2C~.js with a junk w file that seems to contain nothing.

The Hybrid Analysis for one sample shows a download location of:

178.212.131.10/z3zeg (21 Century Telecom Ltd, Russia)

There are probably others (I'll post them if I get them). The payload appears to be Locky ransomware, phoning home to:

195.64.154.202/data/info.php (Ukrainian Internet Names Center LTD, Ukraine)
46.38.52.225/data/info.php (TCTEL, Russia)
ajsrbomqrrlra.pw/info.php [91.223.88.209] (Private Person Anton Malyi aka conturov.net, Ukraine)

It drops a DLL with a detection rate of 8/54.

UPDATE

These Hybrid Analysis reports of other samples [1] [2] [3] [4] [5] show other download locations at:

roxieimshi.com/eppmn
roxieimshi.com/y4lf1neg
foveawaac.net/yjmaazj
foveawaac.net/wzwzjply
merofid.com/zn6mcj

All of these domains are hosted on evil IPs:

178.212.131.10 (21 Century Telecom Ltd, Russia)
91.194.250.131 (Evgeniy Zbarazhskiy aka TOV 'Dream Line Holding', Ukraine)

These domains are all related and should be considered malicious:

duelrid.com
merofid.com
pradran.com
adzebury.com
amrastacy.com
bulkreasy.com
sternhala.com
gobantakao.com
roxieimshi.com
tearyrecce.com
wyvesnarl.info
aborik.net
ecadxyst.net
maydayen.net
ponggirr.net
foveawaac.net
normadnex.net
pawlrubia.net
pradkevyn.net
satyrwelf.net
vernpucka.net
yerndrunk.net
latexuchee.net
maggycocoa.net
moismdheri.net
rokerlelia.net
sparmsov.org
citmowra.in
swagpaty.in

Recommended blocklist:
195.64.154.202
46.38.52.225
91.223.88.209
178.212.131.10
91.194.250.131

The last one listed in italics is part of the update.