Drink poison & suicide Mod for GTA SA

Author : Rakesh Nama, Lavkush

Description :

This Mod Will bring Drink poison & suicide feature to GTA SA.
To USE this Mod Simply press "G+B" to drink poison and Suicide.

How To Install :

Just Put "CLEO" Folder to Main GTA SA Folder.
This Mod Requires silent's ASi Loader.

PASSWORD : Cracking-Mods.blogspot.in

Direct Download

GTA SA Silly FART Mod by Rakesh Nama

Silly FART Mod By Rakesh Nama

DESCRIPTION

This Mod Bring Silly FART feature to GTA SA.
JUST Press "X" button on keyboard to fart.
You Can Change the key by editing "FAAART.ini" file.

INSTALLATION

Drag CLEO Folder to GTA SA Folder.
ASI Loader and CLEO 4 Needed.

PASSWORD : Cracking-Mods.blogspot.in

DIRECT DWONLOAD

AUD/USD Forex Report 30th November 2015

AUD/USD Primary Cycles

My view is that the AUD will try and continue down in 2016, however I've been looking for the AUD to move up into resistance zones before the next move downward in 2016.

The ideal move would be for the AUD to remain above .7091 and rise upwards in December and early January and then look for set-ups for the next leg downward using the 2016 50% level as resistance.

GTA V Interactive Phones For GTA SA

Author of interactive phone v2               :  Gon_Iss

Auther of GTA V Interactive Phones     :  Rakesh_nama

# Fetures of INT phone

- Call friends(Sweet,Smoke,Cesar,Ryder) for help or drink

- Internet (buy Cars, Bikes, Zero rcs & planes)
- Maps (for teleportation)
- RealTime Weather
- Music
- Settings for change themes, ringtone, widgets or language
- Camera (front and Back Camera with three vision mods)

# Installation

No Requirement for this mod !!!!!!!!!!!!
Because this mod included asi loader & modloader.
You just have to copy content from folder "to sa folder".

# HOTKEYS (Default) 

Shieft      : snapshot in the camera
Up Arrow    : get the phone, or move up the menu
Down Arrow  : remove a telephone, or a move down the menu
Right Arrow : Key to move to the right in the menu
Left Arrow  : Key to move to the left in the menu
Enter       : Select menu item
Backspace   : out of the item in the menu
"0"         : switch the track previous track.
"P"         : repeat tracks in audio player.
"I"         : shuffle tracks in audio player.
You Can Change Hotkeys by changing "INTPHONE_SETTINGS.INI" file in cleo folder.

DOWNLOAD LINKS

Download Trevor Edition
Download Franklin Edition
Download Micheal Edition

GTA SA Quick Radio Off Mod

Owner : Rakesh Nama
________________________________
>> Description
If you think turning radio off in GTA SA is very annoying, Scrolling...Scrolling...Scrolling is just a waste of time, So This Mod is Just made for You !!!!
-This mod brings Quick Radio Off Feature(like in GTA IV) to GTA SA.
-To turn off Radio Quickly just press "X" key on your Keyboard.
-you can also change key of "radio off" by editing "Quick_Radio_off.ini" in cleo Folder.
________________________________
>> How to Install ?
Just Put All Files From "TO SA Folder" To Main SA Dictionary.
________________________________
Direct Download

Best Apple Black Friday deals 2015: iPhone 6s, iPad Air, Apple watch and Macs

The Black Friday 2015 is here, so does the black Friday deals. Below we round up the best deals for apple fans, those of you who are prepare to get Apple gear. Check out this carefully to save your money.

1. Apple's first-generation Apple watch

There are not many Apple Watch discounts this year, but If you are prepared to getting one during the holiday 2015, then you should not miss this chance. Target is offering a $100 gift card when you buy an Apple Watch.

• Black Friday Price: Starts at $349, but you get a $100 Target gift card when you buy any Apple Watch.
• Normal Price: Starts at $349
• Timing: Starts Nov. 25
• Where to buy: Target, online and in stores.

Related to: Collection of Fancy Apple Watch Bands

2. Cheaper iPad Air 2
There are many deals for the iPad Air 2 this year, so pick one at the reasonable price.

Staples : 25% off, so you can find a 16GB Wi-Fi model for $374 (compared to $469) and a 64GB version for $450 (down from $550). Staples' Black Friday deals start online on Thursday, and stores open at 6 a.m. local time on Friday.
Best Buy is slashing $100 from the 16GB and 64GB iPad Air 2, and $125 on a 128GB model. Best Buy opens its doors at 5 p.m. local time on Thursday, then close Friday at 1 a.m. before opening again at 8 a.m.—or you can shop online.
Target is all about gift cards this year. When you buy an iPad Air 2, starting at $499, you'll get a free $150 Target gift card. iPad Air purchases, which start at $399, come with $100 gift cards, and the $269 iPad mini 2 comes with an $80 gift card. You can take advantage of Target's gift card offers starting Wednesday both in-store and online.
At Walmart, a gold 16GB iPad Air 2 is $399—a $100 discount. Walmart's sales kick off online at 12:01 a.m. Pacific on Thursday morning and in-store at 6 p.m. that evening—yes, right after dinner.
Related to: Wooden iPad Stand Holder

3. iMac, MacBook Air and MacBook Pro

Best Buy is selling the 11-inch MacBook Air at a $120 discount. You can get it at stores or online.

• What it is: The 11.6-inch MacBook Air with 4GB Memory and 128GB Flash Storage.
• Black Friday Price: $779
• Normal Price: $899
• Timing: Nov. 26-28

At the same time, best buy also offering a $150 discount on the 27-inch iMac , the device which features Retina 5K display, 8GB Memory, and 1TB hard drive. Black Friday Price: $1,649
MacBook Pro with Retina display at a $150 discount, now at only $1,349.
Related to: Beautiful Wooden Stand for Macbook

4. Beats headphones

Enjoy the big discount for beats headphones this year. A pair of Beats Solo2 headphones, normally $200, will be $97 at Target. Staples are selling the same pair for $132.
Beats Solo2 wireless headphones are $225 at Target, down from $300.
Powerbeats2 wireless Bluetooth earbuds, which are designed for exercising, are $100 at Best Buy, down from $200.
Staples is also offering huge discounts on Beats Executive noise-canceling headphones, at $200 compared to $300, and Studio wireless headphones, at $250 compared to $380.

5. iPhone 6s
Now Let's go to check the black Friday deals 2015 for new iphone6s.

• Best Buy: iPhone 6s and iPhone 6s Plus – purchase or lease of phone after iPhone 5 or later trade-in (guaranteed $200 Best Buy gift card)
• eBay: $819 128GB iPhone 6s (save $30)
• eBay: $719 64GB iPhone 6s (save $30)
• eBay: $629 16GB iPhone 6s (save $20)
• Target: $249.99 16GB iPhone 6s Plus with 2-year Verizon or Sprint plan (save $50)
• Target: $149.99 16GB iPhone 6s with 2-year Verizon or Sprint plan (save $50)
• Target: 64GB iPhone 6s and iPhone 6s Plus also available for discounted prices when purchased on contract
• Target: $0 down for 16GB iPhone 6s (save $50 and $250 Target gift card for well-qualified quests with installment billing activation)
• Walmart: iPhone 6s with 2-year contract AT&T and Verizon (save $100 and get $100 Walmart Black Friday Gift Card)

Related to: Collection of iPhone 6s accessories

Amazon also offers variety of deals on this black Friday, including TV, Video & Audio, camera, etc. Visit their official website to find your interesting deals.

Source from: Best Apple Black Friday deals 2015: iPhone 6s, iPad Air, Apple watch and Macs

Focuseak.com Announces Collections of Cool Apple Watch Bands and Gadgets

SHENZHEN, China, Nov. 24, 2015 /PRNewswire-iReach/ -- Focuseak.com, a popular global online store that offers gadgets at an affordable price, now announces a broad collection of hand crafted Apple Watch bands, diverse accessories and cool tech gadgets. In focuseak market, customers can easily browse by collections and shop in the fast PayPal checkout method.

Photo - http://photos.prnewswire.com/prnh/20151123/290298

Located at www.focuseak.com, you will admit it that they have created a straight forward display of their superior products. Customers can easily browse products and collections by using the categories and filter. Apart from fancy Apple Watch goodies, focuseak also helps you discover awesome cool gadgets such as wireless Bluetooth Headset, Sports Camera and Stylish Wooden Stand for iPhone, iPad and Mac, etc.              

• Apple Watch Accessories: Now you can easily customize your 38mm or 42mm Apple Watch with a variety of luxurious leathers band, stainless steel, Milanese loop bands as well as gorgeous charging stands. All of our bands are really awesome alternatives of Apple Watch bands as we're offering something that Apple is lacking of. Each bands are designed carefully to ensure the comfortable and flexible, offers at less than half Apple's prices. For more information, please visit:  http://www.focuseak.com/collections/for-apple-watch
• Bluetooth Headsets: Music is a necessity as much as breathing, eating and sleeping, sometimes even the favorite for most of we youth. So, when it comes to daily life or holiday gifts, I couldn't refrain myself from writing a gift guide about the latest headphones with solid sound quality. Yeah, the wireless Bluetooth headsets collection from focuseak is designed to look and sound great with your portable devices. They look fashionable, feel great, and are well designed.
• Sports DV Camera: The sports camera guarantees high-quality photos and videos. So you can capture every unforgettable moment and keep it forever. Get these delicate gadgets no matter for Christmas photo taking, or as festive gifts for your friends. They'll be wise choices.

Focuseak is able to offer economically priced products because they obtain their products directly from the manufacturers, eliminating third-party sources. While offering competitive price, they distribute extraordinary products. The complete line of beautiful Apple Watch bands and gadgets can be free shipped in 100% original packages. In addition, we also provide online support for express delivery like DHL UPS and FedEx.

The customer service team at focuseak is knowledgeable and friendly. Customers can receive a 7-day money back guarantee if they are not fully satisfied with their purchased products. So if you are looking for the best Apple Watch bands and electronic gadgets at reasonable price, please visit the website at focuseak.com. The company also offers a mobile version of shopping site for you to directly purchase commodities on your smartphones and tablets.

About Focuseak.com
Meet focuseak, meet surprise. Focuseak is focus on seeking the best and coolest gadgets. They are dedicated to providing a better shopping experience and variety of hot selling products at the right price. They guarantee the quality of the products.

For more information, visit:  http://www.focuseak.com

Media Contact: Katherine zhang, focuseak, +8618665976994, focuseak@yahoo.com

SOURCE FROM: Focuseak.com Announces Collections of Cool Apple Watch Bands and Gadgets

AVG Cleaner & Battery Saver PRO v2.5.1 APK

AVG Cleaner & Battery Saver PRO

Download AVG Cleaner NOW to save precious memory & space and help boost speed & performance!

• Get more space – clean junk cache files & unwanted apps
• Get more power – optimize and extend battery life
• Reduce data usage – view & remove apps by mobile data usage
• Let it run automatically – daily/weekly auto-clean

Use AVG Cleaner to monitor, erase, clear and clean junk files & unwanted apps from your device’s internal and SD card to help boost speed and make space for the apps, music & photos you really love.
Cache Cleaner:

• RAM cache processes – identify and clean up unnecessary cached RAM memory running in the background

History Cleaner:

• Browsing history – clear out the things you just don’t need like browser, clipboard, app store and email histories
• Large files – view and easily clean media files and documents larger than 5 MB
• Phone calls log – clear out long forgotten incoming, outgoing and missed calls
  App Uninstaller:
• View and receive alerts about rarely used apps by time of last use
• View and remove apps by size, battery consumption or mobile data usage

Battery Booster and Optimizer:

• Battery Saver – helps you see what’s eating up your battery life and lets you easily switch them off to save power for when you need it most
• Battery Profiles – choose between “Low Battery”, “Home”, “Office” and “Car” profiles to get your phone running the way you want

AVG Cleaner works automatically and runs routine memory cleaning so you don’t have to. Our Auto Maintenance feature runs regular cleaning of your cache, history and calls and lets you know what else you can safely remove. Just set it up to automatically run at a daily or weekly frequency depending on your usage level and available memory and space.
Get your phone tidied up and clear up space to help it run smoother and quicker and boost speed and performance. Eliminate unwanted RAM cache memory data, old browser history or call logs to make more storage space available for the apps and data you want.
Download for FREE now!
AVG Cleaner is now part of AVG Performance, our award-winning, multi-device, tuning & cleaning subscription package

How to Install?

1. Download and install apk file as usual
2. ENJOY !!

Screenshots

Downloads

AVG Cleaner & Battery Saver PRO v2.5.1  (9 MB)| Mirror

Top 3 Open Source Pinball Games

The first flipper pinball machine was released 68 years and 1 month ago and yet there is only a handful of open source, cross-platform pinball video games available! Oh well, let's take them for a spin, shall we?

UPDATE Dec 1st, 2015: 1. Added Libre Pinball, see Honorable Mentions below. 2. Added conclusion section.

UPDATE Jul 17th, 2016: Updated Emilia Pinball links

Nexus Pinball

Nova Pinball Gameplay

Started only a month ago, Nova Pinball's simple sole 2D table is a lot of fun and development has made good progress.

Emilia Pinball

Emilia Pinball Gameplay on Five Tables

The ancient 3D Emilia Pinball project has a recent fork on GitHub that adds more tables (the last official release had only 2, the new one has 5). The code is the ancient but consistent original SourceForge project and some new tables are flowing around patches/mailing list posts https://sf.net/p/pinball/

The game has 4 perspectives (F5-F8)

The models are very low-poly, which is fine and fast but the textures are sinfully low-resolution. However editing textures appears to be simple in existing tables, simply by overwriting them with higher-resolution files, as demonstrated with the angry gnu head in the screenshot above.

Creating new tables requires an editor, which I unfortunately was not able to compile yet (possibly due to lack of old Qt libraries).

Emilia Pinball Zombie Table Gameplay

There is a zombie/horror/Halloween table, which unfortunately contains non-free content.

Linball

Linball Gameplay

The 2D Linball table is crazy fast but suffers from some sounds ripped from proprietary games (maybe there's more non-free content).

Honorable mentions

Libre Pinball Gameplay

Libre Pinball (thread) is very atmospheric but has no missions and only very few table elements right now. It was made using the Godot Engine.

Sadly, Visual Pinball only runs on Windows (wine page).

Vector Pinball for Android unfortunately has no instructions for desktop/Linux compilation.

Devil's Pinball Buggy Gameplay

Devil's Pinball is a Blender-made pinball table. It's quite buggy when played in recent Blender and there is no license information.

Conclusion

I find the open pinball games on Linux more entertaining than I expected them to be. The major downside is decoration and context: while the themes of some tables are intriguing, they unfortunately exist in a widescreen world without a proper background that adds to the experience.

And of course some accessible (video) documentation on how to create new tables would be a huge plus.

Got theme ideas for open source pinball tables? Write them in the comments!

How to remove the numbers in blogger post URL's

This article looks at the numbers that are in web-page addresses created by Blogger, what they mean and how you can influence them.

When you first publish a post, Blogger assigns a permanent web-address (aka an URL or a permalink) to the post.  I've previously explained how you can control the words used in this hyperlink.

A common question from people who are researching SEO for their blog is "how do I get rid of the numbers in the post-URL?".

Unfortunately the answer is not as straighforward as most people hope for.

Numbers near the start of Blogger URLS

As described in setting the content of your post's permalink, the URL given to posts published in Blogger shows the year and month of the original publication date for the post. I think this is because Blogger was originally set up as an on-line diary, with a lot of the features organised around the post-date.

Today, there are ways of giving your blog a home page, showing your posts in pages, and changing the order of the posts, which let your blog be a lot more than a date-ordered web-log.

Some blogging software (eg Wordpress) lets you choose the structure of the URLs which are used, eg leaving the date out totally, or puting it after the words.

However Blogger does not currently have any way to remove the date-part of the post URLs. And I could be wrong, but my best guess is that this will not change anytime soon.

So what options are available to remove the year and month numbers?

If you just don't want people to know the correct month and year of the post, then you can change the date before you publish the post for the the first time. Maybe make it something non-sensical (eg 1/1/1990). (However do remember that your RSS feed will show the actual date of publication, not the assigned date).

If you have some content where any month-and-year are particularly irrelevant, put it into a Page instead of a Post - because Page URLs don't contain a date.  But remember that you need to give users a way to get to these Pages, and that remember that they are not sent out in your RSS feed, so subscribers won't see the content.

The third - and least attractive - option: is to accept that this is how Blogger works and that you need to live with it or switch to another blogging tool.

Numbers near the end of Blogger URLS

Blogger puts digits at the end of post-URLs in order to make sure that each post ever published has a unique address.

Notice that I said "ever published": if you publish a post, then delete it, and then publish a second post with the same year, month and either title or customized-URL-words, then the second post's URL will have some digits put on the end, to stop it being the same as the first one.

Once a post is published, you cannot remove the digits and keep the same words and month/year.  The only way to avoid them is to make sure that your post-URLs are unique. So if you publish a post and notice that it has digits on the end of the URL, one option is to delete that post, and replace it with one which has a different publication date or customized-URL-words(don't forget to copy the post contents before you delete it!)   Or you could just set it back to draft status, and then publish it again with different and this time unique customized-URL-words.

For example, if you publish and find that you get

www.all-about-cats.com/2012-07/vegetarian-cat-food-recipes01.html

you may want to delete the post, and republish the content in a post with a different date like

www.all-about-cats.com/2012-06/vegetarian-cat-food-recipes.html

Does it really matter?

Personally I'm not convinced that having numbers in Blogger URL's is a problem.

If the content is so weak, and poorly linked to by other sites and social media that the presence of numbers in the URL is affecting visitor numbers, then it seems to me that there are more important things for you to be worrying about.

On the other hand, if your blog is already popular and well-optimized, and you're looking to get the last possible bit of SEO benefit - you'd be better off using your time to write even more good quanlity, unique, content so that your exisiting subscribers visit more often, instead of fussing over something that you cannot control.

Or am I mistaken?

---

Related Articles

Setting the custom-URL for a blog post

Giving your blog a home page

Putting Blogger posts into pages

How to set the date for a post

The difference between Posts and Pages

What is RSS and why it matters for bloggers

Removing a post from your blog

Copy the contents between blog posts - and keep all the formatting.

5 best third party apple watch stainless steel bands That Suit Your Style

On Monday, we have written an article about the best third party apple watch leather bands, and today we will introduce the 5 best third party apple watch stainless steel bands. All of them feature high quality and unique design. Pick one for you as your Christmas gift.

1. Stainless Steel Band for Apple Watch by Hoco

Now you can easily add some elegance and beauty to your Apple Watch with the Hoco Stainless Steel Band. And if you are looking for the most fashionable stainless steel band for Apple Watch, I will firstly recommend this. Thanks to its 316 stainless steel, this watch band is the ideal mix of elegance and strength, and the polished black color makes it look even better.
This band is perfect for 38mm or 42mm of Apple Watch Sport, Apple Watch, Apple Watch Edition and comes with 3 colors: space grey (Black), Gold and Rose gold.

2. Hoco Slim Apple Watch Band

According to the Hoco official, this bands thickness is only 0.2mm. Made of a premium stainless steel, this band feels smooth and uses a dual folding clasp in the middle for easy installation and removal. Great match with the Apple Watch

3. Hoco Milanese Loop Stainless Steel Band

If you are looking for a perfect metal strip band for your Apple Watch to make yourself look different in the crowd, Hoco Milanese’s wrist loop band is a perfect pick for you.

Unlike Apple official, The Milanese loop mesh from Hoco let you have multi choice: Silver, Black, and Gold. There aren't any gaps in the connections and the magnet is incredibly strong. And because it’s fully magnetic, the Milanese Loop is infinitely adjustable, ensuring a perfect fit.

4. Hoco Butterfly Lock Link Bracelet Stainless Steel Band

We would admit that the stainless steel Link Bracelet is one of the nicest looking Apple Watch bands available, but it is really really expensive for $449 price. So here we recommend Hoco third party link bracelet which sells at only $79.99.

Crafted from the same 316L stainless steel alloy used for the Apple Watch, the Hoco band features a matte surface, more attractive and comfortable. It is Easy to install and take off, so feel free to get the stainless steel link bracelet band that your Apple Watch truly deserves. This link bracelet only suit for apple watch 42mm version temporally.

5. HOCO Stainless Steel Strap Buckle Band [5 Pointer Edition]

With an elegant finish and secure folding, this is said to be the best in the list by most of the customers. The sleek design and some pure combination of colors make it even better.

For those who love to stay updated with the latest fashion trends and want to outclass others, this would be perfect pick for you.

Above is the collection of 5 best apple watch stainless steel band 3rd party which offers at reasonable price. All of these Aftermarket apple watch stainless steel bands are made of high quality. If you have any question, welcome to contact us online.

Source from:  5 best third party apple watch stainless steel bands That Suit Your Style

A close look at real-life pictures of Hoco Hermes Apple Watch bands

Last month, we announced the luxury Hoco Hermes apple watch bands and it soon becomes the top selling items in our store. The Hermès Apple Watch bands includes 3-in-1 bands bundle which features the three styles: Single tour, double tour extra-long band and cuff band.

And now lots of buyers all round the world gradually received their package and showed the image with us, so below we will show you all kinds of real-life photos with Hermes look for apple watch. And welcome to check our collection of best third party apple watch bands.

1. Package of Hoco 3in1 hermes bands

2. Single Tour

3. Double Tour

4. Cuff

The Hoco Hermes leather bands fit for Apple Watch & Sport & Edition Version 38mm/42mm. You can enjoy 3 different bands which is around $20 for each that let you achieve the same basic look with genuine leather. It is in stock now and we support worldwide free shipping.

You may also like: HOCO Stainless Steel Band Strap

Welcome to follow us via:

Source from: A close look at real-life pictures of Hoco Hermes Apple Watch bands

Top 5 best Third Party apple watch leather bands and straps

The luxurious apple watch leather bands from official are simple and best, but cost us about $150. And now you can find a wide variety of styles, colors, and clasps for both 42 mm and 38 mm Apple Watch sizes in the market. So today we round up the 5 best third party apple watch leather bands and straps for your easy choose to save money. These well-designed and sweet bands fit for Apple Watch & Sport & Edition Version 38mm/42mm.

1.  Hoco Hermes Apple watch bands
We put this Hoco Hermes Apple watch bands at the first place due to it comes 3-in-1 bands bundle. That is to say, the package combines Single tour, Double Tour and cuff bands. The leather is really nice and adapters are well-polished.

We have written an article about How to get Hermès look with third party apple watch Hermès bands.


2.  Baseus Modern apple watch leather bands

Baseus Modern Luxury band has been made with quality leather. It is durable, simple in style and features pure steel buckle. The leather band is available in 3 colors, which are red, black and khaki. Red color is perfect for girls. You can now personalize your Apple Watch by replacing the original band.

3.  Jisoncase Retro Premium Leather Bands

This Jisoncase Wrist Band for Apple Watch is made from premium Leatherette. Precise cut holes on the Apple leather band to fit well for most wrist, standard length just as Apple's original ones. This band comes in black, brown and red colors.

4.  Benks Cowhide Leather Strap Replacement Buckle

The Benks cowhide leather strap features a simple design and comes with 2 colors: Black and Brown. If you are looking for one band that make your Apple Watch just a little more classic, then you can’t miss this. The bands come with the stainless steel attachments and provides long service life.

5.  Hoco Classic Leather Replacement Strap

This watch band has been made with soft genuine leather. With good looking appearance coupled with classic finish, it would make an appreciable profile with Apple Watch. The quality of material makes it very durable.
It’s comfortable to wear. Pick up this watch band, if you wish to give your Watch a formal look.

All the third party apple watch bands we listed above are fit for Apple Watch & Sport & Edition Version 38mm/42mm. So pick your favorite one.

Source from:  Top 5 best Third Party apple watch leather bands and straps

More ransomware shenanigans

Recently, an update of the infamous CryptoWall ransomware (or cryptoware) was released - you can read more about that particular ransomwere here: CryptoWall 4.0 released with new Features such as Encrypted File Names

Additionally, another ransomware variant has made a return, read more about that one here:
“Offline” Ransomware Encrypts Your Data without C&C Communication

And let's not forget about this one either: Chimera Ransomware focuses on business computers

Did I mention yet there's ransomware for Linux as well? Have a look at Linux.Encoder.1 while you're at it.

... But wait, there's more! You've guessed it, yet another ransomware variant has returned. I wonder what's going on these days, the (cyber)criminals seem to get even more competitive.

Lawrence Abrams over at Bleeping Computer recently wrote an article about the variant we have here as well, as we have caught an updated variant of Poshcoder or Poshkoder or Power Worm:
Shoddy Programming causes new Ransomware to destroy your Data


Moving on to the infection vector and process:

Kan du kontrollera den bifogade filen och låt mig veta vad du tycker? Tack

I just got this document, could you please check it and get back to me? Thanks

Email headers indicate:
Received: from techdallas.xyz (45.63.12.192.vultr.com [45.63.12.192])

45.63.12.192 - IPvoid - Whois

IP location: United States (VirusTotal)

Attached is a file called Bilaga.doc or Document.doc. Other variations are possible, depending on the language (in this case either Swedish or English).

Let's see what's inside Bilaga.doc:

Ole10Native is in fact a VBS file

As you can see, there's an ObjectPool present, containing an Ole native file. The former contains storages for embedded OLE objects. In this case, it's containing a VBS file: 

The VBscript uses Powershell with certain flags or parameters to download a file to the %TEMP% folder and execute it:

(Note that by default PowerShell is configured to prevent the execution of PowerShell scripts on Windows systems)

• -WindowStyle hidden: don't display anything to the user (set WindowStyle as hidden)
• -ExecutionPolicy Bypass: no scrips are blocked, neither are there any warnings or prompts
• -nologo: starts the PowerShell console without displaying the copyright banner
• -noprofile: tells PowerShell to not load profile (user) scripts

You can find a tad more information on these commands here.

But what is the user seeing? Opening the Word document, there's another, clickable 'document': 

Clicking the icon, warning message from Word

Decoy message

Then nothing happens, except in the background:

PowerShell download & running the malware

Another PowerShell script (.ps1 file) is being executed, which will start encrypting files with the following extensions:

"*.pdf","*.xls","*.docx","*.xlsx","*.mp3","*.waw","*.jpg","*.jpeg","*.txt","*.rtf","*.doc","*.rar","*.zip","*.psd","*.tif","*.wma","*.gif","*.bmp","*.ppt","*.pptx","*.docm","*.xlsm","*.pps","*.ppsx","*.ppd","*.eps","*.png","*.ace","*.djvu","*.tar","*.cdr","*.max","*.wmv","*.avi","*.wav","*.mp4","*.pdd","*.php","*.aac","*.ac3","*.amf","*.amr","*.dwg","*.dxf","*.accdb","*.mod","*.tax2013","*.tax2014","*.oga","*.ogg","*.pbf","*.ra","*.raw","*.saf","*.val","*.wave","*.wow","*.wpk","*.3g2","*.3gp","*.3gp2","*.3mm","*.amx","*.avs","*.bik","*.dir","*.divx","*.dvx","*.evo","*.flv","*.qtq","*.tch","*.rts","*.rum","*.rv","*.scn","*.srt","*.stx","*.svi","*.swf","*.trp","*.vdo","*.wm","*.wmd","*.wmmp","*.wmx","*.wvx","*.xvid","*.3d","*.3d4","*.3df8","*.pbs","*.adi","*.ais","*.amu","*.arr","*.bmc","*.bmf","*.cag","*.cam","*.dng","*.ink","*.jif","*.jiff","*.jpc","*.jpf","*.jpw","*.mag","*.mic","*.mip","*.msp","*.nav","*.ncd","*.odc","*.odi","*.opf","*.qif","*.xwd","*.abw","*.act","*.adt","*.aim","*.ans","*.asc","*.ase","*.bdp","*.bdr","*.bib","*.boc","*.crd","*.diz","*.dot","*.dotm","*.dotx","*.dvi","*.dxe","*.mlx","*.err","*.euc","*.faq","*.fdr","*.fds","*.gthr","*.idx","*.kwd","*.lp2","*.ltr","*.man","*.mbox","*.msg","*.nfo","*.now","*.odm","*.oft","*.pwi","*.rng","*.rtx","*.run","*.ssa","*.text","*.unx","*.wbk","*.wsh","*.7z","*.arc","*.ari","*.arj","*.car","*.cbr","*.cbz","*.gz","*.gzig","*.jgz","*.pak","*.pcv","*.puz","*.r00","*.r01","*.r02","*.r03","*.rev","*.sdn","*.sen","*.sfs","*.sfx","*.sh","*.shar","*.shr","*.sqx","*.tbz2","*.tg","*.tlz","*.vsi","*.wad","*.war","*.xpi","*.z02","*.z04","*.zap","*.zipx","*.zoo","*.ipa","*.isu","*.jar","*.js","*.udf","*.adr","*.ap","*.aro","*.asa","*.ascx","*.ashx","*.asmx","*.asp","*.indd","*.asr","*.qbb","*.bml","*.cer","*.cms","*.crt","*.dap","*.htm","*.moz","*.svr","*.url","*.wdgt","*.abk","*.bic","*.big","*.blp","*.bsp","*.cgf","*.chk","*.col","*.cty","*.dem","*.elf","*.ff","*.gam","*.grf","*.h3m","*.h4r","*.iwd","*.ldb","*.lgp","*.lvl","*.map","*.md3","*.mdl","*.mm6","*.mm7","*.mm8","*.nds","*.pbp","*.ppf","*.pwf","*.pxp","*.sad","*.sav","*.scm","*.scx","*.sdt","*.spr","*.sud","*.uax","*.umx","*.unr","*.uop","*.usa","*.usx","*.ut2","*.ut3","*.utc","*.utx","*.uvx","*.uxx","*.vmf","*.vtf","*.w3g","*.w3x","*.wtd","*.wtf","*.ccd","*.cd","*.cso","*.disk","*.dmg","*.dvd","*.fcd","*.flp","*.img","*.iso","*.isz","*.md0","*.md1","*.md2","*.mdf","*.mds","*.nrg","*.nri","*.vcd","*.vhd","*.snp","*.bkf","*.ade","*.adpb","*.dic","*.cch","*.ctt","*.dal","*.ddc","*.ddcx","*.dex","*.dif","*.dii","*.itdb","*.itl","*.kmz","*.lcd","*.lcf","*.mbx","*.mdn","*.odf","*.odp","*.ods","*.pab","*.pkb","*.pkh","*.pot","*.potx","*.pptm","*.psa","*.qdf","*.qel","*.rgn","*.rrt","*.rsw","*.rte","*.sdb","*.sdc","*.sds","*.sql","*.stt","*.t01","*.t03","*.t05","*.tcx","*.thmx","*.txd","*.txf","*.upoi","*.vmt","*.wks","*.wmdb","*.xl","*.xlc","*.xlr","*.xlsb","*.xltx","*.ltm","*.xlwx","*.mcd","*.cap","*.cc","*.cod","*.cp","*.cpp","*.cs","*.csi","*.dcp","*.dcu","*.dev","*.dob","*.dox","*.dpk","*.dpl","*.dpr","*.dsk","*.dsp","*.eql","*.ex","*.f90","*.fla","*.for","*.fpp","*.jav","*.java","*.lbi","*.owl","*.pl","*.plc","*.pli","*.pm","*.res","*.rsrc","*.so","*.swd","*.tpu","*.tpx","*.tu","*.tur","*.vc","*.yab","*.8ba","*.8bc","*.8be","*.8bf","*.8bi8","*.bi8","*.8bl","*.8bs","*.8bx","*.8by","*.8li","*.aip","*.amxx","*.ape","*.api","*.mxp","*.oxt","*.qpx","*.qtr","*.xla","*.xlam","*.xll","*.xlv","*.xpt","*.cfg","*.cwf","*.dbb","*.slt","*.bp2","*.bp3","*.bpl","*.clr","*.dbx","*.jc","*.potm","*.ppsm","*.prc","*.prt","*.shw","*.std","*.ver","*.wpl","*.xlm","*.yps","*.md3","*.1cd"

As you can see, it has covered quite a lot of extensions. Nathan Scott from Bleeping Computer provided an image with a great explanation on what the script does:

(Source)

In the version I saw, the PowerShell scripts were slightly different, in fact an 'improved version'.

After encrypting all your files, it will drop an HTML file (named DECRYPT_INSTRUCTION.html) on the root of all your folders which contains the following message:

Ransom message - you may need to pay up to $ 1000

It generates your #UUID by the following simple PowerShell command:

Get-wmiobject Win32_ComputerSystemProduct UUID

When visiting said Onion (Tor) link:

Unlock message

Difference here from the version of October is that they also offer to decrypt 1 file, as proof they can actually decrypt all your files again. Unfortunately, the encryption fails horribly (for example, no extension is appended) and your files will be unrecoverable. For more information, see here.

Prevention

• Don't open attachments from unknown senders - ever.
• Install an antivirus and keep it up-to-date and running. Enable the option to scan Compressed Files. 
• Consider disabling Windows Script Host. You can use my tool, Rem-VBSworm with option D for example.
• Alternatively, you can install Analog X's Script Defender, which will block these scripts (JS, VBS, ...) as well.
• Consider disabling PowerShell if you don't need or use it. There are two possible options:
  
  
  
  Note that if you have a company laptop, you should inform with your network administrator first.
• Improve security for your Microsoft Office package. (Word, Excel, ...)
  This means disabling ActiveX, disabling macros and blocking external content. Useful links:
  Enable or disable ActiveX controls in Office documents
  Enable or disable macros in Office documents
  Block or unblock external content in Office documents
• As with all ransomware cases: take backups!

Some time ago, I did a Q&A on ransomware, which also included several general tips on how to prevent (ransomware and other) malware. You can find and read those tips here.




Disinfection

• Identify and kill malicious processes (use Task Manager for example). In this specific case:
  winword.exe, wscript.exe, powershell.exe
• Run a full scan with your installed antivirus product.
• Run a full scan with another antivirus and/or antimalware product.
• In a company: unplug your network cable & warn your network administrator immediately!

Conclusion

Ransomware is far from dead (that is, encrypting ransomware or cryptoware, the "old" ransomware isn't very much around anymore), thus it's important to take preventive measures as outlined above.

You may find IOCs (Indicators Of Compromise) as usual on AlienVault's OTX.

Resources

Bleeping Computer - Shoddy Programming causes new Ransomware to destroy your Data

Microsoft - More Powerful Ways to Launch Windows PowerShell

Microsoft - Object Linking and Embedding (OLE)

Microsoft - ObjectPool Storage

Sophos - Russian ransomware takes advantage of Windows PowerShell

SS64 - An A-Z Index of Windows PowerShell commands 

Trend Micro - Ransomware Now Uses Windows PowerShell 

Acknowledgments

Thanks to my colleague Ville from Panda Security Sweden for alerting me about this incident and Lawrence & Nathan over at Bleeping Computer for their already available information.