URLhaus Database

You are currently viewing the URLhaus database entry for http://test.goodnews.org.sg/En/Invoice/Tqsz-cqW_HTqPruI-niI/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:120136
URL: http://test.goodnews.org.sg/En/Invoice/Tqsz-cqW_HTqPruI-niI/
URL Status:Offline
Host: test.goodnews.org.sg
Date added:2019-02-08 11:24:02 UTC
Threat:Malware download Malware download
Google Safe Browsing:Clean
Spamhaus DBL:Not listed
SURBL:Not listed
Reporter:@spamhaus
Abuse complaint sent (?): Yes (2019-02-08 11:36:02 UTC to noc{at}usonyx[dot]net)
Takedown time:2 hours, 5 minutes Good
Tags:emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTSignature
2019-02-08I56025741074659.docdoc 54fb9896f364fb974573b3a50a83a39171bf0a6eb8107f38c81a4b9d3b4485c3Virustotal results 33.33%Heodo
2019-02-0888036701024824142064.docdoc f1b984a7e00d7d52bfede93af0780fe115e493e35791edcda2153357fc094019n/aHeodo
2019-02-08US4916396936.docdoc 85af3bc103238b493009e9a74c161136cb2bcfe136777e704944fbdd274c2c06Virustotal results 33.33%Heodo
2019-02-08PAY8732521982319970.docdoc 42a8088d18fbf4ddb6f3c2e8aacbaea555c1be4f2cbd4161f687a6b6ee68cb49Virustotal results 33.93%