URLhaus Database

You are currently viewing the URLhaus database entry for http://decowelder.ru/sec.myaccount.docs.biz/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:122144
URL:http://decowelder.ru/sec.myaccount.docs.biz/
URL Status:Offline
Host:decowelder.ru
Date added:2019-02-12 01:11:29 UTC
Threat:Malware download Malware download
Google Safe Browsing:Clean
Spamhaus DBL:Not listed
SURBL:Not listed
Reporter:@Cryptolaemus1
Abuse complaint sent (?): Yes (2019-02-12 01:12:21 UTC to abuse{at}hoster[dot]by)
Takedown time:6 hours, 30 minutes Good
Tags:doc emotet epoch1 heodo

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTSignature
2019-02-12eINVOICE_201902126776924.docdoc1a6e50247910449b0a02c6983682ca67c7262e4293c447d1c0f9fd4912176e2fVirustotal results 14 / 58 (24.14)Heodo
2019-02-12eBILL_02_12_195128328.docdocb708e0ef4541dbc50a5360b6da580434dc397506e86f2e7b045cb61577182d8dVirustotal results 15 / 57 (26.32)
2019-02-12eINVOICE_021220194347.docdoccbb21f7231c61582c3d30d0643b1bda8fe2cf5139ab06359d04ce87ed666a0c1n/aHeodo
2019-02-12eFile_02122019032193.docdoc39ac97bb4bf0cae5e73a9c6b44d4b54de204d1a190849fd251c2e082108fa297n/aHeodo
2019-02-12eBill_021220197149.docdoc620e8be300be6caa415fab883a0180b22b97f7f9108b4a18dd7baf32ce4bbb54Virustotal results 17 / 54 (31.48)
2019-02-12eFile_02122019258824.docdoc9cd8bc71cc176edfa223aa1ae6d9ca8c917c95b7c9622866982559e144006190n/aHeodo
2019-02-12eFORM_02_12_198667.docdoc8a7305c21575ec7bda6e5381a7cefa0ff8b25821b3e2642c54cb3990c5f9ced7n/aHeodo
2019-02-12eINVOICE_02_12_1940327.docdocfe297945fd02b6ce9bf4acc5f7f06e1055fb8b524731bb322acccb32034aa6c6Virustotal results 16 / 50 (32.00)Heodo
2019-02-12eform_201902129910.docdoc63fa99785856e6660f75519e8d9ddc46cd7a3616625182d5b08e0306e64e0405n/aHeodo
2019-02-12eFORM_201902123334.docdoc32521609ae00f63202449b0ee69bebc73308f9799bcb4b257dc8847efc508fe3n/aHeodo
2019-02-12eFile_20190212841134.docdoc406c40303d418ee6b2ff61301532d451ab00fb5d644968d46498296268f5ee11Virustotal results 17 / 54 (31.48)Heodo
2019-02-12eFile_0212201986021.docdoc6c26b4d79020ebb8153df783d36010f8b5e1fd3f76baf1a3e3c0f08d6f11b756n/aHeodo
2019-02-12eFILE_201902123536315.docdoce59ed25746b3cb969a3c002003a22c7a216322bba8c967d79a3ffb0463f2fd90Virustotal results 16 / 54 (29.63)
2019-02-12eform_201902124544.docdoc5acdd8044287ccf56da2c17461257d54e31b6df03fc9bb3ba0a2a4e20468731an/aHeodo
2019-02-12eBILL_2019021243772.docdoc275e761bfcb70339ab38973e4c0595fd6e2e5f1a0b87102ae1277c5b00a476b1n/aHeodo
2019-02-12eINVOICE_021220193239.docdocc6ae823e7874e134cb64857b9d5ffc1786f2033582238085ade72b1be67ff6f9Virustotal results 11 / 49 (22.45)Heodo