URLhaus Database

You are currently viewing the URLhaus database entry for https://unsignedonly.com/UPS-Invoices-DOCS-062K/02/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:19199
URL: https://unsignedonly.com/UPS-Invoices-DOCS-062K/02/
URL Status:Offline
Host: unsignedonly.com
Date added:2018-06-14 17:24:04 UTC
Last online:2018-09-08 08:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2018-06-14 17:25:31 UTC to abuse{at}mediatemple[dot]net)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-06-14commercial-invoice-June-06/5520.docdoc dcd709c04b716ad331777a9168f33fee4eda24422970e1765b2e5263245819d9Virustotal results 28.81% Heodo
2018-06-14ups-available-invoice-June-14-02193/0.docdoc e16b4380481e5d8036d619807927d017b7567c22029558354793e6ef64590ad8Virustotal results 26.67% Heodo
2018-06-14ups-Invoice-form-June-04-0920.docdoc 46611fba3e7dbbf390d0d5fa7b3275d471eb347391935f7e7d77cdccb5811daaVirustotal results 27.12% Heodo
2018-06-14ups-us-commercial-invoice-June-14-02821/22.docdoc fcf9ff60b9563f23d40d5f6ebe4b2e8756e3f82d014576986e0191cb38d0eb17Virustotal results 25.42% Heodo
2018-06-14ups-commercial-invoice-00712/5.docdoc b20cb16393b3369de8915bc83fa05100b1d4e70c70c59984ba9689cd20e9aa97Virustotal results 28.81% Heodo