URLhaus Database

You are currently viewing the URLhaus database entry for https://immoinvest.com.br:443/blog/wp-content/plugins/duracelltomi-google-tag-manager/GMD-440023/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1972618
URL: https://immoinvest.com.br:443/blog/wp-content/plugins/duracelltomi-google-tag-manager/GMD-440023/?i=1
URL Status:Offline
Host: immoinvest.com.br
Date added:2022-01-13 03:37:10 UTC
Last online:2022-01-13 12:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Status unknown
Cloudflare :Blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-01-13 03:38:48 UTC to abuse{at}amazonaws[dot]com)
Takedown time:10 hours, 4 minutes Good (down since 2022-01-13 13:43:40 UTC)
Tags:doc emotet link epoch5 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-13FV_50216.xlsmxlsm a64b918b227ae002b52f8ca07c1e57fbf11e0f6a0c5a06abbf79e2b209bce48bVirustotal results 22.22% Heodo
2022-01-13rcypkR5215.xlsmxlsm cd1b8b06a27b93f21a8da161ab4af2768ecdcbe5f8f5122d89c33caf145da46cVirustotal results 26.98% 
2022-01-13ZFZXA-03202.xlsmxlsm 07fddbd97e1846aa7ef2fae79ea0d177a89210725b1a66a8b52bb066cc36bb1eVirustotal results 23.81% Heodo
2022-01-137634SFNFT3815095.xlsmxlsm 9e443aedd2833d67bb9b858bd14abc6a235186f865e05497ac39ab8cd0185156n/a Heodo
2022-01-133842797-612886.xlsmxlsm d47dc5f481df3ec15f19e8625c29b0beaf33c401b23191b818c9ecf885e3c8dcn/a Heodo
2022-01-13NDOK75.xlsmxlsm 2b8b0ca757e3eccb527d9ce11a9a8815f5a9ce3c6d2ed5a8711d4c109e88bd71Virustotal results 22.22% Heodo
2022-01-1318_39421.xlsmxlsm ca6662f6a52a16a294b7d873a1f4b60f6ed054cb1cbaf3207081f30380c573e2n/a Heodo
2022-01-13eub_6729.xlsmxlsm ae4c37f20738b2bc766ca1b1437dd27be15c5a86e663f8ce3fc8be6762483305n/a Heodo
2022-01-134008687094.xlsmxlsm 80f7072eb1b894cec06813c3267356f693ff21d0d1f116d1cf53d5b8035277deVirustotal results 16.13% Heodo
2022-01-13301124_75.xlsmxlsm 1080082d0eec3c4e3583b6e259b0863c746d211af8a8b6b645b21059e60f1119n/a Heodo
2022-01-13304541049.xlsmxlsm c062d769449f6c74f82252e4215d23c83a360d97a7ed1b75001ba3250df330e7n/a Heodo
2022-01-137115YTBTHVI_09733.xlsmxlsm 6169a4500b717ca5de60b77b01c2c1ddf5dbe18bafd0af142248d5066eef19ecn/a Heodo
2022-01-1389733788UGRQC134.xlsmxlsm 152d0b25ca2f0f4066edf77906c112fe4e6d49c17f6fc35a039686276ad7686dn/a Heodo
2022-01-13415096334533.xlsmxlsm 967d8e1ecaddadf97ad824647e734535d41e1996b725dd594a03a043d3795b1fn/a Heodo
2022-01-138285-461887.xlsmxlsm 20d7c4f7e882c414b403403773c244fa421744c48bb9e52a2f9236825be9a76fVirustotal results 11.11% Heodo
2022-01-13s_24837.xlsmxlsm 9eb7d16794f6e4e2e701458af298b2b16c91a04dd45361cc306f32bc5fd25491n/a Heodo
2022-01-13lMH_0800.xlsmxlsm c14e76a48aa71dbc135baf60cb71367b03353dfd7e1e256ec9158c9ab9566677n/a Heodo
2022-01-13ASX_57.xlsmxlsm 37bb74fcd5b1ff6bbd323163e21277b3ed80d124cc4d727f4ec64d1048a2c85en/a Heodo
2022-01-13J-251545.xlsmxlsm ae8e1d5678b54ef2ddb35fcf1233370916f4e2355f1aeb9066b9f7e12d07bcacVirustotal results 22.95% Heodo
2022-01-13GtD53154190.xlsmxlsm e1de888c89a83b9cc12fc5432961766a1de1ad53ebd4aa7f3cda06d9c8cce841Virustotal results 22.95% Heodo
2022-01-13708506190071.xlsmxlsm 09036b169fc8beadecf559d287e1c5168598e5c8eec22cf4a095bbe16090b7acn/a Heodo
2022-01-13YkU-308.xlsmxlsm f0b437ba57fe255f0f1c67d86d32b1ff5c35dadce9eaeb5b4feea4c13aec909bn/a Heodo