URLhaus Database

You are currently viewing the URLhaus database entry for http://castlenkings.com/wp-includes/CFpH_1214/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1974526
URL: http://castlenkings.com/wp-includes/CFpH_1214/?i=1
URL Status:Offline
Host: castlenkings.com
Date added:2022-01-13 18:05:04 UTC
Last online:2022-02-07 02:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-02-02 13:16:09 UTC to abuse{at}cloudflare[dot]com)
Takedown time:1 month, 3 days, 16 hours, 5 minutes Bad (down since 2022-02-16 10:11:44 UTC)
Tags:doc emotet link epoch5 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-1462547782_13261634.xlsmxlsm 0d689f583f780d0dbd3e9197bac7b961ad20c2a5d4e0df322ec0308f43eac999n/a Heodo
2022-01-14gD064.xlsmxlsm 8af80399bba56ded76bb3e7373388d1354841bbea61dfab0094215403def66c0n/a Heodo
2022-01-14mCkjsX-9269.xlsmxlsm 76e281e4666c4a90938595d81796364bfc4521ba33fddeecae09aa8fdb0c3b93n/a 
2022-01-14vURbvM_1964422.xlsmxlsm 2243ada22b4c83d5f5470d40be8a9a88035c7264ad4404dad0776975a93da710n/a Heodo
2022-01-1478437194_253.xlsmxlsm 8a1759da5cf30cda277162bcabe0a579ee44c76e90293cad589f0d6f1e36310bn/a 
2022-01-14267124_6.xlsmxlsm 2b25518c74a4620e944ebbb70b30787175d702d7c2b9dab5072d25bda750f042n/a Heodo
2022-01-14MHQF872.xlsmxlsm 689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6n/a 
2022-01-14121898755866.xlsmxlsm 8af12a9f834703c63edad17992c5c74f775cae7734f8a363b88ab13d0599c6ffn/a Heodo
2022-01-14vqg_517.xlsmxlsm dac736a5562b2a96cece573228b50c17f369d3912fef2b92dc5ea40d5c427034n/a Heodo
2022-01-14jOkGcF-24.xlsmxlsm 01e14e3c803705655e2068d80e77f2e2103118f38fa43791e069273b46c8cc0dn/a Heodo
2022-01-14UK_1301150.xlsmxlsm 25ffc4f1a9abeb750423f929d563d90c09121eee81a928f86f02f8e4421f5c7bn/a Heodo
2022-01-148436-6063.xlsmxlsm 6d309b2f00848aad2b4bb6ebe146e8bdc4dddb271c9ce170a5946cef29ccbe41n/a Heodo
2022-01-14nkob_37377.xlsmxlsm a972c47050ae7cf97f0c52155e8ab1462d5a9606eaf7140f1ee56f1e8a45dbb8n/a Heodo
2022-01-1444022902-7659311.xlsmxlsm d75b9fb536fb81677c1647eb63af1579bc3f2e7d21a22325d4d17059d3a851ddn/a Heodo
2022-01-14EZmNIh748.xlsmxlsm 1f33cccbde25d58a817b0b6355084b8d0694bb104019808808694c2e6bbe2fbbn/a Heodo
2022-01-14IV_355026.xlsmxlsm 8241a915f1a80d0c6898233cdfef1c73d4e00a2b17c41b4bf84984d9b4234f46n/a Heodo
2022-01-14593856917.xlsmxlsm e1f0eb778a09fec529aa7aff9d665828b18007c8e52d62565a552f606c04442fn/a Heodo
2022-01-14E134191.xlsmxlsm ca10d23a4990ebac124b1dda44768d00c6592d955ed3ed5814954a99c9f8f5d8n/a Heodo
2022-01-14PHE_35775935.xlsmxlsm 32d0f9e54a6069ab7da0486acc774eedc286fe45dc94482bde716d22565355cdn/a Heodo
2022-01-14BT_2964586.xlsmxlsm 7ae8d061dd1dd74a37ac33eced5d361e376cc4b919bdfd82338595f8e17d1e46Virustotal results 33.87% Heodo
2022-01-14d_23832.xlsmxlsm b57a55f2405494bd567fe9fd7d0b20a4dff80c22cc57b45a3646dc9e19ac69f7Virustotal results 35.00% Heodo
2022-01-14xtt11.xlsmxlsm 77c84a4f67f70d068261158ddf09d5e98292a7d86397fb95dec8f0092a67d25fn/a Heodo
2022-01-14UX_01.xlsmxlsm 127c23bfe45f05520e25aa2ee365653314949ad5bf52a5961e3b97b42ee942a4Virustotal results 31.75%Heodo
2022-01-149432512TAMDEJB_904179740.xlsmxlsm 0e9ecd9a72922bccbcb8e10f539cb80caf27d6e4a3d3fee85db032623821a4aen/a Heodo
2022-01-1494136-14302199.xlsmxlsm 4ae00681a3df217ac3d3dc4f3e7b9a154540d3047f51504700e9f6d937e6a29dn/a Heodo
2022-01-14WKIJJ_443.xlsmxlsm 2bddcf7091fe815708701ec5e688ab154d2d422c7bb736a50dec1ad373b77d8cn/a Heodo
2022-01-14698522_372.xlsmxlsm 3e81aeff6c3de374e2eccaf42502eb484fd572d9cfd1b165fb2d05169913a6e5n/a Heodo
2022-01-1485814704_2909754.xlsmxlsm efe6738d4ba36185f68784a158eaafecfa97f2a854ae278b8d193f6edc65ed2fn/a 
2022-01-1473208092QHEDNAGE-3086.xlsmxlsm 8930ee76733f7d47386802541a1c011bacf01d3a97b98801b53dc4906502f824n/a Heodo
2022-01-146450-4290.xlsmxlsm 6f172f29fad74cb96e7bfa67cff818457f78054d98f4fe83a8147104da2b7a17n/a Heodo
2022-01-14BO_45.xlsmxlsm 2cb32cce5af951f826a1a62921237a45f2734472193d1e7ef2285c566b44dc3bn/a Heodo
2022-01-147326605_5.xlsmxlsm 2f8585e901dad97e223c520854756f6026457c7e3a00cc91fd5af8387d6c0e7an/a 
2022-01-1430847081276055.xlsmxlsm 93797babbd39191ec7414750b549df061089d4b224c2465baa56820ed3583b66Virustotal results 29.51% Heodo
2022-01-1443816QDNFDAL5613904.xlsmxlsm 0766c61d5d861dd6db71ee8f535e5f405f9d7ae80dfc5c83938e000d2b4ba58an/a Heodo
2022-01-14xdyjwla_1043.xlsmxlsm d8fd315efba4dd6e72aaf30eb91ac6bbdc046717708c740158751ebf6a9e18d4Virustotal results 28.57% Heodo
2022-01-148094951244528.xlsmxlsm a4fac371acf37f2dfbd34397e355ade1361d93fd5c85013e9a902677149da2f4n/a 
2022-01-1410937KRZNMFJLF391152.xlsmxlsm 992922c0dd74c7f68096c93f4df4d4fb642f1503e40b7b20eef156edebe70839n/aHeodo
2022-01-14TN-97.xlsmxlsm ff585f534b9fcb8f660da3a92bdf92629e9d66cc31aceff6d3cf69be3aa2da60Virustotal results 29.03% 
2022-01-14RGWD285.xlsmxlsm be9b720458252f06a6688c838079c24730523961b9242c3a0c76ef5c4c1ac949Virustotal results 26.98% Heodo
2022-01-14UT39901895.xlsmxlsm ec237a7588cb70688e3f57edf9ec59126b234f51b996b68000604002a379dc5dn/aHeodo
2022-01-1494118-68946962.xlsmxlsm 8705d70c0665223e1bdafd9d3ab2a3d0d2afa50f899b976f4a480293ccc715ean/a Heodo
2022-01-14O-2.xlsmxlsm a49399789b01cd98a86c1e039af45a87a2c9ec07d14956bb189152912239bc4cVirustotal results 27.42% 
2022-01-1426715580130699.xlsmxlsm 296171d1b92b175041ee3829e60a6880b93861ef09614e912d112777fc2fe13aVirustotal results 26.98% Heodo
2022-01-14HlGiQt_1845329.xlsmxlsm cb0d9916b6be6d3b9d52d057b5b8aa3b223284abe331467dea72eca27165a618Virustotal results 26.98% Heodo
2022-01-144326BEBMBE-1.xlsmxlsm 0e2db8bad325d450826ee98740532c44b36d70a95f31178c85a50f4e8ee9c8b0n/a Heodo
2022-01-14636840892_25841.xlsmxlsm d7e424ccc4f316f9abbabc2a3b0bc47b61daf071111fed745056ffc823c541c1n/a Heodo
2022-01-14D008.xlsmxlsm 77f9047608db228251671697e703de19448819776d18446a1c5cbae840087e02Virustotal results 25.81% 
2022-01-14xWZc_8068257.xlsmxlsm 5388d17d28ba671fbe8a27779a4ff0a97c15a00c1a91e946824b81b38c6d8e90Virustotal results 25.40% Heodo
2022-01-146656431397276.xlsmxlsm d55979fab69e6383de91fecd3232f4f013cc7eb8de5a4a0090c6e0a371765b4cn/a 
2022-01-14xlstw-6662.xlsmxlsm 28d2e274a082c7de870cd52bde0f9bb929bcb9331d7ce9e85f5c9bb6948a59dbn/a 
2022-01-1427394059_094.xlsmxlsm 5e752b11e5c8a995688ec34e8bacbf253a0450479c1c2582dbd770d004babe51n/a 
2022-01-14UZJN_547.xlsmxlsm 948bece3441056d04af338e263063315d45921d28cf536276011fab5b2127a00n/a Heodo
2022-01-13ZNRMTP_336367.xlsmxlsm 731ec98a6308e19709812083b3dfba8b079aa48f36b486f2f06d7170de5d1541Virustotal results 22.58% Heodo
2022-01-13RXO8700600.xlsmxlsm e15f4ab1af0935e26f54b19c1221a5dd41698713dfa44c327a206ffd708f3ceen/a Heodo
2022-01-13FZ-16.xlsmxlsm 88d07eac813b81a446e976b9d46feb95a86d3e4d0cdfb6e604d42bba8757db02Virustotal results 22.58%Heodo
2022-01-13pwd-371.xlsmxlsm 792a7b8e75aa51f90c66ee711faf429dfe3220b038cc3725ee935083fcb60e0fn/a Heodo
2022-01-13H_08.xlsmxlsm 3acb79e666d3707fa30bea2fc66a8432f80c7af6af0b835810549c9b20d03838n/a Heodo
2022-01-13SNN_87.xlsmxlsm a2c4ed091b3f72777bb52bb63738e0cd8b5fc88eb4408d1ebf355c431920a2f1n/a Heodo
2022-01-13473135943.xlsmxlsm 8956b950352fe247497f8aa4a0738a1fd22c1e32a643a1e98ecc416229fa29f4n/a Heodo
2022-01-13Tj5.xlsmxlsm f1ec4f871b40968083790f9f1e19eaf6c17301f20743055e00b6382b3d5b2f55n/a Heodo
2022-01-134513_65.xlsmxlsm 3ee5184a13e445cfb1886d07497ad642ebcf9b1d33fa9628d60e50e8cfa882e3n/a Heodo
2022-01-13887442_846.xlsmxlsm 3be68616e8943e1a8b35ae8d39c7e26e6f949d3f5ce41072a3037bfafe766c14n/a 
2022-01-13PIINR14998.xlsmxlsm 86a1ee206571860bb3bad454634ec72849381988ddef82b11da1360046a070a6n/a 
2022-01-134743DTPQAPKBQ_223788.xlsmxlsm 8b8691c729c4aae4cda2049c3fcbf3153562829da68bfd3121e61dc3f9bf2cfbn/a Heodo
2022-01-1322039_0175129.xlsmxlsm f6319e708e7c942acfec28dcc5e23df293475f01d892e4992d9717277f79d6een/a Heodo
2022-01-13188074_760658.xlsmxlsm 4a3a254a975f87ed78ab0ab53de0a7f8ab2235a1bc8abea99ade0593d3c2c450n/a Heodo
2022-01-13CYUQ_66554539.xlsmxlsm 5cf53f9f40389a8c56abd3a90681dadd27c0db904fbc2422ec9baa37e84c1584Virustotal results 30.65% Heodo
2022-01-13O-196879097.xlsmxlsm aefebee74f868174371b6f9925e3484198f01753d2e1ed58c2b99a6c2e24de08n/a