URLhaus Database

You are currently viewing the URLhaus database entry for http://womenonwheelsmtb.demo9lec.co.za/cnegwgkr/SEfJs-0152/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1975521
URL: http://womenonwheelsmtb.demo9lec.co.za/cnegwgkr/SEfJs-0152/?i=1
URL Status:Offline
Host: womenonwheelsmtb.demo9lec.co.za
Date added:2022-01-14 01:45:06 UTC
Last online:2022-01-20 10:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-01-14 01:46:11 UTC to abusepoc{at}afrinic[dot]net)
Takedown time:6 days, 8 hours, 41 minutes Bad (down since 2022-01-20 10:27:32 UTC)
Tags:doc emotet link epoch5 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-18fwgrg_094172.xlsmxlsm fb51ebfd72054de8cbd7f74a05ce8d3cce650a9224c21504077cce9e86ae6fd1Virustotal results 36.51% Heodo
2022-01-144220_948.xlsmxlsm fc35484b7ef1a18a7ceb82df9d86f0b80de2741cddc33c3fdb8d5a51ab630b1en/a Heodo
2022-01-14a_44.xlsmxlsm f3623a62008214216481fe10c617e9ca5a5c4c73017e1abd575cf48faf21078cn/a 
2022-01-144403_24187364.xlsmxlsm b0a265b0d24252c4692de5729a76f1258a03a12694e20a49e306a0f83709270an/a Heodo
2022-01-14neob_87.xlsmxlsm 5a2aef933d4e5f7047736fa4cf87af3ced016c1e6b1bdd7afba9e7e0cfe81d1fn/a Heodo
2022-01-14051055LTNMAYPLQA789038.xlsmxlsm a071e68277a7133cb48b04e16b3df8081238c690317747153fc4c48d7f508952n/a 
2022-01-14kabe2233.xlsmxlsm 4798497313ab844457b411ab2b7dd381ff709e35009c92e6adf769777919b08en/a Heodo
2022-01-14MK_1910.xlsmxlsm 60373a2b7942416a3047d1724d055f1383105920170390683cf2e74aea7d632dn/a 
2022-01-14RGJBC_236.xlsmxlsm fb20c75e85242c7b718ffdb1e74fb46786951c34620031b9c851461bcd6b4f03Virustotal results 33.33% Heodo
2022-01-14WWA3.xlsmxlsm 014ff5c82b7c1bdb0b30b6c7148eba05ceb93243f3a0611ff6ee6be8d29009a3Virustotal results 34.92% Heodo
2022-01-14K_7707.xlsmxlsm 6adebb1f908d95b0e98266710b732c600ff552131a6844031fc5417ea84615b9n/a Heodo
2022-01-14893480_93310804.xlsmxlsm 38fae338f6c68c5cf6e80768b44a9286d484b36262b24c1766f66e76de463aafn/a Heodo
2022-01-144420_8379.xlsmxlsm 91d755374725859f64dc3160258cc1f6a2f04cb768b0da56e86e04511d57aca7Virustotal results 33.33% Heodo
2022-01-1408290_09251.xlsmxlsm daf92a74582de89dee72174738e3196b3e9246a624735a3ab312f4ffe7ef1855Virustotal results 32.79% 
2022-01-14TUTSB39427683.xlsmxlsm 44f26e4d53adb8ef86a7002203ec875caaa24b24a0ae88d88eccb71c5b610b56n/a Heodo
2022-01-14690_33067.xlsmxlsm f36635fc524dee008c90bd6556c998119d281be4995e4a5fd140a69fbbfea36dn/aHeodo
2022-01-14au_192.xlsmxlsm 1c297a6ab065acb1152f13e630509d68b98eedaca18dd4ab43062f8f95ea9a16n/a Heodo
2022-01-14782969-522.xlsmxlsm 240d9c912338f39fde436264a56a9b48ded82608f23ae5f4a8f732110c2b30a2n/a Heodo
2022-01-1478245_5080.xlsmxlsm ccaa6507919076a28b38c5b5e30d2091705e482d54aedc76bec5163d31e21fe1Virustotal results 33.33% Heodo
2022-01-142717-74.xlsmxlsm c10d40fd29ee12ca187becbe26e5d7f132695ffca909bf6013247c9146b71b81n/a 
2022-01-14754884_7.xlsmxlsm 920dccc135e7f573d85fc925df056af68170bbdead1b6cd0e1fcd31b1e1b2e7en/a 
2022-01-14D-91057.xlsmxlsm 31880b7b69938b12824c65ef7240304c054a61f2c4e62b7f596cafbad8b63eben/a Heodo
2022-01-14CPS_8453.xlsmxlsm 42c5bb56d6d7939abf3f29c32648b0239c79d8362d5b7634e96c8387b4376831n/a Heodo
2022-01-1487126160250.xlsmxlsm a45f772b66ff40e7de3bb7541d5563fc62563fb2aa9ab6b9343e4ab859593c7en/a 
2022-01-14cxx-492967403.xlsmxlsm 93797babbd39191ec7414750b549df061089d4b224c2465baa56820ed3583b66Virustotal results 29.51% Heodo
2022-01-148784352032.xlsmxlsm 0766c61d5d861dd6db71ee8f535e5f405f9d7ae80dfc5c83938e000d2b4ba58an/a Heodo
2022-01-14I_7397428.xlsmxlsm d8fd315efba4dd6e72aaf30eb91ac6bbdc046717708c740158751ebf6a9e18d4Virustotal results 28.57% Heodo
2022-01-14Y_346235.xlsmxlsm a4fac371acf37f2dfbd34397e355ade1361d93fd5c85013e9a902677149da2f4n/a 
2022-01-149830372526.xlsmxlsm 992922c0dd74c7f68096c93f4df4d4fb642f1503e40b7b20eef156edebe70839n/aHeodo
2022-01-14EDIS_814226.xlsmxlsm 69ef1b95072beb41ac0bd2bff9613836579a4e1b2738fd5f150a0507e1c97fa4Virustotal results 29.51% Heodo
2022-01-14wnqwf126169871.xlsmxlsm c38669a80f2dce6bbc2dbfc67e98ecead22379ea9733a7e496c8cc6896d61d11n/a Heodo
2022-01-14KBTW_3718.xlsmxlsm ec237a7588cb70688e3f57edf9ec59126b234f51b996b68000604002a379dc5dVirustotal results 27.87%Heodo
2022-01-1446685_334079453.xlsmxlsm 59ae2ce51e3e9e2d3e412dcf23488aa002acb72d34656606872d00bb4ab0eca3n/a 
2022-01-14077705309_432632.xlsmxlsm 878245ca533c239b7066ce1bb483d8cd42a8d5887954c3e4db00b5a52d46f354Virustotal results 31.03% 
2022-01-1495YKB_94.xlsmxlsm 3b63ba5e81eedd06656eca70b56b6d9490b598df1646dd83dacefe8cd52d6a77Virustotal results 23.81%Heodo
2022-01-146441859760.xlsmxlsm cb0d9916b6be6d3b9d52d057b5b8aa3b223284abe331467dea72eca27165a618n/a Heodo
2022-01-14W-79311112.xlsmxlsm b8e60cbecfbe9cdc725b0f3fc1524d2004d7a1e7a7aca69e4f7bc0ce89fe2f54Virustotal results 26.23% 
2022-01-140634495_44.xlsmxlsm 70331e285111162a78eb26ed4f17fa1fd42d663b4355e55f6e4aa117d19dd2f3Virustotal results 25.81% Heodo
2022-01-14925172475_86.xlsmxlsm b8b1fb98701bf450f491a99a027c35455ecc635801276ec74d0f637aa91aa3f9Virustotal results 25.40% Heodo
2022-01-1456868_72665.xlsmxlsm c2ab14bf957655123abdaeec4efe8202b1e6038c324c3492e2b610175334ff58n/a Heodo