URLhaus Database

You are currently viewing the URLhaus database entry for https://wordpress05.aftershipdemo.com/w4gfdi/mGgE87/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1992532
URL: https://wordpress05.aftershipdemo.com/w4gfdi/mGgE87/?i=1
URL Status:Offline
Host: wordpress05.aftershipdemo.com
Date added:2022-01-20 12:25:05 UTC
Last online:2023-01-21 11:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-01-20 12:26:29 UTC to google-cloud-compliance{at}google[dot]com)
Takedown time:1 year, 0 month, 5 days, 23 hours, 27 minutes Bad (down since 2023-01-21 11:54:23 UTC)
Tags:doc emotet link epoch5 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-24zq_28.xlsmxlsm 0f5d70d653951694aacfdbae441a87340e2689247cc1dc79852a86d5c8e7dd2bVirustotal results 46.03% Heodo
2022-01-20vbkkcW_28224565.xlsmxlsm 200e8f491dade178eca83bd109426425ffe7ca9d4baf974a204e3835c56ceb2eVirustotal results 21.31% Heodo
2022-01-2023894_28893127.xlsmxlsm 6b010b591c50b68c8101ed6ffe62e903c6501ae17d1b430a904288c1391d4482n/a Heodo
2022-01-2088593759-04695589.xlsmxlsm c8b489b858ea1f5536525a2b538ee8d955f10b8f43b86e4eb06894d5c48e885fVirustotal results 28.57% Heodo
2022-01-20915-8523779.xlsmxlsm 8866cd8ebac58f0fd038a21db8094be78be8577a1e3613be93fe9ff78388e192Virustotal results 25.40% Heodo
2022-01-20PoF1469196.xlsmxlsm 8440eb113e9093c7bb2f228ac7cd77334e4168cbb32dd19d86f2f49cc3466da7Virustotal results 29.51% Heodo
2022-01-20gsn_5051503.xlsmxlsm 42eefcfe7fff0afcdc0bca565d1d1dd9cfaae1167d9d0a9ca49e0389d53ed46dn/a Heodo
2022-01-20xxqlnii-9195.xlsmxlsm f48ab458724fad35a7456e9f640afa8c061c0b6bd04acbc9cb0d0dbb2f4d3202Virustotal results 28.57% Heodo
2022-01-20740WAFEARPQ073.xlsmxlsm 40b52631655bde48abffe4d280833b1b6019e1ab64d64762283108f4cbaa0c5fVirustotal results 27.45% Heodo
2022-01-20CSJ1.xlsmxlsm dfa1de096862a3281db07782e1a8365a37fb07c94cd5b390ea1ba9a0e202d507Virustotal results 28.57% Heodo
2022-01-20D_4739.xlsmxlsm 0df825699f788f7c626557258cc6c79c394f663837325ae5fb3977b5ae23a67dVirustotal results 27.87% Heodo
2022-01-2086_216.xlsmxlsm 66f754fa0c762bb97ca72ff0da7ed505aced3d99925ab65efc7402ff27e56039Virustotal results 28.57% Heodo
2022-01-202941_1515212.xlsmxlsm 645e264c2f657e1f901918767938090cbb4403348a8eb2a6c4eca245175dbd18Virustotal results 31.75% Heodo