URLhaus Database

You are currently viewing the URLhaus database entry for http://mamaspresence.com/cgi-bin/OI_28817/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1992860
URL: http://mamaspresence.com/cgi-bin/OI_28817/?i=1
URL Status:Offline
Host: mamaspresence.com
Date added:2022-01-20 14:55:05 UTC
Last online:2022-01-20 22:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-01-20 14:56:11 UTC to abuse{at}amazonaws[dot]com)
Takedown time:8 hours, 2 minutes Good (down since 2022-01-20 22:58:43 UTC)
Tags:doc emotet link epoch5 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-20U-1.xlsmxlsm 200e8f491dade178eca83bd109426425ffe7ca9d4baf974a204e3835c56ceb2en/a Heodo
2022-01-20THTRV_49222.xlsmxlsm aec2322328224504e216bae76697e68ec37167ececb7693615d72235044bf28fVirustotal results 23.81%Heodo
2022-01-20350579717-02480672.xlsmxlsm 46dadb348869cda14d38466d791ebf6c906f5ec26cc305fdca50921785f48b20Virustotal results 23.81% Heodo
2022-01-204778404915217330.xlsmxlsm 6b010b591c50b68c8101ed6ffe62e903c6501ae17d1b430a904288c1391d4482n/a Heodo
2022-01-20SYJ35.xlsmxlsm 5eb512924e585833ee9f0111efd74c3e3ced26d8a78db2b71d87bb6c9f684791Virustotal results 29.51% Heodo
2022-01-2063HPRG068709952.xlsmxlsm f3af1bae6675bb7eff796079a60c5a67ec86892f1c09053d2c25fe7d9fcee836Virustotal results 29.03% Heodo
2022-01-20pd-53474.xlsmxlsm b1551887350e6e3d73f1d159a97f121cdb3d5b3d9f151de703c313f247958248n/a Heodo
2022-01-2072131.xlsmxlsm f3f1542a86bb2d668046714e3987278506d3308023b1cb398efa9573d2da7776n/a Heodo
2022-01-2069324891002343.xlsmxlsm 1bccdaed8a9d03e7c5a5f0ecd9ca25e942077d1be538087e6451cc3030e37b8dVirustotal results 30.51% Heodo
2022-01-20QU1979311.xlsmxlsm 7429c9e25f9d5b509f78af97a0f595fac9ce8122ad4788c17087360e06521b2fn/a Heodo
2022-01-200876_62553289.xlsmxlsm f48ce531d75c5080dd92c721b92678a75a2be77b9c53d1a33d5539c695d1e614Virustotal results 23.81% Heodo
2022-01-20iYVtu995573.xlsmxlsm 8ca261137fec414bb9066e12a3b88f3872e87a71d57134c1ee8331a7c0590965Virustotal results 22.58% Heodo
2022-01-20P_11358.xlsmxlsm 47b55d5918804812bdc25923b93b4d42f3f5fb005f755266aba09ace6d636e20n/aHeodo
2022-01-20jAOwQ_72600118.xlsmxlsm 54dd7b43faf6af4521533712663354a19b6793199ff1fd6b355828448b1cce66Virustotal results 27.42% Heodo
2022-01-209894_998.xlsmxlsm 7805fd902552d2c362cec5d35c3ab11be2ecd01d5932757e4f175b5f9d21ba1fVirustotal results 26.98% Heodo
2022-01-20646_6.xlsmxlsm 2ef3416e562bce54a825d048a989566f6f14e3f396d453e6efab5664d6066b3bVirustotal results 45.00% Heodo
2022-01-2010572455472.xlsmxlsm 619c3ee3590e414b2de3333ff07b4cb2df3c76fc7512468d4a6499833db70078Virustotal results 23.81% Heodo
2022-01-20YPG-08.xlsmxlsm d3f4d5fc34a444c8ae251c04b1e12ad1371e72f9f7f5682c02e0339eb3fb6ba8Virustotal results 26.98% Heodo
2022-01-20bgdvci_359520.xlsmxlsm dd2013ad0148de7b9a7877b7b27f3372c04615fb214c98f8a96d3d5dc80b03f5Virustotal results 30.65% Heodo
2022-01-20495393321_1318.xlsmxlsm 9761bc5de47973837988a9be7b5128db72f1817d53c224709b5b2c63848e47ddVirustotal results 26.98% Heodo
2022-01-20jtd-6062586.xlsmxlsm 17fec23004233b510f24a66fbfbff83304bf565e4138fa85b44c7b80d9dfcbafVirustotal results 26.98% Heodo
2022-01-2086539PLEGSRCAD_48.xlsmxlsm bc7476f9d9148b939127a2024a1b341cec82fb398bf06667bdd3da4b1acc8bd2Virustotal results 29.03% Heodo
2022-01-20OI_28817.xlsmxlsm d13c581258a7b7cea4c550025cf6e9a52d509d4759d34753a8386e339153ef11Virustotal results 25.40% Heodo