URLhaus Database

You are currently viewing the URLhaus database entry for http://www.duchessadimotta.com/wp-content/Z/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:2118865
URL: http://www.duchessadimotta.com/wp-content/Z/
URL Status:Offline
Host: www.duchessadimotta.com
Date added:2022-03-29 11:47:05 UTC
Last online:2022-05-25 08:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-03-29 11:48:05 UTC to abuse{at}cj2[dot]nl)
Takedown time:1 month, 26 days, 20 hours, 13 minutes Bad (down since 2022-05-25 08:01:29 UTC)
Tags:emotet link epoch4 heodo link redir-doc SilentBuilder xls

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-03-31DY-95593256.xlsmxlsm 894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7Virustotal results 36.51% Heodo
2022-03-31ZC-7868485.xlsmxlsm b0fa5dda99558a54917cc9a5f6269d440cd8b30ed825f72c837d6e4044d9f628Virustotal results 42.62% Heodo
2022-03-31CZY-415571940713.xlsmxlsm 5fe0d5c74d36af2db670ba08c72837740a66a82a2e8f0b206468474195578366n/a Heodo
2022-03-31HRT-57868800679.xlsmxlsm ed2c24997ee2d47a9cc1d73571d3466166ce479c5bc10602b744894b32f9a009n/a Heodo
2022-03-31CXH-10685779751.xlsmxlsm 54bb2433c32ae91e6033d49276536fd303652e555e7d1cdf5e1aa0bf9f483d18Virustotal results 40.32% Heodo
2022-03-31ETK-1955976.xlsmxlsm 23dd125c7c3f736b183b9ba66bdd5ee5565f575fbb6c8c593f78f6da0b84e621n/a Heodo
2022-03-31ZY-2652183.xlsmxlsm 41a73a914406df97e2944f7742f48272bab7d25486c9c2a5084a7f158fdb2aafn/a Heodo
2022-03-31DLX-0455115255937.xlsmxlsm 4409b097292f1ed1adedbae38fcecf71370a64209f9bb5ffff019b71e8a88533n/a Heodo
2022-03-31IX-68185534371958.xlsmxlsm 5035ae7fff2fb435f53d12c0e8e9a2287956b64dd8acb7bfaf9d534ba59e9839Virustotal results 38.10% Heodo
2022-03-31PRT-3259671950.xlsmxlsm 9da38d7964f16ed0c46e5a0ee55152196bf8368f5e2d2b08cbf8c24932ec490dVirustotal results 33.87% Heodo
2022-03-30RL-8428595718421.xlsmxlsm 24499993a94d9888bcdc8a5b9c58aadb86dbd363efdfc2fe1996d98dba57bde8Virustotal results 39.68% Heodo
2022-03-30DX-493988412.xlsmxlsm 8eb161bd22ea52d987b19953ebebe364df8a0779ed9f42ad96c6dec32f8cce52Virustotal results 36.51% Heodo
2022-03-30UV-878652560.xlsmxlsm 42c504a0fee5cb3e3033b4f6d596ce78f3f3c1118dc4cdfddf0b54715c66117cVirustotal results 32.79% Heodo
2022-03-30WSO-08651369628083.xlsxls 88eb7648bf7a3c5eb3fbb953cd7b5df5165ffd0cd0249928a6e314f8958ebaf4Virustotal results 28.33% SilentBuilder
2022-03-30PF-02201727404.xlsxls 46218e7a1f860f4758adfd19dc3b12e27771a613ca00f687ccbe48a0c275f83eVirustotal results 26.67%Heodo
2022-03-30OR-191049858329810.xlsxls 7813b5f2ba1876b183aec911e5a55402903c7b4702fef4c3c0055557490ef04aVirustotal results 28.33%SilentBuilder
2022-03-29n/ahtml f0634cbd527d18b989262043155765da9090b1fa2c03121b144e3a8499541c6cn/a