URLhaus Database

You are currently viewing the URLhaus database entry for http://fisika.mipa.uns.ac.id/reseller/img/ldRfBVqQ/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:2119324
URL: http://fisika.mipa.uns.ac.id/reseller/img/ldRfBVqQ/
URL Status:Offline
Host: fisika.mipa.uns.ac.id
Date added:2022-03-29 13:41:06 UTC
Last online:2022-06-10 07:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Status unknown
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-03-29 13:42:08 UTC to abuse{at}uns[dot]ac[dot]id)
Takedown time:2 months, 12 days, 17 hours, 30 minutes Bad (down since 2022-06-10 07:12:58 UTC)
Tags:emotet link epoch4 heodo link redir-doc SilentBuilder

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-03-31UXI-292647199.xlsmxlsm 894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7Virustotal results 36.51% Heodo
2022-03-31VM-808885303790736.xlsmxlsm 97f11e4cd509aefb731d8b1a4b299c8ab4096e270f05f52d8e0eb6d2366fa501Virustotal results 38.71% Heodo
2022-03-31FQY-979830718.xlsmxlsm ed2c24997ee2d47a9cc1d73571d3466166ce479c5bc10602b744894b32f9a009n/a Heodo
2022-03-31ABS-135585441907056.xlsmxlsm 54bb2433c32ae91e6033d49276536fd303652e555e7d1cdf5e1aa0bf9f483d18Virustotal results 40.32% Heodo
2022-03-31RSW-11803705076.xlsmxlsm 9490224310276e55dea4f02cf1d9c3c81919929e8abc13c37b670025f1f7a3d0n/a Heodo
2022-03-31ER-500082360.xlsmxlsm 41a73a914406df97e2944f7742f48272bab7d25486c9c2a5084a7f158fdb2aafn/a Heodo
2022-03-31YDN-5813288847265.xlsmxlsm 3a269c2f6424eb67cc3c98b36e1c350029d24611529951783fd2a2980b739e47n/a Heodo
2022-03-31WH-6921334333691.xlsmxlsm 08e924859a3a3f17c099cca75fbb3cfd7f8cd726fa2e89fb47ff02f9687143baVirustotal results 34.43% Heodo
2022-03-30ZC-2772415808.xlsmxlsm d3ad5641b527c4ec7e77e037ed81f1913c394f063e13677b8744b26fb09bdeceVirustotal results 36.51% Heodo
2022-03-30PZF-675360271069313.xlsmxlsm 533372e6130ad44ced6eae30ab3af8be4ae172cc7585719b61074bb861f2dbben/a Heodo
2022-03-30EWN-48030634772.xlsmxlsm 70c7353a1e172d428b42bed59b7ddb9a6d1b60c368ec7ae5eb64c0eeed368080Virustotal results 33.90% Heodo
2022-03-30SY-02512485127.xlsxls f3101b6d16751623f8a025bfbf75ae9a32c68b534dccbab4452ee72a9fbe0f5fVirustotal results 28.33%SilentBuilder
2022-03-30DM-84653562799597.xlsxls 92a382930844cb9ee7f5e2bcf28d79c298b41e8403d2ed09b09e8559666b2bf2n/a SilentBuilder
2022-03-29n/ahtml de3c3517816aed0748b528c0e5cda1e12d3e3540bdd5074f6714e50cd9ab0e1dn/a