URLhaus Database

You are currently viewing the URLhaus database entry for http://dulichdichvu.net/libraries/63lx8/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:2120214
URL: http://dulichdichvu.net/libraries/63lx8/
URL Status:Offline
Host: dulichdichvu.net
Date added:2022-03-29 18:20:15 UTC
Last online:2022-07-03 15:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-03-29 18:21:15 UTC to hm-changed{at}vnnic[dot]vn)
Takedown time:3 months, 5 days, 21 hours, 35 minutes Bad (down since 2022-07-03 15:56:19 UTC)
Tags:emotet link epoch4 heodo link redir-doc SilentBuilder xls

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-03-31YC-104999416328.xlsmxlsm 0e92cfd04405b8b597562761080285f19807c04c48c7278fe7632271ded41c3dVirustotal results 40.00% Heodo
2022-03-31VD-60556061424182.xlsmxlsm 9c234ce84ff77dfc1466c436eea9d46c50c3055c50f0029b81dba5052864f4ban/a Heodo
2022-03-31NO-6485666090.xlsmxlsm 894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7Virustotal results 36.51% Heodo
2022-03-31QX-504532377949946.xlsmxlsm 97f11e4cd509aefb731d8b1a4b299c8ab4096e270f05f52d8e0eb6d2366fa501Virustotal results 38.71% Heodo
2022-03-31TE-888618545862.xlsmxlsm 08e64e582d9d42f5f3a21eaff52bcb72b4a3abfc761561ff28f40bf937dedb2cVirustotal results 38.10% Heodo
2022-03-31WYP-5943264.xlsmxlsm eb39b29661d81cbcd7a00f191c61ce9902b80b68e1e03215e56221bfc85863efVirustotal results 39.68% Heodo
2022-03-31DTY-7521908438772.xlsmxlsm 2617b3b15f0d97a163be4c1cf6df03a45313c05bf0f36c3c2b37e56732608493n/a Heodo
2022-03-31AQ-9085905005899.xlsmxlsm 00ea616ce33ef49268a2d6046f588bb73c80b7a90ae6e5e5067938d72e858564n/a Heodo
2022-03-31FMA-9164978816.xlsmxlsm 764d8e72174b0666952016caf95096e85219dba6554a8ce6db74b8244b3e7590n/a Heodo
2022-03-31WP-86000860826.xlsmxlsm 162637428037d1f8f3bd675b122e5b830107b9ea7352c8c765e97a3afbce1231n/a Heodo
2022-03-31UK-63262474898.xlsmxlsm 355981d4c8400968deaa8a13a04a79c90bf9aab795af2ff1b3273b825a477968Virustotal results 38.10% Heodo
2022-03-30LTD-337264373072677.xlsmxlsm ccf8147ef96ae47288019a25336c2935e73d2e06b8fe73823e3596fb1596ba8dVirustotal results 39.34% Heodo
2022-03-30FC-69060639.xlsmxlsm 51be5ff843565b3e8fe56f303452e018d305cc846181d2d79d435509b2dc578cVirustotal results 35.00% Heodo
2022-03-30WO-1223163.xlsmxlsm 168a9aa1b5fa37a354fd6ccba71dcd29cbcd503a578504c69feb38bd84a8a691Virustotal results 30.65% Heodo
2022-03-30HL-1495352287.xlsxls 31ad327541ee0627096151e901dee22241e584b78b52c17eee5a1c40a6f25490Virustotal results 25.42% SilentBuilder
2022-03-30EBC-2162613491711.xlsxls d743d15057637cf8074f2c125e85dec324808dae8860051c978dcda48f641d86Virustotal results 28.81% Heodo
2022-03-29n/ahtml 58354ec5d0d08dc20748b3124a673bab74bcd6e1d4e99fff668c31e12f40cf5bn/a