URLhaus Database

You are currently viewing the URLhaus database entry for http://hassan-khalaj.ir/x4jqp8bg/eTrac/q6xespo/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:267324
URL: http://hassan-khalaj.ir/x4jqp8bg/eTrac/q6xespo/
URL Status:Offline
Host: hassan-khalaj.ir
Date added:2019-12-11 22:38:05 UTC
Last online:2019-12-27 09:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2019-12-11 22:40:03 UTC to ripe-abuse{at}0-1[dot]ir)
Takedown time:15 days, 10 hours, 37 minutes Bad (down since 2019-12-27 09:17:13 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2019-12-139179727994214.docdoc 7cb2ce004956c533a28d83695e20fd6b02564df6ff33ea74de3d7b6729d54151Virustotal results 31.15% Heodo
2019-12-13EO8478207321PY.docdoc ee411de23018782be884a00549868c7e823a63cede2e39563e480f257cc10f94Virustotal results 31.67% Heodo
2019-12-13PO_ 12132019EX.docdoc ab49efefe457f2c0c050496c1fdc8d586d01c70baaaaee84a831e766db85973bVirustotal results 28.33% Heodo
2019-12-13ETE_55980313377572893.docdoc aadfdc82f050fcb2e3002a14f3982fd8c46af5fc8967eedf28f8f8444dc43d7cVirustotal results 28.81% Heodo
2019-12-13REP_OL6979130534II.docdoc 31a1a3e451a10c8ed8378a4f250b321b025eb9abe1b6d898c08da6e3b4339598Virustotal results 28.81% Heodo
2019-12-13DOC_81497829.docdoc 484569e190db879a6583d3351876a81c10ddfcb7f1d0c55655907a2b9d0015b4Virustotal results 31.15% 
2019-12-13IM_PK2551527895RZ.docdoc b02b6cc7e944e8e288d738c1e48486faa34bf01341583b4c8cc787557e88f3feVirustotal results 27.87% Heodo
2019-12-132J3UZHLH.docdoc 7f3722390f208ea1ad86acb7ec6269ec5ddbbc769264e96f0735a1d58fbde64aVirustotal results 27.87% Heodo
2019-12-13SB_53547610.docdoc 8ac66a3b1707d5f9a1b90b7125004d8a426a344aaf5ac9195a6730a53996a168Virustotal results 26.67% 
2019-12-13FILE_2931459445267821817.docdoc 1f8b88c5a6aea42b550b7b6f8f2829f0ff509137083307e2d2310c871942f0bcVirustotal results 26.23% Heodo
2019-12-13GK_32978869513522.docdoc a07562b4b8b20ece4cb55219f5a54776a9d8a0bf56cd2e0115e1acee44824559Virustotal results 26.92% Heodo
2019-12-13DOC_79935830.docdoc 0dc0bda81ebdc4de5edc1af4a8979d9a01a10ada4dbb4a393c3fedc618bc99dbVirustotal results 26.67% Heodo
2019-12-13QO3064616865YP.docdoc 9fdc95bdd1ee6373d84cf9dd7905e7ebad4bd814669d11eb635d552205dc4ca2Virustotal results 35.29% Heodo
2019-12-12REP_PO_ 12132019EX.docdoc 3fa12bc90f54541203935b3f98f4cd1dffe7691168cb282446a2905a46f27d6cVirustotal results 35.00% 
2019-12-127068456525075973.docdoc 9eac7269a69c311d034b34a2780776ec54b0a8b8524d636742ad701e895662ddVirustotal results 34.43% Heodo
2019-12-12UQQ_8377282060502731991379121.docdoc 3d80ad311c11470127a15471f9fb6223164b2d23861c9790a36c11bac768ca3bVirustotal results 33.90% 
2019-12-12Q_PO_ 12122019EX.docdoc 13f15eb6814ece84a55978266600aa071f90fc973e927681542a176d5a4d69e0Virustotal results 34.43% 
2019-12-12RS_PO_ 12122019EX.docdoc d34a3b22b311a68cf698ad967f3a8a7473173253098abd4253af7be2fbcee40cVirustotal results 33.33% 
2019-12-12SBJ_SMK_120119_PLI_121219.docdoc 4a9cab9e3d160128fed40b2f74c27d11a22ef6a96e8d57298124dda524618898Virustotal results 38.33% 
2019-12-12FILE_BUAEH9TY.docdoc 2b6bf2055790d8fae5a1b31dfc9ff559ccd0586cb7d0c8717c24cdb6262626b0Virustotal results 32.79% Heodo
2019-12-1268093081825225616150.docdoc 5c8dba81db95bc51ed5031e5d36754b7511c85af2bf774d9b2399516815f2936Virustotal results 30.00% 
2019-12-12PO_ 12122019EX.docdoc de6662c946d502bee251e2dabcd64f8c31f8a8f31898c3cce8cc80b78a138781Virustotal results 31.67% Heodo
2019-12-12NK0053820665GI.docdoc 281353f5be1adab4b3bd5be93b4397edae5d9fc5a5595fa72dbf0d7967606d61Virustotal results 31.67% 
2019-12-12L_808U9NMX.docdoc 03a6a75373a9d6a8cdc3dc2f0bbb827d595216900979ac8df62a5a87439300ean/a Heodo
2019-12-12CDC_120119_SJD_121219.docdoc 7880cc42f78ce37e1603207a15bb0471e309eb5fedc7fa51abbefd09e357efcbVirustotal results 28.81% Heodo
2019-12-1290317728.docdoc 3292c4956d982de5eef4cd373fd0ecc1d828837ee3c25d57e418bd06a64e6f6dVirustotal results 44.07% 
2019-12-12PO_ 12122019EX.docdoc 9c7bb5e717f85675c29ed902a947d6efacdd29b7a8c40029ab46b1d13625bd2fVirustotal results 43.33% Heodo
2019-12-1170703281.docdoc 1b1e2c9c30f48e46d8d966421c16c5254043e7166661a7ce2adc7feb2ff68cden/a Heodo
2019-12-11REP_TE0276395344UY.docdoc 19655e3d8bcfd9caa6dc59d1b3df8ff605bd6d486ae018d10445e425c0cc73dfVirustotal results 43.33%