URLhaus Database

You are currently viewing the URLhaus database entry for http://nwcsvcs.com/cgi-bin/parts_service/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:267816
URL: http://nwcsvcs.com/cgi-bin/parts_service/
URL Status:Offline
Host: nwcsvcs.com
Date added:2019-12-12 19:37:05 UTC
Last online:2020-07-19 17:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2019-12-12 19:38:02 UTC to abuse{at}inmotionhosting[dot]com)
Takedown time:7 months, 9 days, 21 hours, 56 minutes Bad (down since 2020-07-19 17:34:37 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2019-12-13JRC_OY2514668606ET.docdoc e48f77d12f62ba039f3896ef1e41afd764ea64ea8b943d4de3453b66980a1a11Virustotal results 26.23% Heodo
2019-12-13DOC_74457645310355258630.docdoc dc0578076e7e321a5ece52c7d3b5276d32ac0f6923e3eed2c01fd384cad6658fVirustotal results 32.20% Heodo
2019-12-13FILE_PO_ 12132019EX.docdoc ec0e70c7355494d17949475109a1d6693d27a72cf686547f8f7c94634f49a492Virustotal results 28.81% 
2019-12-13DOC_BQ5227831679GH.docdoc 7672328d284205d3ae9dd68d3842b671ea8393227ca046cfe3bc2f2b37ebc99fVirustotal results 27.87% Heodo
2019-12-13DOC_PO_ 12132019EX.docdoc 2328329f003f62be7f0fbfc6b8438cfec2f2d6c9aee19dc127579b1153798e22Virustotal results 26.23% Heodo
2019-12-13JX_GP5116584882BJ.docdoc 4640a1f47cdfb050fa7690ad2369a986641ae5d7b0072441060a7e099629cc43n/a Heodo
2019-12-13W_MJ3VRDN8BMSB01.docdoc 09a4dcfa609d35f93f113a48c321504d914a671ec5a90b5385fbec029f686ed0Virustotal results 27.12% Heodo
2019-12-13QRJ_120119_CCF_121319.docdoc ad35b92c46bbfa19204d81d350a8822fa74c2461f15ae49869141816c71398d5Virustotal results 27.12% Heodo
2019-12-13O_5200513594994583988933722.docdoc 84bac96b1cb3bd42694000e4cd6ef996f066ddce2f137e2374cf537a6e07e0a2Virustotal results 40.68% Heodo
2019-12-13DOC_PO_ 12132019EX.docdoc e2e4f606a0781b7e7a32ffce6227f92e4016ef6f3d5e27a8986014ed27e741f6Virustotal results 35.00% Heodo
2019-12-1327KFKS7Z5P2LAEV.docdoc 606eff1c3113bfbc02655fd1e36856d58457957a0115ce49a3ab3ffb1064af9fVirustotal results 35.00% Heodo
2019-12-13QC1883170537ID.docdoc acc7ea43de61e6d7bd1a88fde0e40ca54f4dc2d0ababd3ec2d68cee4cc7c4100Virustotal results 35.00% 
2019-12-12DOC_HW9528215238IM.docdoc e669dbdd714585009681a2d096d33b242836587dab56be165722553c1b119454Virustotal results 36.67% Heodo
2019-12-12L_22127141.docdoc 9b41cb53786a486e00fd172b3b9e3268ec06b000cef6d3a976031edb82ffe7c1Virustotal results 35.00% Heodo
2019-12-12REP_92758047.docdoc 3d80ad311c11470127a15471f9fb6223164b2d23861c9790a36c11bac768ca3bVirustotal results 33.90% 
2019-12-12GG3848428563XT.docdoc 7809b8101b62664377f6e5478f1c76c98d567b803eaba9dcb2030ca4cc992790n/a Heodo
2019-12-12REP_PO_ 12122019EX.docdoc 9fc089e477a74e74b7b0d06faac197d0db58688e9d47f8b6a0d1cd4ec41c7436Virustotal results 33.33% Heodo