URLhaus Database

You are currently viewing the URLhaus database entry for http://expo300.com/ruth/docs/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:268011
URL: http://expo300.com/ruth/docs/
URL Status:Offline
Host: expo300.com
Date added:2019-12-13 01:04:03 UTC
Last online:2019-12-13 22:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2019-12-13 01:06:02 UTC to abuse{at}webhostinghub[dot]com)
Takedown time:21 hours, 22 minutes Good (down since 2019-12-13 22:28:46 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2019-12-13Y0B887O9Y.docdoc ab49efefe457f2c0c050496c1fdc8d586d01c70baaaaee84a831e766db85973bVirustotal results 28.33% Heodo
2019-12-1399002498.docdoc a5609fd7ceaf1a37082aa9daa1062c06900e55018662eb97fc66035dd0536575Virustotal results 26.67% Heodo
2019-12-13DOC_5909229907.docdoc 848735c57e1a6435289594c80b894ae30009e92a9735261b256d15baf27b4cabVirustotal results 26.23% Heodo
2019-12-13KVW_120119_IFV_121319.docdoc f89538264a7e22ccebc45894ff55f363d10a82e0c70ab9cffab2758cf787ebb3n/a Heodo
2019-12-13REP_43538932.docdoc ec0e70c7355494d17949475109a1d6693d27a72cf686547f8f7c94634f49a492Virustotal results 28.81% 
2019-12-1339310521.docdoc 17ed52aabc368ac7fb34e008c50e96a33de32a500d6ef405dab5ad5456d1f9b5n/a Heodo
2019-12-13REP_PO_ 12132019EX.docdoc dd0d6ee5d8038e136406532ba5ba86427b9637b3518b2a4cf26b5d4f058daecan/a Heodo
2019-12-1364669993.docdoc 4640a1f47cdfb050fa7690ad2369a986641ae5d7b0072441060a7e099629cc43n/a Heodo
2019-12-13FILE_791069650274402216481826.docdoc 507875ad75bfefcfedca478bc7338807630f05b37a971f14ea44687a54847aa1Virustotal results 27.12% Heodo
2019-12-13ON_0993738147562.docdoc 25283c249c93d624f6710bdaec09efc08ff9d1db27aff59e7c05e431fc7fb4a2Virustotal results 27.12% Heodo
2019-12-13REP_PO_ 12132019EX.docdoc 84bac96b1cb3bd42694000e4cd6ef996f066ddce2f137e2374cf537a6e07e0a2Virustotal results 40.68% Heodo
2019-12-13FILE_Y70D6J22KK39F.docdoc e2e4f606a0781b7e7a32ffce6227f92e4016ef6f3d5e27a8986014ed27e741f6Virustotal results 35.00% Heodo
2019-12-13F_4N986BU3YM.docdoc 0b46984b2220d0a860fd03530036cf63599137320ca84fdfb8fe7029a952647eVirustotal results 35.00% Heodo
2019-12-13U_LWL_120119_ISV_121319.docdoc acc7ea43de61e6d7bd1a88fde0e40ca54f4dc2d0ababd3ec2d68cee4cc7c4100Virustotal results 35.00% 
2019-12-13PO_ 12132019EX.docdoc d38388ddded5f27b3ff341d7b16df8c400ccba2f718ec3e25ccf3e781b3e4fc4Virustotal results 34.43%