🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

URLhaus Database

You are currently viewing the URLhaus database entry for http://gemapower.com/wp-content/aj917n7-0h4-0291/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry



ID:268150
URL: http://gemapower.com/wp-content/aj917n7-0h4-0291/
URL Status:Offline
Host: gemapower.com
Date added:2019-12-13 06:42:07 UTC
Last online:2019-12-16 11:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Blocked
Cloudflare :Blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2019-12-13 06:44:02 UTC to abuse{at}cyberdata[dot]co[dot]id)
Takedown time:3 days, 4 hours, 44 minutes Bad (down since 2019-12-16 11:28:32 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2019-12-14Bonus Payment Notification GN016.docdoc e8d3e9d5d4c9257a079e4140d2a7806854440a260a933a0f46c2d3a1979ecc9bVirustotal results 30.00% Heodo
2019-12-14Bonus Payment Notification VMD472404.docdoc 398558c05eadf7cd53b6b1a24c5d4a55f98fc0e579775f20b6dee8da34b8fc6cVirustotal results 29.51% Heodo
2019-12-14Pay Payment PO639191240.docdoc 2c0cb30b037c87e7d577b35d59e60b9517518256ec73c701e179142424011e51Virustotal results 30.00% Heodo
2019-12-13Bonus Payment Notification M103336653.docdoc 3c01fd4743e5de5c3f320a29d001b6a47095eebde50a10bf46f26b97292ecc11n/a 
2019-12-13Pay Payment VD32747003.docdoc 654f3d7188f7761b4ed2c79c6a18d7c041b0ad3d3c3931cca54e46cc3e18ee8aVirustotal results 29.51% 
2019-12-13Pay Payment 3031.docdoc 61bd31127d7986d44e8d0a56bb5f11c6ad0d5bcbaac574580da229469c7b0f71Virustotal results 29.51% 
2019-12-13Pay MOB45932773.docdoc ab3b1e5d75fbd378cf84c9ccfa3a70958f158d6cde8b321e3dadc80586182a6dn/a Heodo
2019-12-13Pay SF60373252.docdoc 989cc9dd654ecb6687eec34fa5f51f6cffba0d7f021364203d80117642f9a877Virustotal results 27.87% 
2019-12-13Notify 54650951.docdoc 4c27e4f535f1981dc693f0f74772eb7516fc620404cd6de6c1ca70d19577bd20n/a Heodo
2019-12-13Pay Payment 668.docdoc 127411738bebe8bc1ddb86c3f12f66da1c815a165c6dcc28e69a5183722aa6a7Virustotal results 27.87% 
2019-12-13Notify NE777244399.docdoc 1d9d018983c19aba80412aef9e7c2d0f7e71c28ae8770d785819ef49fb467c5aVirustotal results 26.23% Heodo
2019-12-13Bonus Payment Notification XLW0148164.docdoc f3308d1afd3ae3633c4137d9110f38e98107af7af02e0a0311a2a1aa5063af32n/a 
2019-12-13Pay Payment FO0815882.docdoc 706b9f216096b918ed5f19af7d81997092dad599ee5cb345f1c65b70ee9499c1n/a 
2019-12-13Bonus Payment X571858004.docdoc dd0b91f6cdd8818a14e592837a5e3055a15b1676166d1513944b22216edaa733Virustotal results 24.59% 
2019-12-13Bonus Payment Notification K12774729.docdoc c0197a5e801dee8d80df024c32a616c04539a56108b2225b469c7eb5fede5447n/a