URLhaus Database

You are currently viewing the URLhaus database entry for http://www.maisenwenhua.cn/wp-includes/vNHiIg/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:268159
URL: http://www.maisenwenhua.cn/wp-includes/vNHiIg/
URL Status:Offline
Host: www.maisenwenhua.cn
Date added:2019-12-13 07:31:46 UTC
Last online:2020-03-23 03:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Blocked
Cloudflare :Blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2019-12-13 07:32:02 UTC to abuse{at}tencent[dot]com,abuse{at}qq[dot]com,jsquare{at}tencent[dot]com,dreamsruan{at}tencent[dot]com)
Takedown time:3 months, 10 days, 19 hours, 57 minutes Bad (down since 2020-03-23 03:29:44 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2019-12-14Bonus Payment Notification E380247.docdoc e8d3e9d5d4c9257a079e4140d2a7806854440a260a933a0f46c2d3a1979ecc9bVirustotal results 30.00% Heodo
2019-12-14Bonus Payment Notification 0369.docdoc 2aa6984c470e837755d50b32f00bf272b534bacc4a942b0fe8fe19788a7cb20bn/a Heodo
2019-12-14Bonus Payment Notification HU01616.docdoc 2c0cb30b037c87e7d577b35d59e60b9517518256ec73c701e179142424011e51Virustotal results 30.00% Heodo
2019-12-13Pay Payment 1658.docdoc ba93991c276f3adee4593b4f6891875a14f17ceb39d54006ae90bae675c51c21Virustotal results 28.33% Heodo
2019-12-13Bonus Payment S7353.docdoc a13e83eb3d6576d57de2d5a9f3470d15197650348520eef008902133622840e2Virustotal results 30.00% 
2019-12-13Bonus Payment ZD863621.docdoc 61bd31127d7986d44e8d0a56bb5f11c6ad0d5bcbaac574580da229469c7b0f71Virustotal results 29.51% 
2019-12-13Bonus Payment Notification S5619.docdoc 941883f4ff0a879f4034405695a7cf711416a878b0e414de84c8fd6d6cb7166cVirustotal results 29.51% 
2019-12-13Bonus Payment 2819.docdoc 989cc9dd654ecb6687eec34fa5f51f6cffba0d7f021364203d80117642f9a877Virustotal results 27.87% 
2019-12-13Pay BR460.docdoc 4c27e4f535f1981dc693f0f74772eb7516fc620404cd6de6c1ca70d19577bd20n/a Heodo
2019-12-13Bonus Payment VJS13085542.docdoc 2f3504935e6597fa439dd67660ec0a34500c48ab5107df49af42072b57f9c250Virustotal results 27.87% Heodo
2019-12-13Bonus Payment IR761.docdoc 1d9d018983c19aba80412aef9e7c2d0f7e71c28ae8770d785819ef49fb467c5aVirustotal results 26.23% Heodo
2019-12-13Notify 24406.docdoc f3308d1afd3ae3633c4137d9110f38e98107af7af02e0a0311a2a1aa5063af32n/a 
2019-12-13Pay Payment SJN649563509.docdoc 706b9f216096b918ed5f19af7d81997092dad599ee5cb345f1c65b70ee9499c1Virustotal results 25.42% 
2019-12-13Bonus Payment Notification 251837.docdoc b0cf6737f47fb1eb937f42c7f665c1f6689d4feb171b6e97ff5c963a802feeaeVirustotal results 25.00% Heodo