URLhaus Database

You are currently viewing the URLhaus database entry for http://www.dienlanhducthang.com/bch/fxVNFR/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:268164
URL: http://www.dienlanhducthang.com/bch/fxVNFR/
URL Status:Offline
Host: www.dienlanhducthang.com
Date added:2019-12-13 07:59:07 UTC
Last online:2019-12-20 08:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Status unknown
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2019-12-13 08:00:03 UTC to hm-changed{at}vnnic[dot]vn)
Takedown time:7 days, 0 hours, 8 minutes Bad (down since 2019-12-20 08:08:50 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2019-12-14Bonus Payment VK25795.docdoc e8d3e9d5d4c9257a079e4140d2a7806854440a260a933a0f46c2d3a1979ecc9bVirustotal results 30.00% Heodo
2019-12-14Bonus Payment Notification P7614268.docdoc 2aa6984c470e837755d50b32f00bf272b534bacc4a942b0fe8fe19788a7cb20bn/a Heodo
2019-12-14Notify 3250.docdoc 2c0cb30b037c87e7d577b35d59e60b9517518256ec73c701e179142424011e51Virustotal results 30.00% Heodo
2019-12-13Bonus Payment Notification PS592.docdoc 5a26b5ccecce0e460d15aaa4aaeed2db020967361d62a14b9a68cb9fb7f2f51bn/a Heodo
2019-12-13Bonus Payment Notification BJH24850416.docdoc ab3b1e5d75fbd378cf84c9ccfa3a70958f158d6cde8b321e3dadc80586182a6dn/a Heodo
2019-12-13Bonus Payment Notification QM33828895.docdoc 989cc9dd654ecb6687eec34fa5f51f6cffba0d7f021364203d80117642f9a877Virustotal results 27.87% 
2019-12-13Bonus Payment VBZ570291.docdoc c64aa3dc3a30ca1bb8f56d5a0c9b2e23831c56eb5e6577e4bd4ac56c53641094Virustotal results 32.79% Heodo
2019-12-13Bonus Payment Notification Z1666545.docdoc 127411738bebe8bc1ddb86c3f12f66da1c815a165c6dcc28e69a5183722aa6a7Virustotal results 27.87% 
2019-12-13Bonus Payment Notification 0178253.docdoc 1d9d018983c19aba80412aef9e7c2d0f7e71c28ae8770d785819ef49fb467c5aVirustotal results 26.23% Heodo
2019-12-13Bonus Payment Notification P841174.docdoc f3308d1afd3ae3633c4137d9110f38e98107af7af02e0a0311a2a1aa5063af32n/a 
2019-12-13Bonus Payment BL721897755.docdoc 706b9f216096b918ed5f19af7d81997092dad599ee5cb345f1c65b70ee9499c1Virustotal results 25.42% 
2019-12-13Bonus Payment Notification J312587.docdoc 329fbd302495873b30a142e762b72bbee970207464af6cff2ebea7410756921bn/a Heodo