URLhaus Database

You are currently viewing the URLhaus database entry for http://www.51az.com.cn/wp-admin/VGnjzwsV/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:290557
URL: http://www.51az.com.cn/wp-admin/VGnjzwsV/
URL Status:Offline
Host: www.51az.com.cn
Date added:2020-01-17 02:30:08 UTC
Last online:2025-07-04 16:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2025-07-03 18:34:10 UTC to abuse{at}kurun[dot]com)
Takedown time:5 years, 6 months, 17 days, 15 hours, 2 minutes Bad (down since 2025-07-06 17:34:15 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2025-07-03f383b7e68c6c0277685d4dc261f2910b74de1cccf1c0b95981fc8e32fa69b77e.unknownunknown f383b7e68c6c0277685d4dc261f2910b74de1cccf1c0b95981fc8e32fa69b77en/a 
2020-02-01Inv_SKW5_3550115.docdoc 1b8390cb75240fd9f9a1471852b1fc3284f0a9704629b52a722dffb676506271n/a 
2020-01-18Inv-Z7177_58875735.docdoc 2f90590da13be020cab94f6054224224af5d674bb07964796cbb051cef5dde3aVirustotal results 27.87% Heodo
2020-01-18Invoice-V23_5456608.docdoc be4d9b3676d0bd95a24755c84b152d727eb0043cb0a2d8c240c567fb1668786eVirustotal results 25.42% 
2020-01-18invoice-157_462083.docdoc f3cbdc44faf63684f682e6faf078854ba2d08c4f80284ccb192508021087101fVirustotal results 24.59% Heodo
2020-01-18invoice-7409_878986.docdoc e4def16e9897c04029e960d9ba6d20e17757ac6084e0e9ecc6cab31c90669e8dVirustotal results 22.95% Heodo
2020-01-17Inv-01_22433556.docdoc f95984ef535315242fca3fc45cb952c5918ca8fecb789f8a803e4e1471a25c94Virustotal results 22.95% Heodo
2020-01-17Invoice_E16_153922.docdoc a8c4e3f1c16e9ff3857699615d8f6bd392a4d88dfdc6f9dd9b43b523ac3158ebVirustotal results 19.35% Heodo
2020-01-17INVOICE-ZMK5738_303160451.docdoc c1773292833e3d31b42687618328bfc2e893bc2262b9d3ddeda0dd585eb5446aVirustotal results 19.67% Heodo
2020-01-17Invoice O451_46021621.docdoc 612232f5fbbd7e962ff9a576f1a32be4fe4dc541a1bf7dad094becace6e2443dn/a Heodo
2020-01-17Invoice YGQX7222_634100.docdoc ba41ad73fcdce6b4e813741379ada938bdc3b9f751255d0f38bf9e39833dd000Virustotal results 23.33% 
2020-01-17INVOICE_1_633117.docdoc 5b5d276c15b051d7bd90d0a94065b9989ff8678436c073df253abb3dc9d5f2c1Virustotal results 22.58% Heodo
2020-01-17INVOICE LC4_935585382.docdoc 127fbb144e09a37a3fb74478730d2c431fc0876897035497e7dce1c49d3d539fVirustotal results 20.00% 
2020-01-17INVOICE-C499_572107065.docdoc 00f75724fcb4f68254a9f4fe7f165b94256863fda19aff094ac9899e4d4ae4c7Virustotal results 19.35% Heodo
2020-01-17Invoice_JBW4_775789152.docdoc 6a30e995f8d4b431a06066f77625efb700c679b72dd760d573016bfb6c391a87Virustotal results 18.03% Heodo
2020-01-17Inv_PRY853_521565.docdoc e09d6c6471feb40345f420439b9c6a3a12ad485be6d8be5a8568b50fcee2b422Virustotal results 18.03% Heodo
2020-01-17INVOICE RTD9_1032890.docdoc c682de9b99812ab7c470a026d17e1060364b9bf4e1890d733b05ef312452f8d8Virustotal results 19.67% Heodo
2020-01-17Invoice BM685_2643148.docdoc efef469ac7e82a2301e3e2da0c734792182828663bd6d178f0d773bb4c37f07aVirustotal results 19.35% Heodo
2020-01-17INVOICE_LAA833_2848658.docdoc 705c0fe4297531835d50b0458ac82dd33ecc2372332fa70d25d6f723ee898671Virustotal results 19.35% Heodo
2020-01-17INVOICE-T461_132555089.docdoc 7a51d9e976d8778788950f5c677c677cdea8a828a49b9306cee884e85d66c448n/a Heodo
2020-01-17Invoice-61_186615.docdoc e54979318c06a7cc3d8fb5f00d32d0fa2a169f8447a224ec8822749071c550f6Virustotal results 37.10% Heodo