URLhaus Database

You are currently viewing the URLhaus database entry for http://jeremflow.com/wp-content/neqkgY/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:295838
URL: http://jeremflow.com/wp-content/neqkgY/
URL Status:Offline
Host: jeremflow.com
Date added:2020-01-23 11:08:03 UTC
Last online:2020-01-25 07:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-01-23 11:10:03 UTC to abuse{at}o2switch[dot]fr)
Takedown time:1 day, 20 hours, 42 minutes Poor (down since 2020-01-25 07:52:56 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-01-25Invoice L0_672266741.docdoc 983ddd1518361a6f16f1b4f4980f9f8e195ab46794ddb14935f83c5a93781f17Virustotal results 39.68%Heodo
2020-01-25Inv K0228_8631532.docdoc cc2a02b23102e898d67f5485ed9f922b40b4006521e1ff3d26aeb85195284f8bVirustotal results 38.71% Heodo
2020-01-24Invoice_JB699_6837559.docdoc 75014b9efcb14fb22591a986fdf636d6106b987d956ebbf793aa91c24dd67dc8Virustotal results 34.38%Heodo
2020-01-24Inv-P7859_435363.docdoc 367dfc1505c5c9b6c114c2a8b2b9604b8fd894ce90371f8f6eeabf3f029280d6Virustotal results 33.33% Heodo
2020-01-24invoice-UCG3919_8683561.docdoc 9298f239b41ba2312503b00f930f8bd5886e595b99527e2daefcb02ccb716e9fVirustotal results 33.87% Heodo
2020-01-24Inv FWO8164_59482808.docdoc f632cc29e85b046da247d72a74114c3d50dec27be7e5bae146b9622e2542e59aVirustotal results 29.69% Heodo
2020-01-24INVOICE_2_241915289.docdoc c260f6cd5f516c2c4fbfb823ad262a0577d66cdbe77a0e5ba6d5d7277f66fc1eVirustotal results 30.65% Heodo
2020-01-24Inv-NBK4_0083054.docdoc e44017a7deba31d2c40a8bd2519c68d30883e3590a03407929281ebd1a2d9390Virustotal results 31.67% Heodo
2020-01-24Invoice-T288_8241152.docdoc 3d77b72651e464a5eacd9ec09426f2ed186472e8cd379d628629a6b29be9bd05Virustotal results 29.03% Heodo
2020-01-24invoice-H5969_6580429.docdoc 1794021229640d080ec671b9c7262e9941c79cf43c48c22d1c4b5297212f0014Virustotal results 26.98% Heodo
2020-01-24invoice AVM5_4002476.docdoc 58f4a9350c2c4d061072015bf56382f773719d9d78ad3bba260cece6dce54e54Virustotal results 26.56% Heodo
2020-01-24Inv_CQ63_27257438.docdoc 7dd53825b5d2ade36c33feb1492c3e52cd0a331948cbdb102e2098dbe2811560Virustotal results 25.81% Heodo
2020-01-24invoice_CJK45_769488.docdoc 406168096ae744197949fd532ab6364264b0b639f3dda9e4cb6d13e3c393f20cVirustotal results 25.81% 
2020-01-23invoice-7_522403859.docdoc 6dbf308715c0b429e1b0e16054cdad388a7095462af98c1893432f3967836b53Virustotal results 32.26% Heodo
2020-01-23Inv_FWWL992_0244157.docdoc ed36764d44c72f35ca5df8c3d02db5dec4d7b26089c9d54400169fe15becc2c2Virustotal results 30.65% 
2020-01-23invoice TA14_6532096.docdoc 93cea3c1010026439c96c2937d17417feda4f0ea115804f4fb81ec63b50857ffVirustotal results 27.42% Heodo
2020-01-23INVOICE-S667_900815251.docdoc 22a33574708b807eea150cc268e7d1fdf70c732e334d04b8ccbe81b627da68b4Virustotal results 26.56% Heodo