URLhaus Database

You are currently viewing the URLhaus database entry for http://zardookht.ir/wp-snapshots/paclm/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:299499
URL: http://zardookht.ir/wp-snapshots/paclm/
URL Status:Offline
Host: zardookht.ir
Date added:2020-01-28 04:50:12 UTC
Last online:2020-02-23 13:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-01-28 04:52:03 UTC to amir[dot]akhoundi{at}ouriran[dot]com)
Takedown time:26 days, 8 hours, 41 minutes Bad (down since 2020-02-23 13:33:03 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-01-29VW8417024906KZ.docdoc 135e6e64bd7742b372ada6b825319eb55fa6081a563f2bb5b8c41b146badb7e9Virustotal results 32.26%Heodo
2020-01-29PAY_LKJS3NN35EKA4P2.docdoc 1fdfbf7f30a7e8b1dcea188b87f98b95a33b4d708bb434ceb97f14fb0d870275Virustotal results 33.33% 
2020-01-29RP_136240811.docdoc 2974d01a1a4da0562902c3971327dcc14301362344429bb27e64548127418106Virustotal results 26.98% Heodo
2020-01-294859044957646872852.docdoc c39aa63290c4b66475a91f31655d381cb05d871f118ec9c5128f64d19dadd59fVirustotal results 26.98% Heodo
2020-01-29PO0719282078TE.docdoc 0ecee5bf68cc63fa4be97a02959091ef6d16df3f32ef3e438a8936658c9e4feeVirustotal results 26.32% Heodo
2020-01-29ST_PO_01292020EX.docdoc f8f81a064bdb565bc4c924978b55c540c33829d0fcdef91f3fa12d6c102a50f5Virustotal results 28.57% Heodo
2020-01-29DOC_56922128383475526168.docdoc 3bf12769229661d5dd0a25950302e189697b914c141c2afd1b39219a381a4becVirustotal results 24.19% 
2020-01-29ST_TBY_010120_STS_012920.docdoc 9bdef37e7bb472e96094bda10305a1ddf86f819c9b420a0f3ebf9aa624aa0fd4Virustotal results 26.67% Heodo
2020-01-29FG0590094776SI.docdoc 68acc39757788a8708e49c907d5e1ee5625da548d421327f759e8cd6be844c99Virustotal results 43.75% Heodo
2020-01-29S_ZRH_010120_PIP_012920.docdoc 7f356527ac507ffcec77b82de4fd38a36f61e6102547dfdb67116eca1566ac60Virustotal results 44.44% Heodo
2020-01-29FILE_694PTS79BU3R.docdoc fc03a02b0660ccb6a067febf4c13372cb4f18c18bacacae9842d53d48fc4b6e8Virustotal results 42.19% 
2020-01-29DT78S0NGYTFNY8U.docdoc e52715b694f6cdc90821034038903a67121b9f80502757bdce73ec1bc3a0e406Virustotal results 40.32% Heodo
2020-01-28PO_01292020EX.docdoc d049be38a287df1e2e1ba9d2b6426c925a97ce5d71ce1ca10028a9345fc06cdaVirustotal results 39.68% Heodo
2020-01-28SW_0T6BA4QW.docdoc 0d9df05fda4de4dc764d3276175ad0a1de0b5e4cb03147cf4e0774894d9406b2Virustotal results 41.94% Heodo
2020-01-28QZMJV8HR6H.docdoc 69870612eec211dca6a4b7da2289fae4d1560824eeaf57088fc35b6c124c4804Virustotal results 37.10% 
2020-01-28REP_L1V1DH5EB.docdoc 18b907b9ce74511ea5a44e541b4f1085c6cbcee6422a0d67df58675cd7753e5aVirustotal results 35.48% Heodo
2020-01-28N_PO_01282020EX.docdoc a5c74dd5fb3a758bde71214750ecc2fbac51879e09a8bdb8a3dbc0764f19f3a3n/a Heodo
2020-01-28BAL_IFM_010120_SWI_012820.docdoc b1ab99a923481add4837b0cfdd043d0cdc32ef155982d00666e1ce577377cd51Virustotal results 27.12% Heodo
2020-01-28QJJV844K98.docdoc 4fbe553d5c4888a202aee17a26e78193be76b493cb981fd2f5fb015d0c25e185Virustotal results 24.19% 
2020-01-28GN34W2OZCZ8CI8.docdoc 9980032e1043354ebc75f35cbc87f2ce29c74078f007909d1a5822f6556e20ecVirustotal results 24.19% Heodo
2020-01-28BP_XCP_010120_NFP_012820.docdoc 7d3a3874f861a74507017ef33df30b4d919a29b0c3cd5a880fad08914d6e3e79Virustotal results 22.95% Heodo
2020-01-28PAY_PO_01282020EX.docdoc 29a975ae2b4e3d310e5d3bd432f4df6db24d5d3622aca20e8e0dfda95bb9d420Virustotal results 26.98% Heodo
2020-01-28BAL_YMS_010120_WRD_012820.docdoc 566db9b01fd935b2a8a63aca4b9f41becf0fa76eb8d74ba2b1c5920d70bdffbfVirustotal results 26.98% Heodo
2020-01-28PAY_PO_01282020EX.docdoc e7f338528d7e25e6e9f27ffe587394a3515876d82e989bcf0ed6ee939f67e51en/a Heodo
2020-01-2894758598.docdoc a42772fa59afc7ba2e87cf8a02a2080453cf603a67d65c61f4f997c1c2dadc06n/a Heodo
2020-01-28SW_CM93SLHUMJS.docdoc 726fe3a86f202ffbce80e52bd30501e05747819355ed9bd32f0c7346a497c7edVirustotal results 22.22% Heodo
2020-01-28CSY_010120_BBX_012820.docdoc 6f3fc64cc5874fc03f7e564c4c117aa694fbce96e69e40c4a52b96a5d6b84211n/a Heodo
2020-01-28RP_W9ZME098MEKSUD6P.docdoc 3460ecdf6f2885cbca4dbfaeb9196093bcc127c677e3e966ed8f4ecb6f971a61Virustotal results 43.55% Heodo
2020-01-28INV_PO_01282020EX.docdoc e06a185bcd4fa3a4767d9ce03a82a2a5e066a4e299916ac0c94d21ceff291e6eVirustotal results 44.44% Heodo