URLhaus Database

You are currently viewing the URLhaus database entry for http://wqapp.50cms.com/addons/cH/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:300809
URL: http://wqapp.50cms.com/addons/cH/
URL Status:Offline
Host: wqapp.50cms.com
Date added:2020-01-29 05:02:30 UTC
Last online:2020-02-14 10:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-01-29 05:04:04 UTC to abuse{at}tencent[dot]com,abuse{at}qq[dot]com,jsquare{at}tencent[dot]com,dreamsruan{at}tencent[dot]com)
Takedown time:16 days, 5 hours, 16 minutes Bad (down since 2020-02-14 10:20:34 UTC)
Tags:doc emotet link epoch3 GandCrab link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-01-31Invoice MK120_843475.docdoc 813226187f75c12909c10d00dfafe96c916ad768979a68def760048753fdea9eVirustotal results 34.38% 
2020-01-31INVOICE-PO92_4305219.docdoc 797c8a01976f70efa8f735c4a8f0d80a805578978d7f025c204d3e99a1a67d29Virustotal results 33.33% Heodo
2020-01-31Invoice_PQI041_511944571.docdoc 5f956252e9f433a4b7675b2422ef016eac5627672a114bfafbc0c667a22db5ddVirustotal results 34.38% Heodo
2020-01-31INVOICE-J0676_742928.docdoc 1c2d2dcc9e0140fd9e9055a697ec4c2c969590ba93a2f5ebf75bde37cc7ba0f1Virustotal results 33.87% 
2020-01-31Inv-WOI85_3605963.docdoc 2a154df78f570ed8acf939ecc71aa078e047b4a0b7cadbcc449df5c0d3f0f665Virustotal results 34.92% 
2020-01-30INVOICE-XF4208_343561959.docdoc b93c176b25e95c8538cc6e80bf1dca7b57ab9a7fe306415caed9989f1c306dd3Virustotal results 33.87% Ransomware.GandCrab
2020-01-30Invoice-PV4_64700165.docdoc 8aa2f0d5d11a3aedd257f45c6768e0c8af5a1473436c6e956d5455494349ab8cVirustotal results 34.38% Heodo
2020-01-30Inv-P7_8033796.docdoc 9e5e33a967ae502e2a528fd31502336cc68f2deff565b4760bc2eee148ae87f7Virustotal results 35.48% 
2020-01-30invoice X825_3323017.docdoc 0cd2361c959ed9e7e67f305e10241dac8c04cf6aa8816a02fa0ecd57f3b8e66eVirustotal results 35.00% 
2020-01-30invoice Y8957_420456.docdoc c0ef60e9ae4ffd63004837885e296e68eae72f32531f67e363d5715b86d63da5Virustotal results 39.68% Heodo
2020-01-30invoice-KC690_364923.docdoc ea0054ea77bae531dfe21c9c57ed960e3fdea5d9d5472e752c8cb6e12589e6f1Virustotal results 35.94% 
2020-01-30INVOICE-NLDE96_150803341.docdoc ded5ade432b903d65d1c0b0c15075f658c1976998f6e3e0b5c5a7c794c06573bVirustotal results 39.34% 
2020-01-30invoice-OC37_574174448.docdoc f274292ec06934b8c2417a6103a2558010703119785efb96e2443e57f4e1c658Virustotal results 34.38% Heodo
2020-01-30Invoice J383_83596092.docdoc 9440498706f2d925d78ed85c677ee615fe3fdf05c7188cf59cadf543e59e0c32Virustotal results 32.81% Heodo
2020-01-30invoice 2_111649411.docdoc d1dcb4fa88a056a19af9634c99847a108027f1a0f5c3fc9d0219fc0f8d676b24Virustotal results 30.16% Heodo
2020-01-29invoice-76_624134336.docdoc 5452b9448c3310adaa86f6020c32d6ae4727fce5049f613ad9242e2f35e94effVirustotal results 22.58% Heodo
2020-01-29invoice-VPS92_2567311.docdoc e14bd51bea91be160aefdfd75c853ce85ef348e87400f0d1e14b64c7d46eb748Virustotal results 33.87% Heodo
2020-01-29invoice_LUTB995_74604138.docdoc 829a7809009f98e48474acb1055638a301574dc66340f546a4f96029e8a6cb9aVirustotal results 29.03% Heodo
2020-01-29invoice H1353_204496066.docdoc 0e7d6a780c7dedc2d2625158cde219a2df7eb7b37a509c810644085e1781eb12Virustotal results 29.69% Heodo
2020-01-29Inv-92_916351445.docdoc d965b7c533614e4ad1f1a9090edd5e83a4f4aae50a67b1ab1158ceaa31cfe7c0Virustotal results 29.03% Heodo
2020-01-29invoice_6_7296538.docdoc 7522a47f398818f54f95582e8d122a7bbd81f69c9807cc61fa12d0fc15a2e39bVirustotal results 27.42% Heodo
2020-01-29INVOICE-4_1172506.docdoc 3be00db967f63065494037f5de7659deb23f83c948d103057222421fc50cc775Virustotal results 28.57% Heodo
2020-01-29Invoice-N5499_1733641.docdoc 603a04c67b941a3ff9345c94e890896e5570dd544e8ca3998f5197f45ab28f00Virustotal results 26.56% 
2020-01-29INVOICE-JGIF99_18539136.docdoc 19f29957bde797c4505244aec4c78ca3ff7e264967215abd6444d9f7c31da7edVirustotal results 25.40% Heodo
2020-01-29Inv-RNE9_757244929.docdoc b14d70827d5d668aeb31e94be512fea9fb38ead8ec12cdf7617616801c76b6e9Virustotal results 32.26% Heodo
2020-01-29Invoice_WCE8_818310.docdoc b9b47debd4d9fb932401d580847e8c3f82b770c5163dbc7d405aefb5cc704a1bVirustotal results 31.75% 
2020-01-29Invoice TGSI1111_510729.docdoc 7cf8f24d7e8b1e2f63bfa7a18cd420a03fff44126e80aed8cb90fba3c4e986acVirustotal results 52.46% Heodo
2020-01-29Inv NMQ7780_411253233.docdoc f51d2aa766b1b07701a52e866f50132c0fcfaad288c1aaf13c781a66db3168daVirustotal results 47.62% Heodo
2020-01-29Inv-JB245_06724323.docdoc b34f4ec4ae8d66b030f547efe3acc2a71c9ab564f78aac68719ec91dab613bb3Virustotal results 47.54% Heodo
2020-01-29Inv-IK772_971387790.docdoc 0a84308348fee6bbfe64a9ef23bb9c32cb319bcdf5cf78ddfda4a83dadea4b8eVirustotal results 45.31% Heodo