URLhaus Database

You are currently viewing the URLhaus database entry for https://xcxcd.360aiyi.com/pgdt77wo/skH/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:302165
URL: https://xcxcd.360aiyi.com/pgdt77wo/skH/
URL Status:Offline
Host: xcxcd.360aiyi.com
Date added:2020-01-30 05:17:12 UTC
Last online:2020-02-04 02:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-01-30 05:18:02 UTC to abuse-noc{at}west[dot]cn)
Takedown time:4 days, 21 hours, 19 minutes Bad (down since 2020-02-04 02:37:58 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-02-01invoice-IGY67_195393.docdoc 970df6100d8375af169bb259df2c7bb1ad641294e34ed57dc3ad02a38371b4c7Virustotal results 36.51%Heodo
2020-02-01Inv-DA8714_9504156.docdoc b8293e1621d18a41ab502785bdf7c9db017b758601839425ee13e60cd88b9d47Virustotal results 35.94% 
2020-02-01INVOICE G9802_805118868.docdoc 33b3ec4162e08d960a63f59db559c88ea8d64d270e61f84b3df6c1e712447831Virustotal results 36.51% 
2020-01-31INVOICE_QO5_3987265.docdoc 0e515b40fbfacc6e1f632f89fda79c5bc01fce11baf9bb015aba19ede05b2775Virustotal results 38.71% Heodo
2020-01-31Invoice-IU6_017559.docdoc 291fde1b7df03ea3c7e5e4db7fc76f74ac51dd876d9295da30fa9b7ad026388dVirustotal results 32.26% Heodo
2020-01-31Invoice-NK849_060636491.docdoc 13da986a6313e4f7d8bd759fab4372e49889bc08c005eb19c7942cd26b3d36d3Virustotal results 31.25% Heodo
2020-01-31INVOICE LTYX4214_37379770.docdoc 7d36bd087bf192b32fc6a40a94b79081e1d7d25d356a9697a158b29bcc1d073an/a Heodo
2020-01-31Inv-H9582_173432.docdoc bc79e24ba2ac5c6cfe39026ed82318cd18feb73fd5f8987ffcf5b7f9cdd9af0bVirustotal results 34.38% 
2020-01-31INVOICE_96_635100125.docdoc 48aece09b58178b17b2a09cebbb26f2da0bc3e6140b65d86b642060ec00689e5Virustotal results 33.33% Heodo
2020-01-31INVOICE_FT2_81080019.docdoc 3e43537c29e5174e6e982ff2cfa6b7752413a26de10839b58420ceb8a425c316Virustotal results 28.57% Heodo
2020-01-31invoice 5233_288785197.docdoc e01b9d1ec39ab6b746fab54011b045e107974f3d979db52766632eec495d9b59Virustotal results 33.33% Heodo
2020-01-31invoice-547_9106539.docdoc cf5dba5032b0f5bb0d64f3622bfeb7e35d27c6892d6ba1daa6f07cae87b1566eVirustotal results 20.31% 
2020-01-31Invoice MKQG77_549287.docdoc 02d0fca16499272621f28342b9c41dfc3c6133eb9cc3d485b8334de09bc9825fVirustotal results 22.03% Heodo
2020-01-31Invoice_I6_59798581.docdoc 0668a44b54d70499bb0ba03c8fc66fe388ac0acdbb91c6284ea3683c00aad183Virustotal results 17.74% Heodo
2020-01-31Invoice-GYH5_5729627.docdoc 3566860336b023d9bfc9ea68bdc1228a6897a65cc344973a63e87b04a41c74f1Virustotal results 20.63% 
2020-01-31Inv_JOPD24_39697693.docdoc e37ea56013de3f5e376abe94907f943d3d382cac1855f56a3841694118a80c80Virustotal results 20.31% 
2020-01-31Invoice-562_1009940.docdoc fc244aba71a46c59805f50c5e9bfbed39277b6c94199062748330ab074a89a11Virustotal results 20.31% Heodo
2020-01-31Invoice_DKUD365_418114.docdoc 1fdae9fc6aa69ff362c050d3b72b7ea035f4347be47b332d1cf733a6a60ebf62Virustotal results 20.63% Heodo
2020-01-31Inv-P1_381463722.docdoc ae1cdc48a32c38051b8709d02ac807627572fa24244b491c0d3c9fdb7e73da8aVirustotal results 36.51% Heodo
2020-01-31INVOICE_GKWM4_452773703.docdoc 27d755aa7bf58559ed73cec0d481fe32fe0d81d2f18da774763c0da9e5c15b5bVirustotal results 33.33% 
2020-01-31invoice-REM8_50863079.docdoc 8a06475b5843111147926b32b1aecdad3780400157cfae38379d64a78b36139fVirustotal results 33.87% Heodo
2020-01-31Inv_J0_287323042.docdoc 5f956252e9f433a4b7675b2422ef016eac5627672a114bfafbc0c667a22db5ddVirustotal results 34.38% Heodo
2020-01-31Invoice_Y792_61960985.docdoc 8dece0d2130198c1d3acb7688f96392e3ded40745d7d8f7c01f03337209801f9Virustotal results 34.38% Downloader.Upatre
2020-01-31Invoice Q0_254394306.docdoc ae370246a5b55b8f9dc4d3d0d7041d03f466f3d4260bf0beb48ff4dfa85a5b11Virustotal results 34.92% Heodo
2020-01-30invoice_R1015_974930682.docdoc 228960ea68978d82cf8f245946c0522095c90c78bd4a188a620e87d306c2619aVirustotal results 34.43% Heodo
2020-01-30Inv_U2_190352816.docdoc 344ec62beaa38421243bae13fa80d39d7457a5c8a11c3347366c3e638d1326e0Virustotal results 33.87% Heodo
2020-01-30invoice_FFYB3958_994064822.docdoc 55e09691a61d983f8bb5cb7d81ca1c07171d3248c62cfcd4f3b1a89f5e9a66f1Virustotal results 33.33% Heodo
2020-01-30Invoice-R5284_428821.docdoc 0cd2361c959ed9e7e67f305e10241dac8c04cf6aa8816a02fa0ecd57f3b8e66eVirustotal results 35.00% 
2020-01-30invoice_O5049_507058.docdoc 2e05dae96f07956982b9edba6d64d8668b4ff90f56d548ce2ef2feee40a6e6d5Virustotal results 39.06% Heodo
2020-01-30INVOICE TXZ232_0896392.docdoc 4817eb0931e095dcd5ad20af4725b2da9bb8bd800841f34789aee319897eac87Virustotal results 38.71% Heodo
2020-01-30Inv-C8_4317440.docdoc 70029b2efe245977665727cabe746a92f951297bf034a85f96c12a828c18a682Virustotal results 38.10% Heodo
2020-01-30Invoice-4_1554555.docdoc 444380961c88bf398e9078529bf648cf7f4cc69a583fea9d036c4427e533d8c5Virustotal results 34.92% Heodo
2020-01-30invoice-COAJ5975_498083543.docdoc c5a0f28856e753658d7979a6ab18b47e0a0b4166332f19e992f0091bdc09afe8n/a Heodo
2020-01-30INVOICE WL3027_31046765.docdoc d204a8808c41d9dbf3ad604139c838f916986ce563143b7e41b33c85d22d5973n/a 
2020-01-30Invoice UJTT48_21116692.docdoc 5452b9448c3310adaa86f6020c32d6ae4727fce5049f613ad9242e2f35e94effVirustotal results 26.23% Heodo