URLhaus Database

You are currently viewing the URLhaus database entry for http://crimecitynews.com/wp-includes/yex-mhz-1388/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:302305
URL: http://crimecitynews.com/wp-includes/yex-mhz-1388/
URL Status:Offline
Host: crimecitynews.com
Date added:2020-01-30 08:32:35 UTC
Last online:2020-02-03 10:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?):mail Yes (Ticket DCU002286484 created on 2020-01-30 08:34:06 UTC)
Takedown time:4 days, 2 hours, 25 minutes Bad (down since 2020-02-03 10:59:09 UTC)
Tags:doc emotet link epoch3 GandCrab link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-02-01INVOICE-KQGN8_89807664.docdoc 970df6100d8375af169bb259df2c7bb1ad641294e34ed57dc3ad02a38371b4c7Virustotal results 36.51%Heodo
2020-02-01Invoice-9077_055127.docdoc b8293e1621d18a41ab502785bdf7c9db017b758601839425ee13e60cd88b9d47Virustotal results 35.94% 
2020-02-01Invoice 8168_373188.docdoc 596840343814720213f9ad50272e76d5436f72a30674e560ba88543b854b2fabVirustotal results 37.50% Heodo
2020-01-31Invoice UP45_168679.docdoc 0e515b40fbfacc6e1f632f89fda79c5bc01fce11baf9bb015aba19ede05b2775Virustotal results 38.71% Heodo
2020-01-31invoice_2890_3246535.docdoc 291fde1b7df03ea3c7e5e4db7fc76f74ac51dd876d9295da30fa9b7ad026388dVirustotal results 32.26% Heodo
2020-01-31Inv-385_60401548.docdoc 3c898038b0729e908f29fc28f0b7b4032f71c1bc46d890ded09e2b435bb75256n/a 
2020-01-31INVOICE FEK286_2699959.docdoc 557385e0fca72ec0e0cb78e4fa3878193ac984e8c59bb33353c6565695d6a1c3Virustotal results 31.25% Heodo
2020-01-31Invoice_K612_381086738.docdoc 7f63ac26d5fec1558b8261f76c16ea58e8787e2fa179df2844136feb2ce0c650Virustotal results 34.92% Heodo
2020-01-31invoice-PYU03_25794486.docdoc 897dc97e808c47688c5b3059d5f3c26eab575728e2cef883e6ddd8243b6912d9Virustotal results 33.33% Heodo
2020-01-31Inv-NJ915_12838529.docdoc 2041559b24b2289ef8263b1c8335bd87424dc62061a72b4bfdd5525b98da6b54Virustotal results 28.57% Heodo
2020-01-31Invoice_KYWX050_055630677.docdoc e01b9d1ec39ab6b746fab54011b045e107974f3d979db52766632eec495d9b59Virustotal results 33.33% Heodo
2020-01-31Invoice-N0037_3790591.docdoc cf5dba5032b0f5bb0d64f3622bfeb7e35d27c6892d6ba1daa6f07cae87b1566eVirustotal results 20.31% 
2020-01-31Invoice-BMP902_525781.docdoc 02d0fca16499272621f28342b9c41dfc3c6133eb9cc3d485b8334de09bc9825fVirustotal results 22.03% Heodo
2020-01-31Invoice 90_7350108.docdoc 322bc97effba52663f35f592be159313057162f0b75287845c440a3971648cb7n/a Heodo
2020-01-31INVOICE_QKCH77_939367862.docdoc e1fe6aa5e952e7f904ab79438277216f1af38d9073fa0f7656c8bbfec0ba6639Virustotal results 20.31% Heodo
2020-01-31INVOICE BRN9_62702621.docdoc 1588ef587024ad7de73a0791fa28080025d2b56083263d8c9a597c2a4526ef1eVirustotal results 20.31% Heodo
2020-01-31Inv-CI5056_04858742.docdoc fc244aba71a46c59805f50c5e9bfbed39277b6c94199062748330ab074a89a11Virustotal results 20.31% Heodo
2020-01-31invoice_WH191_02175502.docdoc 1fdae9fc6aa69ff362c050d3b72b7ea035f4347be47b332d1cf733a6a60ebf62Virustotal results 20.63% Heodo
2020-01-31Inv-C7315_0322949.docdoc 943444f98f1bb22118cddf2198722733aa216ad0aa313ece459ae6e268a9e2c0Virustotal results 35.48% Heodo
2020-01-31Invoice-HTT82_643549189.docdoc 813226187f75c12909c10d00dfafe96c916ad768979a68def760048753fdea9eVirustotal results 34.38% 
2020-01-31Inv-8431_019057.docdoc 8a06475b5843111147926b32b1aecdad3780400157cfae38379d64a78b36139fVirustotal results 33.87% Heodo
2020-01-31invoice Q8_37007183.docdoc 5f956252e9f433a4b7675b2422ef016eac5627672a114bfafbc0c667a22db5ddVirustotal results 34.38% Heodo
2020-01-31invoice 4_275300135.docdoc 8dece0d2130198c1d3acb7688f96392e3ded40745d7d8f7c01f03337209801f9Virustotal results 34.38% Downloader.Upatre
2020-01-31invoice_YJEN4_65169976.docdoc 1092c9cc1b0dbf643c81898c30d3034b4db59f49a86de85ced39a5315ce4549eVirustotal results 35.94% 
2020-01-30INVOICE_1283_566023528.docdoc b93c176b25e95c8538cc6e80bf1dca7b57ab9a7fe306415caed9989f1c306dd3Virustotal results 33.87% Ransomware.GandCrab
2020-01-30Inv O749_38062622.docdoc 7d6d03203cda13942959101d4487c86fa9d270163e2d4800debe50da466398a0Virustotal results 34.38% Heodo
2020-01-30Inv-HAMC3273_425918872.docdoc 18679279d06463ba2ca553b32ba509a6cb62381bda5381ab82d862beb91da074n/a 
2020-01-30invoice 9_86975471.docdoc 0cd2361c959ed9e7e67f305e10241dac8c04cf6aa8816a02fa0ecd57f3b8e66eVirustotal results 35.00% 
2020-01-30Invoice DC721_557009.docdoc 9d23b6da889229ad96e4d4ac90dd6c382fca9006273b8de6254bd3fe1415f403n/a Heodo
2020-01-30INVOICE-R4000_131547.docdoc 4b8c920544a36d2b2fe8e35aafddad4a1052e8cced8e159cf4b9753d1c1a82eeVirustotal results 38.71% Heodo
2020-01-30Invoice-8_14832306.docdoc 55f4b1324dcf648c873b70518a37777563890c60c108b2a3eb40eaa7f5f2f90cn/a 
2020-01-30Invoice-H501_88911469.docdoc 444380961c88bf398e9078529bf648cf7f4cc69a583fea9d036c4427e533d8c5Virustotal results 34.92% Heodo
2020-01-30Invoice 847_703092.docdoc 9440498706f2d925d78ed85c677ee615fe3fdf05c7188cf59cadf543e59e0c32Virustotal results 32.81% Heodo
2020-01-30INVOICE-KJOV28_5837967.docdoc d204a8808c41d9dbf3ad604139c838f916986ce563143b7e41b33c85d22d5973n/a 
2020-01-30Invoice-9072_9708549.docdoc 5452b9448c3310adaa86f6020c32d6ae4727fce5049f613ad9242e2f35e94effVirustotal results 31.67% Heodo