URLhaus Database

You are currently viewing the URLhaus database entry for http://yuweis.com/wp-content/37d-7lg-62/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:303681
URL: http://yuweis.com/wp-content/37d-7lg-62/
URL Status:Offline
Host: yuweis.com
Date added:2020-01-31 05:14:08 UTC
Last online:2020-02-14 14:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-01-31 05:16:02 UTC to abuse{at}tencent[dot]com,abuse{at}qq[dot]com,jsquare{at}tencent[dot]com,dreamsruan{at}tencent[dot]com)
Takedown time:14 days, 9 hours, 24 minutes Bad (down since 2020-02-14 14:40:18 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-02-13INVOICE-L240_4112618.docdoc 699a0df1d7e4d88374680fa5b59eb53d086368d9337e18bf44186d9f12a3c864n/a 
2020-02-01Inv NZDJ11_8153976.docdoc 970df6100d8375af169bb259df2c7bb1ad641294e34ed57dc3ad02a38371b4c7Virustotal results 36.51%Heodo
2020-02-01INVOICE_XZ58_1788341.docdoc c7f8a534675b643449abfdf573e7b23803ecce479e90653ba295ae4d5f82995eVirustotal results 36.51% Heodo
2020-02-01invoice-UHOG103_173210163.docdoc ef9d72c4261ed3ba5e294d8ceb14d860b9df7f8eae2f550b8caea5550d3380c7n/a Heodo
2020-01-31invoice-CQAO2_554265.docdoc 1e0386b417804238140c5a047a6abbe6d561b0d67c0ab65173f3b5b22b687d51Virustotal results 36.51% 
2020-01-31Invoice-II36_28367674.docdoc 66cf6a1cda9e240560d3dd09a638f88527ba60dc15d9d5716e63c8ad1df5e954Virustotal results 32.81% Heodo
2020-01-31INVOICE-YKJL68_266723020.docdoc 3c898038b0729e908f29fc28f0b7b4032f71c1bc46d890ded09e2b435bb75256n/a 
2020-01-31invoice_RFAU7_543934850.docdoc 93f30df7007372c3e96246ac6e4f6aada7422dabc2cca1dce79322aa17715aa4Virustotal results 31.75% Heodo
2020-01-31Inv MCM5_95662594.docdoc bc79e24ba2ac5c6cfe39026ed82318cd18feb73fd5f8987ffcf5b7f9cdd9af0bVirustotal results 34.38% 
2020-01-31Invoice HK0_654762263.docdoc 1c1ee91ce47a73525fb005c941777860af76c0ce946b7e56c26d920e9cfd2c25n/a Heodo
2020-01-31Invoice-KWZ35_39395878.docdoc 3e43537c29e5174e6e982ff2cfa6b7752413a26de10839b58420ceb8a425c316Virustotal results 28.57% Heodo
2020-01-31invoice-MA384_16934857.docdoc 33e4df7b63c4cc29a65e8108ed4a9b38735a04ccc24292e4a85e85773ad25b5eVirustotal results 29.69% Heodo
2020-01-31Invoice-RDUV526_597384.docdoc a7b7c834a9ba78a0dc99c2464438070f71eaef06ee9c57af57b9b11c4b0e3b2bVirustotal results 20.31% Heodo
2020-01-31INVOICE_X9159_7681779.docdoc cf5dba5032b0f5bb0d64f3622bfeb7e35d27c6892d6ba1daa6f07cae87b1566eVirustotal results 20.31% 
2020-01-31invoice-07_43921985.docdoc b7240479fd2d092d581c72b25531ea78df9956fb2ea6457b82a34c9c45986bb6Virustotal results 20.31% Heodo
2020-01-31Invoice-HAL231_404520.docdoc 9d887063a7f3798027fe7987b0bc2141ddefde963883c48e1d3ad602fda96e0dn/a Heodo
2020-01-31invoice_COV9174_304303.docdoc 21b6e7719a2afa773453d60937aa333af8e41f515ecf2f2f50301c235971e447n/a Heodo
2020-01-31Inv ODR54_9418460.docdoc 64fed04221b3089f9ca965d7265619bad9d87b2d65ce2f55c04e3f3f95c5db4dn/a Heodo
2020-01-31invoice-GJNA31_4563628.docdoc 1fdae9fc6aa69ff362c050d3b72b7ea035f4347be47b332d1cf733a6a60ebf62Virustotal results 20.63% Heodo
2020-01-31invoice AAN5890_326286431.docdoc 943444f98f1bb22118cddf2198722733aa216ad0aa313ece459ae6e268a9e2c0Virustotal results 35.48% Heodo
2020-01-31Inv 288_852386730.docdoc a9890b29941354d238ff12eddfc6773f5c173ef82fd83e37213178126b943534Virustotal results 34.92% Heodo