URLhaus Database

You are currently viewing the URLhaus database entry for https://kexmoninfrastructure.com/construction/jm/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:303685
URL: https://kexmoninfrastructure.com/construction/jm/
URL Status:Offline
Host: kexmoninfrastructure.com
Date added:2020-01-31 05:42:05 UTC
Last online:2020-02-06 03:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-01-31 05:44:02 UTC to apnic{at}cyfuture[dot]com)
Takedown time:5 days, 21 hours, 43 minutes Bad (down since 2020-02-06 03:27:42 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-02-01invoice-KGB7_399961105.docdoc 89008727c318eb8855e55ca132a09e1676e04483f24e910ad164d7eee4b3c33aVirustotal results 34.92% Heodo
2020-02-01invoice-64_0496974.docdoc 970df6100d8375af169bb259df2c7bb1ad641294e34ed57dc3ad02a38371b4c7Virustotal results 36.51%Heodo
2020-01-31Invoice IDV5278_27563330.docdoc 3c898038b0729e908f29fc28f0b7b4032f71c1bc46d890ded09e2b435bb75256n/a 
2020-01-31Invoice_UVOM8735_49916111.docdoc 7d36bd087bf192b32fc6a40a94b79081e1d7d25d356a9697a158b29bcc1d073aVirustotal results 31.25% Heodo
2020-01-31INVOICE_4_306719.docdoc bc79e24ba2ac5c6cfe39026ed82318cd18feb73fd5f8987ffcf5b7f9cdd9af0bVirustotal results 34.38% 
2020-01-31Invoice-VLT942_41300710.docdoc 1c1ee91ce47a73525fb005c941777860af76c0ce946b7e56c26d920e9cfd2c25n/a Heodo
2020-01-31Inv_0_25190135.docdoc 3e43537c29e5174e6e982ff2cfa6b7752413a26de10839b58420ceb8a425c316Virustotal results 28.57% Heodo
2020-01-31Invoice-PH78_5797052.docdoc b777b2c1bf49b5a05bd8241ae61fbcfa3c3c96cd899ef9ff4215bc6121945da2Virustotal results 22.22% Heodo
2020-01-31Invoice TSON22_509647283.docdoc a7b7c834a9ba78a0dc99c2464438070f71eaef06ee9c57af57b9b11c4b0e3b2bVirustotal results 20.31% Heodo
2020-01-31invoice-T21_31278959.docdoc cf5dba5032b0f5bb0d64f3622bfeb7e35d27c6892d6ba1daa6f07cae87b1566eVirustotal results 20.31% 
2020-01-31INVOICE_3_52747800.docdoc 1fdae9fc6aa69ff362c050d3b72b7ea035f4347be47b332d1cf733a6a60ebf62Virustotal results 27.12% Heodo
2020-01-31Invoice_MS1558_237747.docdoc 322bc97effba52663f35f592be159313057162f0b75287845c440a3971648cb7n/a Heodo
2020-01-31Inv-QOA0_42841113.docdoc 0668a44b54d70499bb0ba03c8fc66fe388ac0acdbb91c6284ea3683c00aad183Virustotal results 17.74% Heodo
2020-01-31Invoice-K5_79206499.docdoc 1588ef587024ad7de73a0791fa28080025d2b56083263d8c9a597c2a4526ef1eVirustotal results 20.31% Heodo
2020-01-31Inv 6055_6299385.docdoc 64fed04221b3089f9ca965d7265619bad9d87b2d65ce2f55c04e3f3f95c5db4dn/a Heodo
2020-01-31Invoice_DCHW821_0587323.docdoc 3787564ed34e427bb2a2d38b16eb007660f36dffcbb6a32b4f38768073b582feVirustotal results 20.31% 
2020-01-31invoice-788_284174.docdoc 2a154df78f570ed8acf939ecc71aa078e047b4a0b7cadbcc449df5c0d3f0f665Virustotal results 34.92% 
2020-01-31Inv-3_33620438.docdoc 6bf02ed6ce271b7b41f52e119fb8d366669e9b26f307aecb1620315034e4443eVirustotal results 34.92% Heodo