URLhaus Database

You are currently viewing the URLhaus database entry for http://maraxa.cz/507YXPAY/QN6920196STMDA/4778487818/ATJN-UXN-Aug-09-2018 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:40241
URL: http://maraxa.cz/507YXPAY/QN6920196STMDA/4778487818/ATJN-UXN-Aug-09-2018
URL Status:Offline
Host: maraxa.cz
Date added:2018-08-09 05:16:26 UTC
Last online:2018-09-08 07:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2018-08-09 05:17:14 UTC to abuse{at}wedos[dot]com)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-08-10PAYMENT 2RCJWDYX.docdoc 8de305b293446832443b59a5cb64b332297899625e12ebb28f12f7612f02b214Virustotal results 35.00% Heodo
2018-08-10PAYMENT 73964CNQLCJGO Aug-11-2018.docdoc a5470f723b60f5857cb440672eb33b431274064c10b5f61000786c56a31b44c1n/a Heodo
2018-08-10WIRE 8745EAOFMCA.docdoc 03332a430c38c770377d70a9315b85c8a70da60d53a8da23008b3b53eab6d95dVirustotal results 35.00% Heodo
2018-08-10PAYMENT 8QSW Aug-10-2018.docdoc a3bdbf915ea341df524f11475ddbd70785e8fa544291e52739c2dded2e087e5fn/a Heodo
2018-08-10ACH 724155HKPBVJH Aug-10-2018.docdoc dbde9292cbefe9efdb2e701469636e0c7825ac33bcb0595fd5a9f86e0a45fe44n/a Heodo
2018-08-10PAYMENT 92YKXQZEFN Aug-10-2018.docdoc 6099ee06c408aa011e2e27a8d32bb29a7418ca9fa5d63038df70c18b8853f95dVirustotal results 35.00% Heodo
2018-08-10WIRE 00317JSPIZMJJ.docdoc f0bf639da101f2a263b164a6eba4b6da81e7665ad82a0b33f6f360fc74babcd1Virustotal results 35.00% Heodo
2018-08-10PAYMENT 47WT.docdoc 3751fcf093e112800f61a83b4ed5392a6665ef1d8be22a104111aec55b39d709Virustotal results 35.59% Heodo
2018-08-10ACH 4292ATL Aug-10-2018.docdoc aea801f386a57a8b1bc1ec560cac259455cf1de3fbece36ab27ab54cba4805c7Virustotal results 36.07% Heodo
2018-08-10PAYMENT 4343201AJO Aug-10-2018.docdoc fc368060fb4946b073b55e56d495e7ab249dbdabbc8f7cd809b55089c9854feaVirustotal results 33.90% Heodo
2018-08-10WIRE 0GU.docdoc 56de2fad613807e46613e7159681a962cc8c54fc6ed20c7c3e90e104cdbfeaffVirustotal results 32.76% Heodo
2018-08-10PAY 96WVXVRG.docdoc a10a4ba4a1727a05d019f8f59d90d72419e63bb4d3c80c49037a194f77592563Virustotal results 30.51% Heodo
2018-08-10WIRE 1206QO Aug-10-2018.docdoc 21e781747a69ebeda636616b47fdd4ff871b9c672aad10f3cf95cbd55eb8b169Virustotal results 31.67% Heodo
2018-08-10WIRE 076ZYZ.docdoc 21982965fc5661c509d1833f8fe9caf02d7649619b7b542d7a735abd7936a9cdVirustotal results 32.76% Heodo
2018-08-09WIRE 18KYKMQ Aug-10-2018.docdoc da09534b67058e48e72b4a9b7a1d620818291bd7f684a4b05ce6a08ce079c90fVirustotal results 31.67% Heodo
2018-08-09ACH 137LK.docdoc cfa7724adc8ed5123e38607f34fbbd7bbdeb531ff1456b0733070f15c2ab1217n/a Heodo
2018-08-09PAY 404724OLA Aug-09-2018.docdoc da69c0df6a11eab120671b1c93d08b3afada374c4f2246382a9b90304552888an/a Heodo
2018-08-09PAYMENT 1532GYETF.docdoc 5b3165e554a96d03bd5f5c743b1b73ea35447bcd7ad01656b36cbb1c298f8499Virustotal results 30.00% Heodo
2018-08-09PAY 342RIJE Aug-09-2018.docdoc fde9fe137f4cef20e171def30b5a72122b9278ac4cd94f020b293da84028dcfbn/a Heodo
2018-08-09WIRE 1549ZSNPU Aug-09-2018.docdoc 9c45f42b5e6c88fc0d80708c11a9931be80e44aaea9a895379b8c8e2d92e1d19Virustotal results 39.34% Heodo
2018-08-09ACH 789TQW Aug-09-2018.docdoc 21657d092fa076607025eb55d39cc40b60c6babba1baa2e40e07cedf1a803227Virustotal results 39.66% Heodo
2018-08-09PAYMENT 48891EA.docdoc bbf29576a9e6c27d0a9d3fb3db156cf40fd0e36b540f12dfd63eea99e41f6defVirustotal results 37.70% Heodo