URLhaus Database

You are currently viewing the URLhaus database entry for http://csnserver.com/doc/US/Aug2018/Order-59961367211 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:40408
URL: http://csnserver.com/doc/US/Aug2018/Order-59961367211
URL Status:Offline
Host: csnserver.com
Date added:2018-08-09 05:49:10 UTC
Last online:2018-11-27 03:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: unixronin
Abuse complaint sent (?): Yes (2018-08-09 06:03:29 UTC to abuse{at}rr[dot]com)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-08-10Invoice.docdoc f63b36ad268aa960aa5baa6b095514828508395aa7a888dc9c41ae2b0716168dVirustotal results 33.90% Heodo
2018-08-10Invoice.docdoc be067a5bb420931e608a60872fe4cf7f94009e0bfeeffbbeda1fe556ed0dd071Virustotal results 35.00% Heodo
2018-08-10Invoice Confirmation 3G3595.docdoc dbde9292cbefe9efdb2e701469636e0c7825ac33bcb0595fd5a9f86e0a45fe44n/a Heodo
2018-08-10Statement as at 10.08.2018.docdoc f0bf639da101f2a263b164a6eba4b6da81e7665ad82a0b33f6f360fc74babcd1Virustotal results 35.00% Heodo
2018-08-10Inv. no. 07PTG5542.docdoc 136cc4762f5d36541f46e018328397e1bac634a88282587ba26385c780288087n/a Heodo
2018-08-10Review invoice required.docdoc aea801f386a57a8b1bc1ec560cac259455cf1de3fbece36ab27ab54cba4805c7Virustotal results 36.07% Heodo
2018-08-10Invoice Confirmation 4079060.docdoc fc368060fb4946b073b55e56d495e7ab249dbdabbc8f7cd809b55089c9854feaVirustotal results 33.90% Heodo
2018-08-10Latest invoice - 830897.docdoc 56de2fad613807e46613e7159681a962cc8c54fc6ed20c7c3e90e104cdbfeaffn/a Heodo
2018-08-10Invoice Confirmation 4S1879.docdoc a10a4ba4a1727a05d019f8f59d90d72419e63bb4d3c80c49037a194f77592563Virustotal results 30.51% Heodo
2018-08-10Accounts - Invoice.docdoc 21e781747a69ebeda636616b47fdd4ff871b9c672aad10f3cf95cbd55eb8b169Virustotal results 31.67% Heodo
2018-08-09Invoice.docdoc 21982965fc5661c509d1833f8fe9caf02d7649619b7b542d7a735abd7936a9cdVirustotal results 32.76% Heodo
2018-08-09Invoice.docdoc da09534b67058e48e72b4a9b7a1d620818291bd7f684a4b05ce6a08ce079c90fVirustotal results 31.67% Heodo
2018-08-09Statement as at 09.08.2018.docdoc cfa7724adc8ed5123e38607f34fbbd7bbdeb531ff1456b0733070f15c2ab1217n/a Heodo
2018-08-09Invoice as at 09/08/2018.docdoc fde9fe137f4cef20e171def30b5a72122b9278ac4cd94f020b293da84028dcfbVirustotal results 30.51% Heodo
2018-08-09Accounts - Invoice.docdoc c4417fc19a3e7eda5f143672d412b112c5a2f7c5a5ded0ba0c8f9c1604391756n/a Heodo
2018-08-09Invoice Query.docdoc 7f1ab1b669edb934ba6a4598be4ce86de17683d8980b17796a59be1f375c0777Virustotal results 37.93% Heodo
2018-08-09Invoice.docdoc 16c52af73c5ae5f2b52196cc111f1b3c924b0dc4514765728826d8c20331e36dVirustotal results 40.00% Heodo