URLhaus Database

You are currently viewing the URLhaus database entry for https://u-firm.com/tpbnh/ajfx9t4a2gz/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry



Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:415726
URL: https://u-firm.com/tpbnh/ajfx9t4a2gz/
URL Status:Offline
Host: u-firm.com
Date added:2020-07-21 05:25:16 UTC
Last online:2020-07-22 07:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-07-21 05:26:04 UTC to abuse{at}alibaba-inc[dot]com,intl-abuse{at}list[dot]alibaba-inc[dot]com)
Takedown time:1 day, 1 hours, 39 minutes Poor (down since 2020-07-22 07:05:06 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-07-22RZHV_480978687546594904044.docdoc e9803e31e8dd4c70a9e476d9dd61e927988fcc98f5c901e18e0597c8dd765b60Virustotal results 27.87% Heodo
2020-07-22BAL_0UDASNAUNRARCWOC.docdoc f9c93aa61dd4cb64cf59976fbb246f87744328a2a1fd1233945c84fbda2c0aaeVirustotal results 26.67% 
2020-07-22REP_KU0688930005DX.docdoc 6999be5570232cb11189a152478254ef33470426036d88fa74b45305031efb73Virustotal results 26.23% Heodo
2020-07-22DOC_PO_07222020EX.docdoc ee36488e9d6d8ea09cff02367c7212d0503f376346c3b40aed03e01c1b1aa668Virustotal results 26.23% 
2020-07-2292982127.docdoc e563992a8b913e222c4f08cd1cb89a4e4af61dc33d30f455e7e3f4fbd039666dVirustotal results 26.67% Heodo
2020-07-22INV_PO_07222020EX.docdoc adecd8241c21aa989810258e39d162aeb6ec0b86ca6a884fa3a542ad306a1c63Virustotal results 26.23% Heodo
2020-07-22DOC_VTGPATDA57YL.docdoc a76feea95a298d6f94ca0a719376f30e4409a18555e10bdb1e90a24c7facf294Virustotal results 24.19% 
2020-07-22INV_HC3492450747AJ.docdoc c14ddeac4500ec2bb65828bcf770f5ce11a369ca829f2c68587632e1dccfd995Virustotal results 24.59% 
2020-07-22FILE_THZ_070120_CUP_072220.docdoc 5f5a353ccf0dbcfaa0859d0a1db152f2d40735bce47864d7ef9c12ab93c8ca88Virustotal results 26.23% Heodo
2020-07-22INV_OS1683426524BP.docdoc f9b9806f9c7c88864e0ff685eaab801a085f8c567b7d6993101bafa58c4833b8Virustotal results 24.19% Heodo
2020-07-22FILE_29831111.docdoc 0b88f7457627bb2ae6f62990289a2e3f1a378c01892e3715bec08b94d13206f1Virustotal results 24.59% 
2020-07-22J_FE6PM440B04H.docdoc f4ca24a43791c023e2992042afaa7e31c98e1352f74e1b4366f6b52627a51510Virustotal results 24.19% 
2020-07-22DOC_032039816525.docdoc b45b106204a66b5d0111681b932137b590dae6124c7176abee5740917c77e871Virustotal results 24.59% Heodo
2020-07-22FILE_6LH7MSMSV58Q4.docdoc 1ff7a8450997cc013c4527af47bac34423607b8fcda043bca82df0e6b3e823e4Virustotal results 25.00% Heodo
2020-07-22YIS_070120_KTJ_072220.docdoc ed1a41469969a80fefc58566124f44e0846bff21d8e51d897da0d10b2386174bVirustotal results 24.19% Heodo
2020-07-22PI_08999012759687138.docdoc 10963f8cec95f3f18634db9382cd4403523a624d72a459c29c9c3baf27097509Virustotal results 24.59% 
2020-07-22REP_27385779.docdoc 73962239e4a48429f588ed5950e69d8ba450efa22a2265afe97bf689935caf47Virustotal results 25.00% Heodo
2020-07-21REP_3793996482912887111.docdoc c6ca23f36d524391de9970059d2e0faf54270286e320503e3eadf282ab5082a2Virustotal results 24.59% Heodo
2020-07-21DOC_PO_07222020EX.docdoc 737dad0010dfc90068d5db4073a76c04f2e9aa7549373686028374e3bbbdb652Virustotal results 24.19% 
2020-07-21DOC_6787744624510283485.docdoc 5c3d472318679572aeebf4c76cf7f2ead0f39f72e9d9d3e26604c88f35364b4dn/a Heodo
2020-07-21INV_NTA_070120_LRR_072220.docdoc dcd97e231a7928660c49c35be9d5b8f839ccd3e2b8882ddd60c22b1bd012ac4cVirustotal results 25.81% 
2020-07-21NZF_36010770.docdoc bc7398dd8ac94a9ff8ca7a93f0755681ec84ca7fd05058ddc053cd16e1b3f4e3Virustotal results 25.81% Heodo
2020-07-2196533494.docdoc c0af5b3ed8e1c92c57aa0e1b6f60d24b4ddc6a95ae92906d793d88413fa9904dVirustotal results 24.59% 
2020-07-21SQ5976870400NL.docdoc eb1f5512e10d3a5224fa2b7a8d42a8b6fdb1b4fa705c24514c2b04fa6fa3bda1Virustotal results 26.67% 
2020-07-2111758007.docdoc bfb0b36ae7105ad67727e68789279e3550b6750177ae7c2fc1007438f686f070Virustotal results 26.23% Heodo
2020-07-21BAL_GLP_070120_QLE_072220.docdoc eb3009e003594f7c6d5a2c373db44fe65d9acc0be9c31c317bf9ebfad08e633eVirustotal results 25.81% Heodo
2020-07-21FILE_16210437.docdoc 2f4719fe8c7d6c5de85448ec6a443b49b51cbee1b16d7d67e6a8e497a3b5cd7fVirustotal results 26.23% Heodo
2020-07-21INV_ATA_070120_GXI_072220.docdoc 0c69f537211ca18ffdcd88151cd0e09636aec3e5708e6fde3df55bea4884ba5dVirustotal results 26.23% 
2020-07-21406305614.docdoc cd6f41e3821d55917fa4a0cdbe223abdb97ed8da6f7870d449d8e81ed6f9ec69Virustotal results 26.67% Heodo
2020-07-21SQ8591761429AA.docdoc 6616cbabce1dd4cb3515191b2ed913e01a7ffc8b1cff8ec410600930bbdf7f3fVirustotal results 26.23% Heodo
2020-07-21REP_PO_07212020EX.docdoc 5966dbc11d924231b5d148a1a821154f88e469adcb6e884d4dd5102c9e598e9fVirustotal results 24.59% 
2020-07-21REP_FRL_070120_QHB_072120.docdoc a501ba4d5001cfc0fdb0e8b95b1dd154dc0c9c3d3e0ffdce873526f1855bc618Virustotal results 32.26% Heodo
2020-07-21REP_FRL_070120_QHB_072120.docdoc a501ba4d5001cfc0fdb0e8b95b1dd154dc0c9c3d3e0ffdce873526f1855bc618Virustotal results 32.26% Heodo
2020-07-21DOC_OZ2078270187JK.docdoc ed1fa22cd74f33f9e0a5d4191f4b7304925eae53db04e752d2095134b6f0100fVirustotal results 32.26% Heodo
2020-07-21PO_07212020EX.docdoc 3272cc94248da1f2887200825c05ff98d655ad34c77c5f92e87ffca784324a54Virustotal results 32.79% Heodo
2020-07-21FILE_56506213.docdoc c10a582916f0da5e84bc38c9cbfbd8bc5b42f1626d9ccebffda99a7a48b90fc9Virustotal results 29.51% Heodo
2020-07-21X_T3UI0199GNBVZMR5.docdoc 4b9e26f2c63d249bd9be365f44513691d3aa8461f77b10638c5f27fcd5144568Virustotal results 31.67% Heodo
2020-07-21REP_EFGPJ95T.docdoc 6acb37f46741819ca10ee4ccb7f88dc94b5dc36a3a1c5c366450d76db4b42a6cVirustotal results 31.15% 
2020-07-21REP_EFGPJ95T.docdoc 6acb37f46741819ca10ee4ccb7f88dc94b5dc36a3a1c5c366450d76db4b42a6cVirustotal results 30.65% 
2020-07-21DOC_BZ3727967185ZI.docdoc bd6a09f3141166fa7bc1c7b79ffb618c31312131de5f1829c37ed66f6099b284Virustotal results 31.67% Heodo
2020-07-21FILE_TWA_070120_CWK_072120.docdoc 4bfbfb5923eb71f021f091cbf5ee00a93a33fa778ffc90650b2245de3ace463cVirustotal results 30.65% 
2020-07-2125914545.docdoc 15416a6fc11e7393653dbfbadaf3a03a0948ecfa7aef70fa367412c3b68d5eden/a Heodo
2020-07-21FJ5792943925TU.docdoc d159652e82699b29e122292ae41629d7c880e1f62e23842f6977cb04533365f9Virustotal results 31.67% 
2020-07-2164252348668195490976.docdoc cead2b444fb70319f7ad607f10b254f3888d97ee61adb8a5be9492f259718ec9Virustotal results 31.67% Heodo
2020-07-21FILE_6U9Q6RTZ4FHYKK.docdoc c50850a81ad3ce08fc961162e1082494177f8e501dab0e698bce46ffef854ef6Virustotal results 27.87% 
2020-07-21BAL_LYC_070120_YMC_072120.docdoc 9730ab9a8c60bf06cd93ddc13f7a80f30ce61e20782b9ff1c85dbeff59e3062bn/a Heodo
2020-07-2119534090.docdoc 26d6a947ace5dc20b8511699014a7230d627b181f37246807ea85cdeadea61fen/a Heodo
2020-07-21REP_DKH_070120_KIX_072120.docdoc b256eedac4c8041fbc722fd1b36b17e5fd7a9a5004f974cef3afca5b5ccadcd3Virustotal results 29.51% Heodo
2020-07-21WAZT_XA4345423371VI.docdoc e8eff9852fefe1a01b140600735f3b9abecfd2f1bb93929c8955778bb11d0681n/a 
2020-07-21INV_PO_07212020EX.docdoc ace3f1e921953c5ef33479a1772138bf5c88c39e1677a8e5a78905066d4818feVirustotal results 27.87% 
2020-07-21M_T3S7YNRS.docdoc 8d53a88575b2b26b3fe78df74205c739baf12ccbe1d51e27853d2ec4ed6aea5bVirustotal results 27.87% 
2020-07-2169903922587455792428.docdoc ced32d6bf400cc3bb59aa1929efa4c17228064153ca0615288fc1fefde35f11bVirustotal results 27.87% 
2020-07-21DOC_AFCKCF06XDLR.docdoc 6aae57a7a60c8c2529948a9290becdc90f10be950ad2133ef7cbb1c366693f4eVirustotal results 26.67% 
2020-07-21C_4951291802228584055201.docdoc 5f79033b6a54db8f8075b5fa3c0629142bb73e654e4aabb10f5e905942a4871dVirustotal results 24.59% Heodo
2020-07-21FILE_1135361197.docdoc b4f865e3011a63a5b8a0da14876282d97d5144e153f8316025555d276602d335n/a Heodo
2020-07-21DOC_JUR_070120_GOH_072120.docdoc 281280ed257511ed8f8f2b291a83ce2978bc6e6f14c52ca9ce10540c70cf0605Virustotal results 24.19% Heodo
2020-07-21Y_63429207.docdoc a77f0d09a07d8f85b737d25216501b343e22c4e04a6f88b16dc1ab9ea1b2a222Virustotal results 25.00% 
2020-07-216ISB969DDX3RVO.docdoc b1a935c9a64f8a2191e613e696c6df7a5892c608ec14c6f72c3459c4a62f2865Virustotal results 25.42% Heodo
2020-07-21BAL_UQJEYLCJ.docdoc d40a13f38676eec40c7fc38f03d55507495374f948219045d50e6ae6af725275Virustotal results 23.64% Heodo
2020-07-21BAL_PO_07212020EX.docdoc 6ea128ea049d2ebacb539514c677bb05791d9844046f47e6e1e3dc783f2942fbVirustotal results 22.95%Heodo
2020-07-21C_PO_07212020EX.docdoc 003110462b096556a9d96dca0472feaa2dee2edaf6d8d0e179dc08a8a8f2b775Virustotal results 23.73% Heodo
2020-07-21REP_MF0461652356HJ.docdoc 76135328ce70dd5755fa54408d962b10954d6bb5c47f883a7c2bdd1defbebb9cVirustotal results 22.95% Heodo
2020-07-21L_PO_07212020EX.docdoc 7205124c976d15cd097c35d5c82d63d616b710da7b82ead06faecf91fd620405n/a Heodo
2020-07-21BAL_GBU_070120_XUW_072120.docdoc f2e0593ca696ec36f6b813e857b8fe6741252d7b65df42e5e16bb3c80bc7a90dn/a Heodo
2020-07-21I_G2RMCXKDD.docdoc 49e7f3d18db1b3402794fa15a11d36c41d2857d4a668834b6178d0c739e2f821Virustotal results 22.58% 
2020-07-216746273430420714472.docdoc 59e827ab690ebe0398ef2409db0e89fd63ebe9c9a198ed0cd9febc218813f6a1Virustotal results 22.95% Heodo
2020-07-21FILE_WCE_070120_FJD_072120.docdoc b946948073ee057b1f1cdf3b7c54098e9eb35bb8736104d13e2f3febb038f2b3n/a 
2020-07-21INV_US1226746309QY.docdoc 252e3f0055225fdaaf98be11f4b12f61d98b7311d4aa43aaf9cca4de02b07a26n/a 
2020-07-21REP_HK3687283991IM.docdoc 660ff4d3124a99db58894556a3461eda17393ca94c27e075185e72536eb6735en/a Heodo
2020-07-21BAL_VHA_070120_YOK_072120.docdoc fc2bb7719f33ff249113e3c05c4b2b6fdbc99190e250b3073295e271c553f0d0Virustotal results 32.26%Heodo
2020-07-21INV_CKV_070120_WJK_072120.docdoc c5862b85395572c8c73f166d1a10c2c92a01f07540ac888627c50ebc89097e02n/a 
2020-07-21FILE_IP2316263092HV.docdoc 53b9a409018adc25ac26a608d9fae417659211d8754dbf7f07c3e4710a026774Virustotal results 32.79% 
2020-07-21HZJ35M9EQMKR97H.docdoc f17f0b864c299e49d3d4bb400964b37b9eb15412b9c8f931029fcf68417aebe9Virustotal results 30.65%