URLhaus Database

You are currently viewing the URLhaus database entry for http://api.xoweb.cn/addons/JjM/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry



Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:416085
URL: http://api.xoweb.cn/addons/JjM/
URL Status:Offline
Host: api.xoweb.cn
Date added:2020-07-21 15:23:03 UTC
Last online:2020-07-21 16:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-07-21 15:56:02 UTC to abuse{at}tencent[dot]com,abuse{at}qq[dot]com,jsquare{at}tencent[dot]com,dreamsruan{at}tencent[dot]com)
Takedown time:59 minutes Wow (down since 2020-07-21 16:55:11 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-07-21Inv_H6252_927612697.docdoc 17c5ba37acc88ac9f8f1db235c32d4c1d24c4d9b268a2637a1b2f6fc95f3c2bbVirustotal results 27.87% 
2020-07-21Invoice_GS561_812684.docdoc be14def968a7a7ba9caaac07b0784bf90fcc93c6917657fa2aae18ebc3813563Virustotal results 28.33%Heodo
2020-07-21invoice-HS3_72741984.docdoc 05b1f0822783aa9419a3b13424fb6d31e224e8dad2c84ace8cafa7c1b42a1f3eVirustotal results 28.33% Heodo
2020-07-21invoice CPIJ5_365152246.docdoc 43b378fd5752ed3af0656ba0189641526f78a1e2cd4481aa60e9ccef683ddb2cn/a Heodo