URLhaus Database

You are currently viewing the URLhaus database entry for http://chiaraberettamazzotta.it/wp-includes/g9ayf-lg6d-9526/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:418191
URL: http://chiaraberettamazzotta.it/wp-includes/g9ayf-lg6d-9526/
URL Status:Offline
Host: chiaraberettamazzotta.it
Date added:2020-07-23 03:28:37 UTC
Last online:2020-07-23 13:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-07-23 03:36:03 UTC to abuse{at}hetzner[dot]de)
Takedown time:10 hours, 4 minutes Good (down since 2020-07-23 13:40:21 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-07-23invoice_53_228442160.docdoc 548e4293f740ef77ecf074a7e8eb5ee8659eb565fd08db697ca873dc770c11b0Virustotal results 46.67%Heodo
2020-07-23invoice_9_24113648.docdoc cf2ba9c49c359ebc0d9ce182b928db8e967b6720c8d531c8366b2420ce778d21n/a 
2020-07-23INVOICE-9969_1492238.docdoc fd1b363068e21fa7a3e86cc0aa6134bfa46a640d70bcef686f19f57f54340f6bVirustotal results 44.26%Heodo
2020-07-23Inv-TPI16_100907.docdoc a7eba5ce690c5078cfc8875f5a8a07cdf7b8fe15a427b22b2620462b04c4558cVirustotal results 42.62% Heodo
2020-07-23Invoice-XC84_339652624.docdoc df314d2431bc91e51d22c2f55c6b9de5577ac0129f93014698c3e17546ae0867Virustotal results 40.32%Heodo
2020-07-23Invoice-RQO142_023227.docdoc 063f625ee5274a7caa1637adec2235e98aeaab2f5f8b14877835b82136892654Virustotal results 40.98% 
2020-07-23Invoice-RQO142_023227.docdoc 063f625ee5274a7caa1637adec2235e98aeaab2f5f8b14877835b82136892654n/a 
2020-07-23INVOICE-EHX1_426913.docdoc c8974949fec3e295b7d7e7844cdb17d5931a697690a6be15b4863e787931d386Virustotal results 40.00% Heodo
2020-07-23INVOICE BKVY8_3760796.docdoc e2796110338cf892ecb47cb8baeafa186dabd1403514af5d5a470c2561c59d11Virustotal results 37.70% Heodo
2020-07-23Invoice_NPTG133_4035808.docdoc 88cca8fc8a65b95ca50edf7f8f1bc19f7c7d91935a589e7a4a88b42ea443b603Virustotal results 40.32% 
2020-07-23INVOICE SMZ9632_394224.docdoc cd246dc83c181223acbe8487d25a97d5c433c31b36f8fe625f2814ca8d28a6c3Virustotal results 44.07% Heodo
2020-07-23Inv_S047_639535743.docdoc eb8252a2dd0e7e0f44a6b26fb09abb04ef9a618d216f46a9c1525a55350766e9Virustotal results 41.67% Heodo
2020-07-23Invoice-KQF78_955411.docdoc c8bc8587d3706f659ce2dbd1c22be268adad0f5f8c4c7be78ff6b4b17c3f1279Virustotal results 45.00% Heodo
2020-07-23invoice-JFDY536_167603.docdoc 8a3c6c28c8e2a7d4a12919a3c5894648e4a54661f9ded2f99e00685742d95bc4Virustotal results 43.33% Heodo
2020-07-23Inv KLNU5_140164.docdoc e96a19dec04fc49f1360224fea7d16ee6c04d29b296500a3b7edc87d31a925fbVirustotal results 41.67% Heodo
2020-07-23invoice-PCHN266_274859.docdoc 5ecb66cb399d319d7c2e24a9ae1e427ee2b10ccd3da9b2a2266dd764ba29cd16Virustotal results 40.98% Heodo
2020-07-23INVOICE-IW7_659218.docdoc b84bcc1db705ebab3793f52dcf633d1ad8ad2a9b7c96dee5daee12d7d4be0375Virustotal results 43.33% Heodo
2020-07-23Inv-NLBT5968_366808333.docdoc f815f1d2c10f89e966e1637e1d1478a36c5c8c8ceb852eefaa2247c44f10b9fdVirustotal results 41.67%Heodo
2020-07-23Inv-LE35_08186223.docdoc 330179eaf2aebaf9bc3d247bc1bf97ee8e2ae05d86fd9ea97f8d352332b459baVirustotal results 41.67% Heodo