URLhaus Database

You are currently viewing the URLhaus database entry for http://faks.nl/worxcms/3184152392886665/7fn1jl84zjw/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:421136
URL: http://faks.nl/worxcms/3184152392886665/7fn1jl84zjw/
URL Status:Offline
Host: faks.nl
Date added:2020-07-28 22:12:13 UTC
Last online:2020-07-29 10:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-07-28 22:14:03 UTC to abuse{at}proserve[dot]nl)
Takedown time:12 hours, 15 minutes Good (down since 2020-07-29 10:29:06 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-07-29REP_1AWDOYH5HGPEK.docdoc 075c7bee49676a5bfce88288211ed92365f0a09e0d5c16e01ecb04398e9ba991Virustotal results 27.87%Heodo
2020-07-29P_92920639.docdoc d303d07324f08db643e402e98153df70e6eac7c42905dd67d233231438bbe25fVirustotal results 26.67% Heodo
2020-07-2945161069.docdoc 10bff4abcb10a44b3d14435988ead41d1468bf4dc8fa4fc184e0babdac5ae73dVirustotal results 26.23% Heodo
2020-07-29REP_48013987.docdoc 9ee009dea50f0125325d62473cfe14613ca3098555ff14345600be9cb1add50bVirustotal results 27.87% Heodo
2020-07-2939411670.docdoc b3a825ec435cb3188c7e312d426ebb88fc14bf826a552888d2b27110ec074175n/a Heodo
2020-07-29BAL_HCI_070120_XDP_072920.docdoc 6a41216f74505746cd9e27126335988cc5ef4727fc68e2375fb50dea917e4a0eVirustotal results 46.77% Heodo
2020-07-29RN_NPUTREIO7394T.docdoc 5d022a451650f6f56f406617294a4445538b97a8f88aa1b89e72480f34ba8bc0Virustotal results 42.37% Heodo
2020-07-29PO_07292020EX.docdoc 9e3690a0a71dc239833dddc5b2aa94983eec61d88a636aa96f12bcfac9898592Virustotal results 41.94% Heodo
2020-07-29INV_SKS_070120_DJW_072920.docdoc b3ffca228d4d444172e54cbafb591ce0d37193492c7775c7dbf7e8c8e6bc00dcVirustotal results 42.62% Heodo
2020-07-29FILE_939852472111748559195.docdoc f01b3323117582e282add297541e14c3b0d359ab03af884367f2d4c562750425n/a Heodo
2020-07-29JUH_PO_07292020EX.docdoc 3de845b9dc4ad5aa22fd3587bf71351eda91ae61c1003f4df40c75bf422f548cVirustotal results 42.62% Heodo
2020-07-29P_UXB_070120_WJD_072920.docdoc 2e0013ae11fd80f2fcbd8488a53d6931d5cda77bb542e026cdca5c602ae4c3e1Virustotal results 42.62% Heodo
2020-07-29BAL_581761406447.docdoc 6370801cfa9c5207d9891ac6bce41478e5f4d52c83922ec87b94af39195aaf65n/a Heodo
2020-07-29INV_7QKWJ6MPM0A.docdoc feea2193fa8429572e0d346487c4e58bffd2c6cfc320d05054411a8df5c3e0d3n/a Heodo
2020-07-28XW5567246010UN.docdoc 7b0638d749631d97044b3b3d44388979a43abd48143abf524df03335eeb290cfVirustotal results 40.68% Heodo
2020-07-28DOC_CEK_070120_VPI_072920.docdoc 7c2262c20cda53c7a80e7ea11ff4ca2bd94fa67cf979a136e2e7649256d902f2n/a Heodo
2020-07-28R_AJ8680227967NX.docdoc 63c74b892d39492d60408cece9e71cc78d5bb63eb8f598ad5d4f1f375c2745fdn/a Heodo
2020-07-28DOC_PO_07292020EX.docdoc 32631dfcd1e0a725b4b51420531bfa589d3dcb19269f060e7a7083332d537fa1Virustotal results 40.32% Heodo
2020-07-28BAL_CQ2546881669DX.docdoc 942f521ccdd9490b25a14dfdb03ff9e8ff7bce4d9d0ad9c5a5fe684216b81579Virustotal results 43.33% Heodo
2020-07-28E_699545225015.docdoc 19aff1e7636349b77c19f5a6a5814d8f852f83fc487a4c5afc0df15ea7635bc9Virustotal results 40.32% Heodo