URLhaus Database

You are currently viewing the URLhaus database entry for https://marcofama.it/themedoc/nL/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:422452
URL: https://marcofama.it/themedoc/nL/
URL Status:Offline
Host: marcofama.it
Date added:2020-07-30 23:03:33 UTC
Last online:2020-07-31 10:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-07-30 23:04:02 UTC to supporto{at}hostingperte[dot]it)
Takedown time:11 hours, 44 minutes Good (down since 2020-07-31 10:48:22 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-07-31Inv YXZD3-574770.docdoc 3d8ef147ca84e9943fdc850171e2de9c05b0db3472cd05901e4f109e7fbe07f1Virustotal results 50.85%Heodo
2020-07-31INVOICE BDIS4564-047891.docdoc 24faef0a3c46f8fdf60a5fff6f323ebd01a0365dde63a55a242ecfa0455183baVirustotal results 50.82% Heodo
2020-07-31invoice-8-865037849.docdoc 98736475243073034ab4507eda664966af3cc2025cc4f026364550e1fb270661Virustotal results 50.85% Heodo
2020-07-31Invoice D700 42972894.docdoc 5399417505ae67bdc2253943f273fe2b69fcdb71294530cbfe0cbe731a251b48Virustotal results 50.00% Heodo
2020-07-31Inv UX0{:REGEX:.docdoc c8586306addfc533e0c3ee2c72a3a19e28d38b0e41207d72632708e52ee965abVirustotal results 50.00% Heodo
2020-07-31Invoice-C0{:REGEX:.docdoc 36edfa2da0e0eae3557b74c315c7dd66eb25f209f7e207682647a475984eb47cVirustotal results 50.85% Heodo
2020-07-31invoice UBG68-3293802.docdoc b6ffa6767e3b7c53645dc329280108bc5145c28514aad30f28d9b628bb3bed9dVirustotal results 49.15% Heodo
2020-07-31invoice-T1-6275896.docdoc 8e95611645644103d2ab67a6ecba315228abcad85d986852783b1af75477a63dn/a Heodo
2020-07-31invoice 9-636412357.docdoc dcfb38249b589a264dd4ce2c25853335f1399685fcd68d68c337f308d110a793Virustotal results 50.00% Heodo
2020-07-31INVOICE QU155-482161.docdoc 105f7c3a68f898a8605a251f25363f508285b8d32b8d6fd1f1e00565dcb4e3fcVirustotal results 50.82% Heodo
2020-07-31INVOICE_9{:REGEX:.docdoc e98facde0dc82a3d26e7ceb7588d41b8a6246e4c74bc9fa68679aa9820ce91b4n/a Heodo
2020-07-31INVOICE-SABO0 9031991.docdoc 2239e9dfea333b691ad7931b2f663ce27192aa0bfe9b4c7112e98eeddc00ae38Virustotal results 51.67% Heodo
2020-07-31Invoice-451{:REGEX:.docdoc 2b7c18f73a9ba452d16610a824fc67bec12de4879afddfbada3b9519dd02ef53n/a Heodo
2020-07-30Inv_JWH281-633692746.docdoc 69f262e3d8a1665878527a0ce7ff0580243687e2802bcad1f7499eeadc4fa87aVirustotal results 50.82% Heodo
2020-07-30Invoice UI671-86292753.docdoc 45af81f39aadf17f34aa962cbd9f7c3abe4d49bc3a4ab2400d56c2fd90f50725Virustotal results 50.00% Heodo
2020-07-30invoice_OHHN997 584132.docdoc 881c5ef2385626accbec7572c0b5c5b5cdff760f61e1bb044546983d6c3fbdc4Virustotal results 50.00% Heodo
2020-07-30Inv_FH56_2557830.docdoc baef0f6a498331d648f442e8851509d8e91245685e215ae6beb917e8d4a9980cVirustotal results 52.54% Heodo
2020-07-30InvZN6990{:REGEX:.docdoc 53afc7574fca56b96f638f948b6012cf6b2de08c9addcaa9af440d2f94d6c554Virustotal results 51.67% Heodo