URLhaus Database

You are currently viewing the URLhaus database entry for http://metheney.com/writehandservices.com/INC/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:426450
URL: http://metheney.com/writehandservices.com/INC/
URL Status:Offline
Host: metheney.com
Date added:2020-08-06 18:24:33 UTC
Last online:2020-08-07 23:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?):mail Yes (Ticket DCU002853341 created on 2020-08-06 18:26:06 UTC)
Takedown time:1 day, 4 hours, 51 minutes Poor (down since 2020-08-07 23:17:31 UTC)
Tags:doc emotet link epoch2 heodo link Quakbot link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-07X_3821774934.docdoc 41051e1b0ef6db0f014593da4cb56df1bd320b0b7f7917b80b0e44f529504443n/a Heodo
2020-08-07TV3012202858KY.docdoc d16d8be6b35c187d5a4984e4f5e210665a966932b567cdaa06a05f18409577acVirustotal results 35.00% QuakBot
2020-08-07DOC_PO_08072020EX.docdoc 6adcae1a6473200202d0c7be82e65ec464926066b908d230dae42ca6e257389eVirustotal results 34.43% QuakBot
2020-08-07JR5197637853NU.docdoc a88af77fd7a45cc422482f3f48ce86b8749212a9abc500571cf0c5d3837d89ddVirustotal results 34.43% QuakBot
2020-08-07REP_IHQ_080120_YKC_080720.docdoc 84c95595d065ebc313271e7701ebcc3d4629488ac753f2fcf608a412dd70d14an/a Heodo
2020-08-07TH0595314896LF.docdoc 274a4a43c73146474792e4027e59c62a74d50880eb7ea20bb84e40abf6df99acn/a Heodo
2020-08-07REP_UL5329567998GO.docdoc 8a9caab4cf61e20588a5db45eebf3d6460ce5f1b94e1320c44e0614b54ff59b7Virustotal results 29.51% Heodo
2020-08-07REP_VZFUAXDP.docdoc d1b2f0cb4dc58d843611431850e75e9a91c0c73d11e902e5d4c3e6e6088b52bbVirustotal results 27.87% QuakBot
2020-08-07INV_LC1103747571HR.docdoc cb70d8b293591f8f7e3191cc49fadd6f29b0c2347f6a3a87ce638aaf4b4b6518n/a QuakBot
2020-08-07PO_08072020EX.docdoc 500bea7d7174b43a7e97b737cf87aadc01519413b884aed2bd0f60418800fe54n/a Heodo
2020-08-0793568029.docdoc 2ffea249c37a4b0ed592b49e9d014d00163748f02a120ddf1db5b6446e1cd2dfVirustotal results 25.00% Heodo
2020-08-07FILE_GT617O88.docdoc 8b8e47ea740122d956b050a9ae147e3fed0f577bb4807b577fc5e491a0d3a045n/a Heodo
2020-08-07BAL_MLI_080120_KDJ_080720.docdoc 266f1dda33c84e9fe52431486debbb7854deb10b46cd1f6be9b2fd6bca527e99Virustotal results 24.59% Heodo
2020-08-07MKMXIHM.docdoc 22c64ac7a89ab8a195cf01ac7fe65b95cfb560eb85d98fe16f7b5b0e5db27538Virustotal results 24.59% Heodo
2020-08-07DOC_PO_08072020EX.docdoc 56aea8dd28bb9f893ec49cf3e5bd73eb7dafad62fb12c5f1431b94e2bbd02986Virustotal results 22.58% Heodo
2020-08-07REP_PO_08072020EX.docdoc 4c70f0ff52d6a0016178754d0223340a2b83c622c1be0d1a49656b744b4775a4Virustotal results 24.59% Heodo
2020-08-07VIOW_88967249.docdoc 9f226b33ed3ac52584fc08957b69d7894a68afb9332dc79d42bcde06df63fabeVirustotal results 24.19% Heodo
2020-08-073836896717445654469.docdoc 29b696d5dfbe52ebcda3b657531576637c41de6f4d5508311faedbca8e3806d0Virustotal results 24.19% Heodo
2020-08-0718634699.docdoc 848159e2d023ddbb3136a1a30ae91e9dad7900c86b3efd66d8670436e9bbea95Virustotal results 24.59% Heodo
2020-08-07H_ZB9432846313HZ.docdoc 57370f33ff18a79a83e7ab0a2058c0182aaf87d4f996595ed5aecbbd404b351dn/a Heodo
2020-08-07T_PO_08072020EX.docdoc b6b363c0540264d6b519df4131b781a081197728b39d1c4c9ad07a23ff710c6an/a Heodo
2020-08-07I_79023448230799777921.docdoc 14df5a4c49d31640d9608852d16eb2683e5d89fae28185fb7faf8eaf9c1eed54Virustotal results 29.51% Heodo
2020-08-07CWYP_PO_08072020EX.docdoc 4b4574331de7a4583c2a0d5eed8d114453c864e40643f51ed2a5f0547bb936a9Virustotal results 43.33% Heodo
2020-08-07INV_8294869971936451.docdoc 6c4a14d2b2f97b27137e3c7c90515100c71e1377f33bb71d7a20dac1b545bbffVirustotal results 36.07% Heodo
2020-08-07AM3810339196HM.docdoc 6e72a9dc7224bc18a8ee74089430217794ccbf80832bbf920691ec7362a07953n/a Heodo
2020-08-0777213361.docdoc 2ee56c4e8d6634b957f41adcf4b67f3236267ee4fecd4a0a9262af3401bcc06eVirustotal results 37.29% Heodo
2020-08-07U_2554298251556137.docdoc f2407024ce93276967b90d0690236b8d95e0fa1eb20c328084d59bd2f27850e4Virustotal results 36.67% Heodo
2020-08-07REP_PO_08072020EX.docdoc cc93f31c0d302e29add795820ac93373ebe03ec88d8bd1480afa134d76b5a0a5n/a Heodo
2020-08-07XX_PO_08072020EX.docdoc de2e8e894a666aa181f12760177bf5ea9cdba17074cc7062f42d6c9aa82a124bVirustotal results 34.43% Heodo
2020-08-07ED_S1AQPX9D.docdoc 7c80a237b2801df78492bcf3d316c32159e095e648a81faaeb8fe75752a2af1eVirustotal results 31.15% Heodo
2020-08-0738WZHLTP.docdoc 4b1b6f5ab3d49093211eab8cbec1b072cabe87aac46a3079e562b382bee3b7edVirustotal results 28.33% Heodo
2020-08-07INV_AL4906083420FC.docdoc 3642f9d62c7152c7b73293eae3e9bc33100f44f5d04fc367617825f804c93f97Virustotal results 27.12% Heodo
2020-08-07INV_HP9074061648GF.docdoc 70bdb576c61fd1465ac3a5c01025bd1c5bc89ac4054c7473b529da4b927c1142Virustotal results 27.87% Heodo
2020-08-07DOC_PO_08072020EX.docdoc eccaeceb3d8c7bd64c70811d74bb4a94d033f558f5d10864b7d9224605ecbb09Virustotal results 26.67% Heodo
2020-08-07RKB_080120_YWC_080720.docdoc d01c8f6276d006be38cb7a690d45041052dc157de49f18c0539bde4b53bd6a4eVirustotal results 27.42% Heodo
2020-08-07REP_1940849331551570024.docdoc 087fed54948cf76d25975a9c8964054e2f6a26d6ab73f36677a091ce9e7eddc4Virustotal results 27.42% Heodo
2020-08-07FILE_PO_08072020EX.docdoc d1a9ffa1566f0dc17eaee7771d4b8a88af8c5d57481bdd3d57fc858cdb5faadcn/a Heodo
2020-08-07DOC_122098269978284.docdoc 900718ee868a4b5cbd08d7ace9025a5fcb821139170628df57c44e739a01dad4n/a Heodo
2020-08-07X_TB3X2KH4CX.docdoc afc5a12fb967ae15765a5cf5ea6b23346e63efa7ebf9ea95eb9d368a4d40234cn/a Heodo
2020-08-07BAL_579751692069366018326.docdoc 6031802a4e2cb8c4f23d900f7bd9cdf00cf90fb6c56ecea25241518887fb322aVirustotal results 27.87% Heodo
2020-08-06ASUIYZPJP.docdoc b2e1c3ec5988e1bff64d6dee4fbc7f379ef509842572cbd16087d6e68323d455n/a Heodo
2020-08-06INV_54951800837378232.docdoc 11ebc1e7d98db529305ab1836ba6f66e1f764bc33d34b9f7f89593137565073dVirustotal results 27.87% Heodo
2020-08-06KC4415327675PP.docdoc 42b4f4e3da71b767f75f5d46991ae244e7d38da690de317a34cd17d52e0ad7ceVirustotal results 27.87% Heodo
2020-08-06DOC_ZDO_080120_XGT_080720.docdoc b50f11d3c9824d9d8e24907a06429c04aa7f976c1941d149665c477cf46b12cfn/a Heodo
2020-08-0663825637.docdoc 482bdf529303b816ba84503cf9f6e2b4f339b81d01f1350c3af7565d7ab1f0d8n/a Heodo
2020-08-06FILE_FDZ_080120_HKF_080720.docdoc a94685be7cbfbdd56e37aa05f5d18b85594acbbf58d8a57ce30c8f6b5efa45acn/a Heodo
2020-08-06INV_EYL_080120_RDI_080620.docdoc 6404a5a49751db7e1c82b5bdffadd5171eea2b5a4b43f9b77afb50b2095df09dVirustotal results 24.59% Heodo
2020-08-06SCW_080120_CPO_080620.docdoc 3c74dbf95327daeaf341a8b8b7eefbe17199eb34186f75217d342c3b384a1ce5Virustotal results 24.59% Heodo
2020-08-06FILE_88415445.docdoc ef6c1ffd05150882bfc54a821a952bd6f743e63a03c52ed1564f9ca8549299ceVirustotal results 24.59% Heodo
2020-08-06BAL_POM_080120_BLR_080620.docdoc 34107c13ae1b93bc3562e7d519d94361508fe399f2d5ed86934b257fc4c7d107n/a Heodo
2020-08-06N_842507323333543168080166.docdoc cb401ff12d318c983879756489ced66cb74d595962df9f6ab32b2046326617cfVirustotal results 21.67% Heodo
2020-08-06DOC_JWJ_080120_SNE_080620.docdoc 49293332112aac8e7324c776e9ea01df8d9c3029f9d89b1883863fa4ac4335ccn/a Heodo
2020-08-06I_55973987.docdoc f87549fbca2f79c32bb2b511f33338c7f8f87e7f46524474573fbb85ddcb1729n/a Heodo