URLhaus Database

You are currently viewing the URLhaus database entry for https://sahandhdr.ir/LxV0jFPyl6/OCT/4dk425054410526928lfz9du2l3a2ivobduao/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:428186
URL: https://sahandhdr.ir/LxV0jFPyl6/OCT/4dk425054410526928lfz9du2l3a2ivobduao/
URL Status:Offline
Host: sahandhdr.ir
Date added:2020-08-10 10:03:04 UTC
Last online:2020-08-10 15:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-08-10 10:04:04 UTC to abuse{at}hetzner[dot]de)
Takedown time:5 hours, 8 minutes Good (down since 2020-08-10 15:12:12 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-109802160936404.docdoc 365d24b51aae43c58665a5fca72115289aa276c62ddca2554fd016ac299ec917Virustotal results 40.00% Heodo
2020-08-10DOC_43216447.docdoc f8f7b8382a2b523434f8826e74bd13ac94a03c98be63a7ae9154bbe3a3295c69Virustotal results 36.07%Heodo
2020-08-10REP_XZV_080120_PTB_081020.docdoc 4ce94f29979a4a4a4c9bc4f2bf228fb0be213bf34298fea52bf3bb82fe03118cn/a Heodo
2020-08-10REP_PO_08102020EX.docdoc edcc83eab42c8192a4daa83887285b3884aacec4e95a3f6a17e6b2e3ff40213eVirustotal results 34.43%Heodo
2020-08-10DOC_PO_08102020EX.docdoc 32dcbf714d1e4a6e2115f5c3fca1c57d86c33af0cfb03fac9fd86e7e2940d881n/aHeodo
2020-08-1030128370.docdoc 149576ef5ef94316d4e0db4ce478cd4866a0293878a5d8070dc4bbe6d86050b7Virustotal results 27.87% Heodo
2020-08-10I_OFH_080120_FCF_081020.docdoc c5a9dbb440705a6a2b8b1b672176e61075d8b4b8261b9a395920e2cafd206b65n/a Heodo
2020-08-10P_WS2134444217MA.docdoc 38aec6035b9dc07a41f0b344d8a84b416a54ac964178c2a9a23e139287ffceb8n/a Heodo
2020-08-10B_PO_08102020EX.docdoc 3279305c76025d9335931768dfb6a02880eebae4e37850754d311dbcb3052bd8n/a Heodo
2020-08-10PO_08102020EX.docdoc 5358ef29b9e1c832a55bd66f19aa10501a806e97c4967f7eb9843c5f7c524c06Virustotal results 26.23% Heodo
2020-08-10LSMA_71982050.docdoc 0a635c6914b1d696e249b62eda3f0fa60f54bbc2c24939308a6f45b0a601796fVirustotal results 27.87% Heodo
2020-08-10KE7240417573NY.docdoc df1f8dc5bdb2922872307a97d663e7a17bf750c84e97d3a48d9f92422a7111b9Virustotal results 27.87% Heodo
2020-08-10BAL_XSK_080120_UHF_081020.docdoc b1a486493dfaccd3d95b45d85742514fbe0a6e13162a5caee9e160c8333f19c5n/a Heodo