URLhaus Database

You are currently viewing the URLhaus database entry for http://cleverpharma.es/attachments/982dyfyh/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:429187
URL: http://cleverpharma.es/attachments/982dyfyh/
URL Status:Offline
Host: cleverpharma.es
Date added:2020-08-11 10:05:16 UTC
Last online:2020-08-11 22:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-08-11 10:06:04 UTC to abuse{at}arsys[dot]es)
Takedown time:12 hours, 11 minutes Good (down since 2020-08-11 22:17:46 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-11FILE_AUY_080120_ZCS_081220.docdoc 2adc586ea7a59715aa3226b8b211a8d39fdc6b40691c30e3a96962d2c041688dVirustotal results 52.54%Heodo
2020-08-11BAL_AX2145454552CA.docdoc bb6e3d0f0394c94254fd90afa543277a215c6834d045f0c20aabd990cb68856dn/aHeodo
2020-08-11SSH_080120_SUI_081120.docdoc cbacf0f510ec4c1a5cacd10259c0e6075f65050b602e47fc67409aefcb6af60en/aHeodo
2020-08-11SZ5091487456EN.docdoc 667d0ee592ac9e54d6758d19535eef977352049d274f48289266578e4f7f3974Virustotal results 45.90%Heodo
2020-08-11I_RH5366722869TC.docdoc 0dc77319f898db1037b996e421c171d0ddbd13166a8b589ab1da97b8bcfc99cdVirustotal results 48.33%Heodo
2020-08-1162573904882550797.docdoc 3f9ed468a85787c4bf29a327c525e87f3ac3fed5b4079b2958f3617ef3d3a1dfVirustotal results 40.00%Heodo
2020-08-11668097655205399734892.docdoc 8e5f3490181127db4ae19a0c19a2aab3233016bcc64272ec836a68426ed0ae89n/aHeodo
2020-08-11HZNC_TG9012396588LF.docdoc 16004f742c9d51196b4a45e665c360f8eecec87448f703ca65f1ca9fd2748debn/aHeodo
2020-08-11J2I3OBA2HTRS2A7M.docdoc 2e6ff6d6098f2b63d436caef9146a587a4906131d0cb324b675b959be4d88598n/aHeodo
2020-08-11QNH_GFVEODV179NF.docdoc dfe95319cf0ecc8daf385929ff7c7cadb747e81a026fdf88dbb55eaf43b38491n/aHeodo
2020-08-11KENC_DY6076285060VV.docdoc 819a2c8717a367ec5a69f4a0ddc0eed9f469fea2415f8b0e3defc94d21813f41n/aHeodo
2020-08-11DOC_DJIL60TY6C5M.docdoc 156c89b670d37466329fb682dd618caf3bd58f87e765cca5964284ab364e311bn/aHeodo
2020-08-11BE7503430087HT.docdoc 5a7268af14b85f336d44d0d10af1c59a02ce7738a4966e2ef96a39574a42b7c6n/aHeodo
2020-08-1127256165.docdoc 5ca1aedbc7b3e63e13e3b3263321e12f1d49d668c331db20a1f996b3fd362894Virustotal results 32.20%Heodo
2020-08-11O_LNI_080120_BHO_081120.docdoc d760943bc37af2bcfc28d0e4f2a9de09a531cf8eb96220ea588ab5373d0b5ddan/aHeodo
2020-08-11PO_08112020EX.docdoc ce20703d88bfe7ebb3959efe8c9aa396e10a20431eed03f6aff303580836af4dn/aHeodo
2020-08-114U13ZGCIM601JTC.docdoc e86b2beb2b36a9530c75a89e078c28b809fca63518cebdcd860f0135e899ae90n/aHeodo
2020-08-11REP_PO_08112020EX.docdoc 74c60ddf02800ed5d9c79d78e912a81ed34d20ccb8fab265ac1512c0ef32a93eVirustotal results 25.00%Heodo
2020-08-118276089532713.docdoc f266dfe6eca386777143d38c655e759b22fba117bcd9138c44354938222c1673Virustotal results 25.00%Heodo
2020-08-11INV_16711880.docdoc c3fc06075bb5fea461b04938a77334e6806e189ceb0ae0a1c93f2979262d662an/aHeodo
2020-08-11REP_EN6642767676EO.docdoc 4a1285a37bc522558f32febe3ec82e72b4ccf1e64cb727c22cd80eff5720f6a4n/aHeodo
2020-08-11FILE_YR1672382180BZ.docdoc 159adf2257291ab010f4ab9a6518eca15f59b22b9dca9f3d52dee5f9fae80c00Virustotal results 24.59%Heodo
2020-08-11INV_JS8330070195IF.docdoc 2cd6d3c756477ef451f511c6ffae2ae49542fb6a4114f11be3b86cf4bdf57404n/aHeodo