URLhaus Database

You are currently viewing the URLhaus database entry for https://onefarmdesign.com/cgi-bin/Scan/tzck3i3vyph/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry



Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:429831
URL: https://onefarmdesign.com/cgi-bin/Scan/tzck3i3vyph/
URL Status:Offline
Host: onefarmdesign.com
Date added:2020-08-12 02:11:09 UTC
Last online:2020-08-22 07:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-08-12 02:12:02 UTC to google-cloud-compliance{at}google[dot]com)
Takedown time:10 days, 5 hours, 11 minutes Bad (down since 2020-08-22 07:23:54 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-14ME8386652588TB.docdoc 9e72fe17b23f8ec865af8a2762597922eb5e0debafed9515603f3af974b15379Virustotal results 35.59%Heodo
2020-08-14REP_NG4480170952JH.docdoc 6ab2c399c8174e97809e728dc331f229df5e7d30dba04a5b1658ff245c45a657Virustotal results 35.59%Heodo
2020-08-14BAL_BH7XD0KKJJ1.docdoc 1caf3b81363b58c02feb6ae2c0ccb617e3ed49bc8a03b4f3de7243dfe6451fdeVirustotal results 35.00%Heodo
2020-08-142397673226344215.docdoc d14b37fdf7ad86b3794264b6df4bfd7efbfd5ae07b03e72a800be6d16ec8aa83Virustotal results 35.00%Heodo
2020-08-14KQ7561919759LI.docdoc 6774da0ae7089fb62d512cd52d2f4defcaeac227cfcd9a91bfb89426fa546398Virustotal results 35.00%Heodo
2020-08-13L_PO_08142020EX.docdoc ae61420aebc07da884917752dcdac62809ccd7a3eb2ed470a3b6c810e7635adfn/aHeodo
2020-08-13INV_PUP_080120_NTT_081420.docdoc d70047b36eb96337b545ff3355409a4722a374e18f8e5955fdbdac3b835f81f1Virustotal results 36.67%Heodo
2020-08-13BAL_UL5661273411CN.docdoc 71e77ff8358d9754ad9a0f3c14c25781dc744be7a30920dde527364cf1ef18c3Virustotal results 36.67% Heodo
2020-08-13DOC_01186101.docdoc 04df573ac90a418093676f7b715b938c6ed9367b845d3ef5e4e1ae4f51ced816Virustotal results 36.67%Heodo
2020-08-13PO_08142020EX.docdoc 8829bbce815af3eb259bf395ab4bc8e41ed24c260d590c7a8253172b4e6ded79n/aHeodo
2020-08-13QZ_SP4003524558UP.docdoc 40fa25d14444c5f0471cb5e33a8397ec008ad42615aefa558366173602afc62bVirustotal results 38.33%Heodo
2020-08-13DOC_PO_08132020EX.docdoc 0f56c76a4c47767ff9ff3f8a9fdc37edabf5d585992ab218eec6d39627dee63dVirustotal results 36.67%Heodo
2020-08-13FILE_LZP_080120_WEX_081320.docdoc 181c8cee3b6463be02aa4dcfbcdecf6a495a03e0692a379e34467dd0ed5a6fdbn/aHeodo
2020-08-13DOC_KRP_080120_DEK_081320.docdoc b4a759ab982ab288dd6ab871610df205148b10cf4305cd15be190ceb1370e330Virustotal results 38.33%Heodo
2020-08-13INV_SUO_080120_CJF_081320.docdoc f153d1cd2401db480ab764a78b8a1928c558755e34f37ecc8ece84b1f14e6964Virustotal results 36.67%Heodo
2020-08-13BAL_LKH_080120_XRO_081320.docdoc 92b38ca67d00bffc28647167730cef8ea6123542c4123464f1c565e59186b871n/aHeodo
2020-08-13INV_PO_08132020EX.docdoc d2096169d1212457db40e6a605d82b82aea4ba2d2ea69225cdd2c60cd104bcd2Virustotal results 34.43%Heodo
2020-08-132329313881238865.docdoc ea4ab11724bb19ff8c0451069a27cfc6b2de7b7ad0254edd07f3036c265a066fVirustotal results 35.00%Heodo
2020-08-13JNL48VDW.docdoc 85edf8843ef74d9d2c73b4aa11a94cc7de224a7bf4839f342de4d17e1a94dc35Virustotal results 35.59%Heodo
2020-08-13BAL_VHIX9YAUI6OE.docdoc f959a3ec8067a6967f047b19554210234638a6ac9b0bac85e006979f09c33d11Virustotal results 37.29%Heodo
2020-08-13GYN_080120_NJK_081320.docdoc 81c7769a0b7529af3a8694dd0b1141ae2446ebc681026ae67653753eba1ed6b6Virustotal results 33.33%Heodo
2020-08-13BAL_DY8927263648TK.docdoc bccd7607de30c4481db2b724437ae78b0d1248b1b7bd563add97f212194b4fd3n/aHeodo
2020-08-13PQ3205316402XA.docdoc e075507a16b93d21aa9bf0848bd5299ef87fe338654ca4e30075fb8677475c50Virustotal results 31.67%Heodo
2020-08-13XL_686265495.docdoc 5dfe99bdd766418f029d534146438a97818581f989d4b2ebf5f92179344000c0Virustotal results 30.00%Heodo
2020-08-13DOC_88493378716855.docdoc 379e94fbd1ac9a1b6ee5207057f464db427f71873639ce917f88a309dc68cc29Virustotal results 28.33%Heodo
2020-08-13REP_00550003286239.docdoc cc1a7efdcb7e41f40365042a5f31c2338804f4bacce2f64fec0ef2fcc3dd2f96Virustotal results 28.81%Heodo
2020-08-13YK_WA0772298625FX.docdoc 34cdb3854071dc86030fc69f90094d0ecc4064d54c2f6c5c2ccea449991908bbn/aHeodo
2020-08-13INV_QLM_080120_SOE_081320.docdoc 4a62d3729df93b38995a6be4a79fd8785c7591f0230b355532afcc18f823ab7aVirustotal results 27.87%Heodo
2020-08-13FILE_Q66VZSNCE.docdoc bd7871f1fceddc02727f3be310e4507aa75ac650a9319a03989d0a1c18bc74cdn/aHeodo
2020-08-13DOC_PO_08132020EX.docdoc a8786f3ff1ecf32215198afb54ea5211a0c5fc6468cef97101a85ff5839b05aeVirustotal results 28.81%Heodo
2020-08-13BAL_AW3745687751VZ.docdoc ae0c7dfa89cf0301b64ef4f6b364a1e426c79c80a9d0943916c93f3315ebc907Virustotal results 27.87%Heodo
2020-08-13INV_MR7892909472VW.docdoc 79b609ddf074406de181d656544923255389ac44a068ddaeb858e6546d2787f4Virustotal results 27.87%Heodo
2020-08-13BAL_PO_08132020EX.docdoc 430d07c2162af45022115ce4b557ab182afc95143b698568d50c41832c6b281bVirustotal results 29.51%Heodo
2020-08-13DOC_107741602083107241096084.docdoc e163803cb71c55b28fbfe8435c5aed2616a006e425556ee9b4f3670db2115d98Virustotal results 30.00%Heodo
2020-08-1383370052.docdoc 0c4015de45653ee2f8fc6e338461a2377e14139b1ff879df5a2fe1d3c200a15eVirustotal results 28.33%Heodo
2020-08-13M_PO_08132020EX.docdoc c62e7473580736e9ec7372d05bfebc80d995dde8be351119f101ba366ef172b8Virustotal results 26.67%Heodo
2020-08-13DOC_BY2172291266JW.docdoc 57077fbea2ccbc5464be5b94b7e01a59f4b28e6658a7a432645380f6413e8a00Virustotal results 27.12%Heodo
2020-08-13S_PO_08132020EX.docdoc 1a457779d9b645e40120f23efa5aef5b0b97308f610fea5a06377c0603636f98Virustotal results 25.00%Heodo
2020-08-1362224256.docdoc 99cfef089f3adc2b3bc70f4fc99eae27e6742ddd207e66c6ee4ad1aef5210532Virustotal results 26.67%Heodo
2020-08-1335886369.docdoc e1bf8d2efe529d4cbe16fa5c6f747b604e88d6ffbeec9742a7617aa8617a9133Virustotal results 26.67%Heodo
2020-08-13B_BSS_080120_UBT_081320.docdoc 4abecf9c71a16e78392600309278c84a75e35f2d1fa5bb8ef6c347820092d753Virustotal results 27.87%Heodo
2020-08-13DOC_5401751166560168160.docdoc 9806f54f8d2769646e6a9caee3f1c15a1b47f781be6eef64c390d6e9ee867bd4Virustotal results 26.67%Heodo
2020-08-13K_69028867080797372842.docdoc ba510b5a0f97430a09efbd12acbb4c1be869e71e678adf5fa0b5498fb477068eVirustotal results 28.33%Heodo
2020-08-13BAL_PO_08132020EX.docdoc f3288815441008b2291c6b17d597d58fe606f7475c4641bacba49ad56c1b1142Virustotal results 51.72%Heodo
2020-08-13U_00811267.docdoc d3cbf8eb26742271a0281233827b52ab52334bef5335d0f8a27c9db613de55c7Virustotal results 53.33%Heodo
2020-08-13QL3041379027BB.docdoc 0938a3eb8d86fa634cbaa1f643bd2c6cafcdacba202e4683cf7245705bd11fb3Virustotal results 52.46%Heodo
2020-08-13DOC_CV0818482393EY.docdoc c2bb5e128810c06abd15ad3ef0bc95622c20da154ca500892972305c94feabedVirustotal results 52.54%Heodo
2020-08-13JNQ_080120_IGK_081320.docdoc 2ec1025c3a44b35de74853b22998ea439d6eb5f0d92d9065256692f0deadcbd9Virustotal results 51.67%Heodo
2020-08-13577175213930765.docdoc 5ec2a412f6729dbbd84453b84c85ac56f93e865a1900eb514efedefedc56467fVirustotal results 50.82%Heodo
2020-08-12FILE_PAF_080120_ZBB_081320.docdoc a9af06ae735677ec282b4a66f7bc85a343dc7c71491658673fed6150e05ef3c5n/aHeodo
2020-08-12359061152881177170651236.docdoc d0ecee1cad0e97af4b127dc23861ffbee329ef4a465840447b48e554801e6081Virustotal results 49.18%Heodo
2020-08-12REP_ZSMPUUEP.docdoc e96e3e7fdf34ca4a62dc44effc09b4043202d720c273b0ca7fe86bc3cbbdedban/aHeodo
2020-08-12INV_MAL_080120_LEG_081320.docdoc 29c5831f071871eed50e5f9e8c02779dedc26d8d1b5485a57cef2f7dae79c9f0Virustotal results 50.00%Heodo
2020-08-12INV_J3UI0HVWRRVERI.docdoc cfec1c4aeca2bf10496b8ae3be0b77a9dfade44f1503c09398114731db0e92b5n/aHeodo
2020-08-12FILE_71217879042.docdoc 5ec93d8ade8ce137e0a4718134228f587451d59aeaa2e27d24713ccc4866e8edn/aHeodo
2020-08-12AA1704435855ND.docdoc 448b77551e8ab272663dac5ccf4cad4be8b7dcfc1759a2859785754aa44d285an/aHeodo
2020-08-12FILE_7756012283916667.docdoc c75a7753aba5fdf5703e46cfe6e6a53ceb7df3394f932fc521343b25ab0b2388n/aHeodo
2020-08-12DOC_PO_08122020EX.docdoc 86a7080b18d0d16fd7b1505799c006382ff034fb5dbb65b0e933ab56cee84215n/aHeodo
2020-08-12REP_PO_08122020EX.docdoc 4b94ba4ad2c65349c09e18ba049dd76f5b61a5491812b3ea60961945d1866446Virustotal results 48.33%Heodo
2020-08-12J_74990589.docdoc 01817dd6570dc258829c88ceab491052f8376cc5071286d89c5ef07b621f96ddn/aHeodo
2020-08-12X_65357337.docdoc 0694defa98963c712991c89bd42b7b679eb379486fe775cd134d490f4aac7978n/aHeodo
2020-08-12INV_IGMFMNQYIF4Q.docdoc dd4525e6914fa0fd2f91bde41f2df30ef8857b9f08c19e0a106ec78098ab63c1n/aHeodo
2020-08-12JSCF73XV18CJH6.docdoc a271c8c4e792f23b038df5aa420090f4cad1de687dea9c0926e46940966b462dVirustotal results 39.34%Heodo
2020-08-12DOC_PO_08122020EX.docdoc 25263694227734da43c741c2d09b0f0aceb8cb2d9488378a2ea765c6c19be594n/aHeodo
2020-08-12ZSGNOVB5RYBYG9I.docdoc 4020a8982e70b51b150cd40a837ea5dfceb35f0a6c9f9858b3fae5e00404ae62Virustotal results 30.51%Heodo
2020-08-12DOC_DC6592781336QV.docdoc 2c99381fa134d8121f52b07a62cf94574cd977c2662a4087f18b2f5960370005Virustotal results 30.00%Heodo
2020-08-12Q_PO_08122020EX.docdoc 555eec27e492447bbe5bb1313613ba7edda123de03e384227bf9440ec1965da9Virustotal results 28.33%Heodo
2020-08-12J_PO_08122020EX.docdoc 25f0b73743327325b14d463d442803004c258fc86d34e90721738869de61490cn/aHeodo
2020-08-12FILE_PHU_080120_LVM_081220.docdoc 8133ad23a95674ac43c254256076e1571b6ac10c7fa712df1a0a3fc9054f2093Virustotal results 27.87%Heodo
2020-08-12REP_95243008.docdoc beb08012d1a1eaa82766653d073df1c7d7579e39012001170ce6ffdd3225e1b7Virustotal results 28.33%Heodo
2020-08-12DOC_PUN_080120_DEN_081220.docdoc 23be0779d59df875485b237b812b0b7d7c4d53c41dd57cc961cfa570bf09eef4n/aHeodo
2020-08-12F_QF0684647778ML.docdoc ae05ea2549ddd83cba471b7b02205d0d37d8976940db87bb5eb3609e40044ac1n/aHeodo
2020-08-12REP_VB4838846060JO.docdoc e0201f9ab91fd60515ac550f33b5556040b5d5ac9438585f999ece1111ffb09en/aHeodo
2020-08-12PO_08122020EX.docdoc 0f87f594b33d4d92a3b56974f9073f6152c33ada49796983d355434e36b5bc71n/aHeodo
2020-08-12DOC_IQ0153214748BE.docdoc b00309dc3091f93c13fa36bd5d5fb4f1d080f70ab1eabe94d84eb8423dc3d5dbn/aHeodo
2020-08-12PO_08122020EX.docdoc 81c27d10e37bd700d8cee11eba8d01d2bda91b7743083fa7a4e51f3f169ef0c5Virustotal results 28.81%Heodo
2020-08-12FILE_3509311069010875856374.docdoc 214f91b9b3ab2ea28b14536241901516f9141df4e12fd3b2ce52088fef0a3734n/aHeodo
2020-08-12DOC_13779916.docdoc 158658167ef948705d54568c02e4901d9af0371490596d98384a1307dc6f7d72n/aHeodo
2020-08-12BAL_133693781501707861.docdoc 025046a10693eb1c9dca8e64fa2dc55f1ba16ff9c6650493205e2c3af827e1dcVirustotal results 52.46%Heodo
2020-08-12INV_71297643.docdoc 9492fa4f34cceef83ff1e6f77bc428777aba7ae617b195a3e6a06d84e5889b1eVirustotal results 53.33%Heodo
2020-08-12BAL_54065605.docdoc c978e204a4343d19a9b1df57379618a391455fe0f0fd17e49fcb670670c4241cVirustotal results 52.54%Heodo
2020-08-12NDHN_PO_08122020EX.docdoc 6f973501cc2dece992aa2f959f8e352e424e96f06abb300b4bed8bcf2ab4bf34Virustotal results 51.67%Heodo
2020-08-12REP_JH7203309151KO.docdoc 1d2096f4adcba717670858b98912615f7bc86bd95ef6b3117901aa4ae6383d4dVirustotal results 53.33%Heodo
2020-08-12REP_0EUAC4LOFOT.docdoc f9f228e552c3971983d4b5909776c052df083b9b41f65f764ceba0dc9d6219e7Virustotal results 52.54%Heodo
2020-08-12PO_08122020EX.docdoc e95c19b3173d0c69d60efb950859b2ffd3020235efd6c47ffebddf950a0edf52n/aHeodo
2020-08-12PO_08122020EX.docdoc 29a8f854081e5f20b6709851863472cd33a1863fbed4867153edf6fcc5e86dc8n/aHeodo
2020-08-12FYG_080120_UVO_081220.docdoc 7f3f157b6efccbe88e544e49aa6b5571503e8f8e2d187cb88f30a38860b1537bn/aHeodo
2020-08-12INV_9UQ058A7P3B6ZH3D.docdoc 4c3eddd6a41f348b80609e91f83e3a9e22818758105ce3db1de70777baeae682Virustotal results 50.85%Heodo
2020-08-12JC00KC2AU7QISOTU.docdoc 1091a172da278b63327e87e8bcda10a580a6858547e9c00a00bda11214a6dc3dn/aHeodo