URLhaus Database

You are currently viewing the URLhaus database entry for http://sharpconstructiontx.com/Wellsfargo/Business/Aug-14-2018/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:42994
URL: http://sharpconstructiontx.com/Wellsfargo/Business/Aug-14-2018/
URL Status:Offline
Host: sharpconstructiontx.com
Date added:2018-08-15 02:34:15 UTC
Last online:2018-09-08 07:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2018-08-15 02:53:05 UTC to TechAdmin{at}megavelocity[dot]com)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-08-16WIRE #167IWLDDY.docdoc 02e8d868a2c2bf0c0611ff91262e6baf2f2fee64565f35c92506347f1a9080ebVirustotal results 25.00% Heodo
2018-08-16BIZ #6WWQGEZM.docdoc 0be4241572bb34864bce4a92517d2087cc96edfe8d943f8340b7b91f59eb9619Virustotal results 27.12% Heodo
2018-08-16SWIFT #95868QEUISSRF.docdoc c9ac91c9915eba1cf9ee1ce5d8680ab5c37167d17a618fd2c493e73b9c10b853Virustotal results 28.33% Heodo
2018-08-16WIRE #415275PJWPCDG-Aug-16-2018.docdoc 50ca3dd502102f03ed01d2caca14e5412915c38e0913f0b7b97982dd0b41cf21Virustotal results 38.33% Heodo
2018-08-16WIRE #160707IPPXHAZV.docdoc 66ebe328415e1eb4e16e3cc17fe1f206f07ad16bc40477760b73e46ccddfbc25Virustotal results 38.98% Heodo
2018-08-16PAYMENT #9813861KNQIZQ-Aug-16-2018.docdoc 087a2ea9d2fb81d0b1d74c25c725c1c183c15995f502e744fe8c4c1a7adc0c20Virustotal results 33.33% Heodo
2018-08-16SWIFT #3SYKZRAFT.docdoc 66b183e80f55c7ced56e97cfc6bfa1a767a558412d0f5ebafdc47e5ed75a1287n/a Heodo
2018-08-16PAYROLL #265PEUE.docdoc c49c861f8be237608246522b56d4e729568e804d4adfca2a28117d972d94e928Virustotal results 30.00% Heodo
2018-08-15WIRE #568NJGWNGR.docdoc a8ecd3c1fcc6e41d4a24c4d8c39f1d7696a83ba28d148511e92c2fd13bfddbf6Virustotal results 25.00% Heodo
2018-08-15ACH #8363QDYZE-Aug-16-2018.docdoc c1982d4406ae41e126221026a549358fe967761e868e358a1b1e9e2c6a9f0113n/a Heodo
2018-08-15ACH #568MLIU.docdoc 4872685440411a411bee7c81b5c147201ed17f61fdb632c4ed561b67ac9c9373Virustotal results 25.00% Heodo
2018-08-15PAY #411RVGVTCMR-Aug-15-2018.docdoc 289cd5b062c4e0d4b405e43b05e150f65f58ed5b9ba7c91353c62dd3a0e2841cVirustotal results 27.59% Heodo
2018-08-15ACH #96716N-Aug-15-2018.docdoc 824b994e79209479f239099b9c368aaff46a6fe2ce5a047d8b8cbaa093a9fdaeVirustotal results 31.03% Heodo
2018-08-15ACH #322B-Aug-15-2018.docdoc c47f17a1f0161b5d502115b0027e18ceda36d53c1b3f1f8f1c46afc242ce8d0en/a Heodo
2018-08-15ACH #9089952KYPGKB-Aug-15-2018.docdoc 2902b6c28fdcbccf3e9034ab0f5b7a18ef8f67de45f7033138f9744ee3514bceVirustotal results 30.00% Heodo
2018-08-15WIRE #005347WEBOKCS.docdoc b3780348a997bf9644df511fc09819640396ae7b5934775a7dae92d1453b9f74Virustotal results 36.67% Heodo
2018-08-15PAYMENT #972782XHLTM.docdoc 25154fb7ac5bbaeea084f65e310f1a7b614f0d611e1b660107f898b312780ccfVirustotal results 37.29% Heodo
2018-08-15WIRE #9BKN-Aug-15-2018.docdoc 23d5a27e14c1441567e38b6a14485082e88f56133f18d60a4d42e5ce9a60d743n/a Heodo
2018-08-15WIRE #21311BMEQDRS.docdoc 750f735540883b2a173ef6de05ed720e37ff554457199c64728f5dbd9d411348Virustotal results 33.33% Heodo