URLhaus Database

You are currently viewing the URLhaus database entry for http://z-bai.com/wp-admin/2632785107_v5JSj5SQLacnsMZ_60s004Uba_RFZmRd5rb064/external_forum/kgCaj_wGkkcMH6y3/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry



Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:430028
URL: http://z-bai.com/wp-admin/2632785107_v5JSj5SQLacnsMZ_60s004Uba_RFZmRd5rb064/external_forum/kgCaj_wGkkcMH6y3/
URL Status:Offline
Host: z-bai.com
Date added:2020-08-12 07:59:06 UTC
Last online:2020-08-23 02:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-08-12 08:00:03 UTC to abuse{at}tencent[dot]com,abuse{at}qq[dot]com,jsquare{at}tencent[dot]com,dreamsruan{at}tencent[dot]com)
Takedown time:10 days, 18 hours, 59 minutes Bad (down since 2020-08-23 02:59:04 UTC)
Tags:doc emotet link epoch1 heodo link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-22inf-20200814-652528.docdoc fda9af753166250232f0855d309359288b8b9e4b0b5e63b5501c4450b48ba5d5n/a 
2020-08-14REP_IES28227.docdoc 2eb2087c8a3df78cf534203df82195d80ade6ba09ee79301c12522adaf9aa4a9Virustotal results 24.59%Heodo
2020-08-14dat_2020_08_14_13757.docdoc 783a766ff6d8b06f0050f051c16b04cad1298697c81bbaeee5d8fcb014a60a29Virustotal results 23.73%Heodo
2020-08-14Rep 20200814.docdoc 29f30041d344456afe3000415acdb3e4aed233e0053aa4f0cc929fc74fb8304cVirustotal results 24.59%Heodo
2020-08-14Mes_2020_08_14_A779.docdoc eb8626c09f81f7723ee7afa0cf39e78db7be79b5e5522f82ed7c116eb5fae52fVirustotal results 37.29%Heodo
2020-08-14Arc-20200814-KTQ418.docdoc 7a37b617ab9dfd1a2b7f090067cde1c83470fd44cd6090994090ac04638304b5Virustotal results 36.67%Heodo
2020-08-14ARC-2020_08_14-VO32808.docdoc 29489efeb7ae7bd57c8cbca798da5a97deae5630ec298d8c5c71dfcea1eac7c0Virustotal results 38.33%Heodo
2020-08-14DAT-20200814-196.docdoc 9f062827e3ec957e494e98c34be89233a5a52bb4a1bf6e1d2fa3a9ba6fe6eadfVirustotal results 38.33%Heodo
2020-08-14List-I72969.docdoc 6280278fef02126376fca03e39598bb3c17632cafd9fa99d26694b43c73da6c2Virustotal results 37.70%Heodo
2020-08-14MES-20200814.docdoc 36f73076b47e2e70a100cb483c78e186e5fb990095c92a6e22d7a0cbd99c8829Virustotal results 37.93%Heodo
2020-08-14FILE 2020_08_14 KBH261.docdoc 2465fb97adc0bcfd2852bc97bf6a929405c2b0c8abb85b57d294befdefbac099Virustotal results 35.59%Heodo
2020-08-14dat 2020_08_14 6104.docdoc be002af97ec2cdb43edc083f492340be1995195c05bcd860b3268acb96e2c539Virustotal results 35.59%Heodo
2020-08-14Rep-20200814.docdoc a5aaa7a63b5ec81fdfe4916e720a21e4df252c2d3823d6558f0593cb1f4f65a3Virustotal results 34.48%Heodo
2020-08-14Doc-2020_08_14-6065034.docdoc 13089378e3c266b290b1016c60c829a4c0ecf6f7941777d28e2954b18e229607Virustotal results 35.00%Heodo
2020-08-14arc-2020_08_14-594.docdoc 97460a6d678e720109dcb87850c5f0117432cae744f36e9942f3974715160701Virustotal results 35.59%Heodo
2020-08-14FILE-2020_08_14-Q12022.docdoc 24cffd9cba643e90804ca8b7c8cfcc717ef8ae85ef64485427c51d320333baa2Virustotal results 36.07%Heodo
2020-08-13arc-4639.docdoc 96fbcc6247407284134b11eb29a5cb2dd6c00fdb5f500c58b19be4822cd412c0Virustotal results 35.00% Heodo
2020-08-13mes_20200814_G87013.docdoc 081c01d015d17984a1e038faef3bdb986ceeb520e856be497bef96b90ad00aa3Virustotal results 36.67%Heodo
2020-08-13MES W9150.docdoc aa253dd86d00217ef0405e1632fe822af17023b8277078b08be3ecdae72d78daVirustotal results 35.00%Heodo
2020-08-13INF-2020_08_14-ZSS4771.docdoc 82c132e196b9c414d1b69255330dffddeae100cd2c323be20574ac4cfde6bcd7Virustotal results 35.00% Heodo
2020-08-13ARC_20200814_63263.docdoc a9f31f864a6aac450ff2fd5887783360d6bb87da12d94b456119e218f2b99e9bVirustotal results 36.07%Heodo
2020-08-13Doc-20200814-742.docdoc deffa862c9c822b31cd7d97529ca881b817e8ae26960dc40541f212b7ba78ea3Virustotal results 36.07%Heodo
2020-08-13Dat-20200813-PFW6692.docdoc cc537ba9658c10a2bcee2a400a79bc17328a5e8a2b2cad49066ff788056fe108n/aHeodo
2020-08-13Inf-2020_08_13.docdoc 5bb4b84296ec60184ea017e657bcea6f6d3acaa986abdfd64cecbbd4ee027731n/aHeodo
2020-08-13dat_20200813_6822004.docdoc b70ef5272311329771dc7aa2f6e62affd540bffa733e6f8360abfaa99e14ff07Virustotal results 35.59%Heodo
2020-08-13Inf HOT5858.docdoc 46927454721c5e3fd90b2fee4870ce3ed1164f837680278f19478136a5480023Virustotal results 33.33%Heodo
2020-08-13File 20200813 950.docdoc 658b81e912c908e06150b1351a244262cf277f4c99003a8f7599354d478a4657Virustotal results 33.33%Heodo
2020-08-13Dat_2020_08_13_0524483.docdoc 20f5cc9fbf75378db1d233e17ea0cf7684dddd9e38fb65a4503ed0f0786ef250Virustotal results 33.33%Heodo
2020-08-13mes 24740.docdoc f4ec266b14464dadad86630e4f028e4e59dd7e7b806925e1ea65fa9e277abf11Virustotal results 35.00%Heodo
2020-08-13MES 2020_08_13 0273270.docdoc f9c8ab13c75b9b4f583962eddd9376163fe85a8e12736648689168bca6f49511Virustotal results 30.00%Heodo
2020-08-13Inf 20200813 B135117.docdoc 6e1d4ebef172aba38558318e3b3c7a6dcd0d21a68d2c7fdcf3ffc232ec58fcf7Virustotal results 33.33%Heodo
2020-08-13File-50100.docdoc 92ef252d93dc57fe3b08c5ae7b0d8a6054d85e3b6f378af68a5c184099aa75e5Virustotal results 28.81%Heodo
2020-08-13rep-EWZ17203.docdoc 57270c211c92893639f45356ac942602a73f44cd8d9f13538b2afd2e300ea475Virustotal results 28.33%Heodo
2020-08-13inf_20200813_OPI061362.docdoc e3b735c7e48d5fd9dd8fbed7a6c5665a9000bb4d3022e2662ff985e567bf4441Virustotal results 28.33%Heodo
2020-08-13DAT_2020_08_13_5081.docdoc b28a644c94ec07cfbc99912b660b91d890b2304970d93aba2ff03de9aafc1b85Virustotal results 28.81%Heodo
2020-08-13File 2020_08_13 95460.docdoc 71138dfb52abb1494dd6a9679780b98135af8c9ae72403e6069a7b8d4d689633Virustotal results 29.51%Heodo
2020-08-13file-275.docdoc 9ebdc1707f453d133205f9dfc76335b15a369b7010b9a9f423917c2003bb4d9aVirustotal results 27.87%Heodo
2020-08-13Rep_9872935.docdoc 56700454c24541743b48ffbc93ef4b0f3a6d1a59d461c082c06e8c83f839978aVirustotal results 26.67%Heodo
2020-08-13mes_20200813.docdoc 21daf21da8f0b098290789d2482e138e7d7aa4cee35835b46dd8684136aa0a2cVirustotal results 30.51%Heodo
2020-08-13mes JB557.docdoc f761201420ed2a148838312db59cbe8632b09b4245505adddbc834a1f9074164Virustotal results 30.00%Heodo
2020-08-13inf 2020_08_13 1384.docdoc 9bc093e7b7a9f7023d6b67826adae21a593c5b2a936dfc90db87008c209cf9c0Virustotal results 30.00%Heodo
2020-08-13ARC-2020_08_13.docdoc 65e17151cf8bf00538cd1a2c67e9bb722880485e9f9564efe966f57f6882aac9Virustotal results 28.81%Heodo
2020-08-13dat 2020_08_13 631.docdoc 2ad23af4014fe937433f4df6f4623f11d97900dc02f74ee90b1bf873ed2eb9b9Virustotal results 28.33%Heodo
2020-08-13ARC_4892913.docdoc 40e4dd488584ef8860fa5634626a6da95aca2703d7796c40d4dbb609c92d8cf8Virustotal results 26.67%Heodo
2020-08-13inf 2020_08_13 Z2683.docdoc e6dc6e50ffc9a797059e2694751f99b03d4952479b2b4d8afb40b5b1b809cba4Virustotal results 26.67%Heodo
2020-08-13File.docdoc 8e34aac321039ce22c7bbb89b61257a397013e7b62607102bea64b2fb1f61960Virustotal results 26.67%Heodo
2020-08-13dat 2020_08_13 E97835.docdoc 6ec6d45a56a019b13a8ab1e1c3baadaf527068d99cc1e640801f34f9aea32c11Virustotal results 26.67%Heodo
2020-08-13rep-X06180.docdoc 48fbb5d57c3837b61bd9326f28dd064e51928b1038fa735a0c28a99342bad063Virustotal results 28.33%Heodo
2020-08-13dat_2020_08_13_67017.docdoc 21c04e61b8204b3b63d3420fcf570b5d7d063338639fac037a6748df5386e1a8Virustotal results 27.12%Heodo
2020-08-13Mes-8610845.docdoc 5c70b1d9be2e62d3cb581708789ffcafdc47ae8733f09039db0c3c7bfe9041d9Virustotal results 51.67%Heodo
2020-08-13file NAL41572.docdoc 57fcedf7b710607daf3ff9d1d3f81b02e5597d6a760e10c3af3805702f2e2ec5Virustotal results 51.67%Heodo
2020-08-13mes 2020_08_13 LF007.docdoc c58ccc775e7c2333d87ae2d0e8b965a9c633a1eebb558d4e153f2ed1a7cb63e7Virustotal results 50.85%Heodo
2020-08-13Mes-20200813-YYQ4720.docdoc 1dd5d7a44f9459e8c6b9aedd3201e616a357788e0008f048f110c382e7411b54Virustotal results 52.46%Heodo
2020-08-13rep_848278.docdoc d16cd96a6382c743e97444d51967f3d83c72ca0618c6d92facad07211712c9beVirustotal results 51.67%Heodo
2020-08-13REP-20200813-3398.docdoc 0920dc57ca08f4f9277d39f3d1b693eb0d12d7fc1c856a1c90689f5151a62dd5Virustotal results 50.00%Heodo
2020-08-13REP-20200813-3398.docdoc 0920dc57ca08f4f9277d39f3d1b693eb0d12d7fc1c856a1c90689f5151a62dd5Virustotal results 50.00%Heodo
2020-08-13LIST.docdoc 7efe325d3dd462aa685894527836d96928d50d1fe594ceab5af597a3df8c258aVirustotal results 52.46%Heodo
2020-08-13REP_20200813_BKH85985.docdoc ccef51f2aac08b771675329e49226ef621176b8408f1e7f7b72aa4359c3d137dVirustotal results 50.00%Heodo
2020-08-12Doc_2020_08_13_2538.docdoc 5aaa39535adf5512408d58dfbf5d54f364b46a2ed6bd258250858b08f2d13e3dn/aHeodo
2020-08-12dat-2020_08_13-9315779.docdoc 6793d7866cd3e3e456843e5eaab907dbcf624cd6b5431f5f40c0cbf492da582dVirustotal results 50.82%Heodo
2020-08-12MES-2020_08_12-MAW61003.docdoc 986acc515daf31c8bd8d424f27e1307eab1f51a043c896ffeb2cd94df1eed8a1Virustotal results 49.15%Heodo
2020-08-12arc-20200812-CM595.docdoc 9745f640a27a145d01b04bb88de1d7b7ab7e784d59fdf5248a9bf9f0508cfefdn/aHeodo
2020-08-12inf_20200812_FA073.docdoc 99587a42037e6883c1b3d9ed477034427499b230aa1d61f823e0771f83d94944Virustotal results 47.54%Heodo
2020-08-12DAT_20200812_98051.docdoc 2422c30dd203e8ecad236795237c40fe7882df559a3eae1ef37ff6f520c8e3ecVirustotal results 48.33%Heodo
2020-08-12INF.docdoc 657108dec334ce0dc7b2f812ad44ebe4305705d156853e7c3f4c929f9127daa7Virustotal results 50.00%Heodo
2020-08-12MES_9356.docdoc c194497bd53deae5037d7ffd04e93de9ae4a080daa6a37959aa42207f197a31aVirustotal results 45.00%Heodo
2020-08-12ARC-VPL319.docdoc e060a3ea1c14105f1702e8b612d1095bd704a9757c2107e3aacc4ce542cf2af4Virustotal results 46.30%Heodo
2020-08-12file HPR5958.docdoc c3c7747e66aafb9af769e878af351dc5bf1d8a99d79617122ee15e02ace032b3Virustotal results 40.98%Heodo
2020-08-12dat-20200812-ERZ2578.docdoc 927446d346c23c410b9de04fd3ed99d22a4d077ec738634934c7e31298bb0e31Virustotal results 37.70%Heodo
2020-08-12Mes-20200812-893554.docdoc 6b6d945cfba7f58812d7c716d37f887c9d81c2edb7c04cc524c5a0284e128289Virustotal results 31.67%Heodo
2020-08-12List_20200812_464670.docdoc b4bf6e6e6eccfbddd61630876d0209894b69e9b122939c029d31b8b8b627d478Virustotal results 28.81%Heodo
2020-08-12ARC-20200812-J227621.docdoc 98cdaca6fb4bec5a48ca84cbfa00b123f41849a8c0e94c9a7a0b5e2e00bc2ddeVirustotal results 28.33%Heodo
2020-08-12Dat.docdoc 4a57ee0f815573230706a5077ac0b74ee8e1b28a2961f94fe17bf39b26773cf6Virustotal results 28.33%Heodo
2020-08-12ARC-20200812-W500977.docdoc 9a3e221e7a322b7b9aba32f18fc7ef8751835341d9657cecbb8b53596702b4fbVirustotal results 28.33%Heodo
2020-08-12inf_595.docdoc d1f274b1452a853782a85f27cb32c0d4df29fa2499f3c70932429390168f81f2Virustotal results 29.09%Heodo
2020-08-12FILE-134.docdoc ec492f642a8aa6fa2d723853f3406c42a3604e895011181c3589e5794cfd4375Virustotal results 28.81%Heodo
2020-08-12Arc 2020_08_12 690455.docdoc 39561a75fef92cc0d348f65d09feca92d1752da2928ff0217a3ba4f1db86c28fVirustotal results 28.33%Heodo
2020-08-12INF_20200812_A963432.docdoc c15363c91a8b99bc22063620a1747a678b17db67321d1b7e850d753f76f56231Virustotal results 28.81%Heodo
2020-08-12REP 20200812 3969.docdoc 50ef5d0b0b7a0a0854a2bcf084cf61dca7c50050f555e23a4d4bf3e23a37a96eVirustotal results 28.81%Heodo
2020-08-12INF I5049.docdoc c0d8e5987556d7ff3a75369c9d63e09f487dfdc0b64d5c719f649fc8f28c325bVirustotal results 29.31%Heodo
2020-08-12FILE_H329.docdoc 1f27218c725463172439c15f32c83326dbeb737a4ac98eab3e936d2588197d16n/aHeodo
2020-08-12rep-20200812-JO211.docdoc 930841c56eace6e8749615832567b64ead1f2589645a88e34c401323873e3564Virustotal results 28.81%Heodo