URLhaus Database

You are currently viewing the URLhaus database entry for http://wurche.net/cgi-bin/PGu/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:431931
URL: http://wurche.net/cgi-bin/PGu/
URL Status:Offline
Host: wurche.net
Date added:2020-08-13 13:17:06 UTC
Last online:2020-08-14 14:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-13 13:18:09 UTC to abuse{at}strato[dot]de)
Takedown time:1 day, 1 hours, 1 minutes Poor (down since 2020-08-14 14:19:43 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-14Inv-INLD461-6696152.docdoc d49209bce50df9e4800e85cb1cfb6952fb0cc47ee0ff8ffd9ab7e98ed132dc33Virustotal results 25.00%Heodo
2020-08-14INVOICE-WAR685-962008.docdoc a4bd9a81a37fee5b41e731813e4cea46796d5684c624d7f09e25be438d71b6dbVirustotal results 25.00%Heodo
2020-08-14Invoice-QA317-9168321.docdoc 31fd17ea13411b2b4c8a726012b7e3390527519bfcb805d9d895877a627c8f7eVirustotal results 26.23%Heodo
2020-08-14INVOICE YLAP4 3064771.docdoc a39c3a1d85563e52225ba5a4b21a11c2020fcfe4370f36c2bc012ae19d91103fVirustotal results 25.00%Heodo
2020-08-14INVOICE-X25-909723.docdoc b580ef15f157d6c19b61810ddb5f085007685d55693d05cb54782cb52bac7e2bVirustotal results 24.14%Heodo
2020-08-14INVOICE-V3-174103.docdoc 7358c63d00a9a687434f3915c70e05e268b5d414d08c19e063de5f08e84e92e3Virustotal results 23.33%Heodo
2020-08-14INVOICE_105_83294217.docdoc 4af3cc1ac4ee4610fa7671fdc8b02ad17ad4e71433250d2ab04291fc1f5e657cVirustotal results 24.56%Heodo
2020-08-14InvWOKR245711293.docdoc 07b144dd0033cf31233b85369f90ddc087ecdf0c5ae378612e504252db7c3f32Virustotal results 23.33%Heodo
2020-08-14invoice_J054_703004652.docdoc 495ebea1fd0ea1d5d47a3696aa58045c06311416da9f715ead1bc2809b8732b9Virustotal results 24.59%Heodo
2020-08-14INVOICE-B073-560082807.docdoc a437dcd3136177141f2affb2906b150c6c0da7a4a12a87e1c808b2b320370f18Virustotal results 40.98%Heodo
2020-08-14INVOICE-PTES5962-995562.docdoc e64e43f9549144dcb8e091b5d2140499702e699e14f019192575a50ce08d323eVirustotal results 41.07%Heodo
2020-08-14invoice IU7 1955412.docdoc 99dac5a117859eb23edb38d2da4b792d02b4a4d1fab2249bc171faf6bf1dfda9Virustotal results 40.00% Heodo
2020-08-14INVOICE-7-80433953.docdoc 3132acbb0aa02f175f2e8bf589a53e732564cf73f1f003cb64c842ba52d3c889Virustotal results 41.67% Heodo
2020-08-14INVOICE-FMJS396-3351648.docdoc c32ebf07a4f2324cc33cf6e7c975c375621c519fa654fc27303c9a812293fd7fVirustotal results 39.66%Heodo
2020-08-14INVOICE_A0_232839.docdoc 854fcd9b34f74cfd7956a1bfd5de137afaa0c79aa3e1e80ccc4f87410e0e6159Virustotal results 40.00%Heodo
2020-08-14INVOICEU42348907294.docdoc d77766273a903661def8286676499fd3cf8f2a337cd8fa867e5788e5509db0e6Virustotal results 40.00%Heodo
2020-08-14Invoice-JO576-11282968.docdoc 8b725e5a090dcb30815c5df978e72af9a04372b9fda6729678004e9bdd617ce6Virustotal results 38.33%Heodo
2020-08-14Invoice_QCYG398_64530736.docdoc 167459762dfa748a07ae8e4d2479e9733ad4d66e0d833453daa2038e833efa29Virustotal results 38.33%Heodo
2020-08-14Invoice_SQPK1_6103582.docdoc 5b5e18fb115c6b3ac31082a0b3d864e051d30cac7f5a27ce29d97c3deed87a5eVirustotal results 37.70%Heodo
2020-08-14INVOICE JAY4 97422275.docdoc 0b134d91d537beab9f4e700b126eb1b43b69c80126818592cef4697fce08263bVirustotal results 37.70%Heodo
2020-08-14Inv-D38-14373364.docdoc 2879a9d705300779c0269f3a6847fb725a3564c7ae27f44226fe17f422474ca3Virustotal results 36.67%Heodo
2020-08-14Inv-Z9-543247802.docdoc 532d6be9513e3dea9cfb7040d4e2b0878429f90b84e8c3229ba775ff99dcfbbcVirustotal results 37.29%Heodo
2020-08-13INVOICE_BS822_04039297.docdoc 2f955001e3dac3ecffeb44a715528d697945545d1093516a8b07523859e79d82Virustotal results 36.67%Heodo
2020-08-13INVOICE 12 34671424.docdoc 3eb6b088630e12b4b89f3af4f5b1366626605adddd5d7d447d1b4b8246d305bcVirustotal results 36.67%Heodo
2020-08-13invoice-D727-8535803.docdoc 88d310c1de24f5a780b5269aeff8f47a6715c4fcc531df6ad2e8b2fce834773bVirustotal results 35.00%Heodo
2020-08-13invoice_EHK9_04042753.docdoc ff68f4adbb2d5f421b94ec8c2ca343c8dc807544237928a2617bb4c1dd32b7b8Virustotal results 36.67%Heodo
2020-08-13Invoice-9-8817688.docdoc 653065e50db8318e4c980f45418849681df513e216b29c07cc7036442b0f9cfeVirustotal results 36.07%Heodo
2020-08-13INVOICE XZG0806 272351311.docdoc 49d66f1859784a289e46f5690a521c15cb397cb29ad8db6882806c03628a4b97Virustotal results 35.59%Heodo
2020-08-13invoice-B29-284688156.docdoc 5068ac1fc3ea1af3eb637bed169df3a72f14ab7db56ff2996f718fbe8c05642eVirustotal results 36.67%Heodo
2020-08-13Invoice634963619.docdoc efd5ba3aef6a5b7efdf02bba779391cf010ad01d68be10642219e412a940797fn/aHeodo
2020-08-13Invoice-GJ97-347194.docdoc 894dfe7d84439530c0f7bdca76e92f6d9ff10fe2121e0ff8decfea3153f5e91fVirustotal results 35.00%Heodo
2020-08-13invoice-VDEQ16-81654725.docdoc efd984b76bd38cb42bed4343bccb28e13e0e6f33e2795237f42c25f313c8ed81n/aHeodo
2020-08-13InvoiceU1793471789681.docdoc 17c0ad7fe3012db3c5ada59ba1d21436aa344ab57a37ce699684f8bbead66de0Virustotal results 33.33%Heodo
2020-08-13invoice_WO854_381421.docdoc 82b0468b8277859b0d4bff3af6eff0d446bbba4daa11cb4d96b62160bb22e3cfVirustotal results 33.33%Heodo
2020-08-13InvoiceMAX1938172703503.docdoc 196a89c54cda70af31877740ead0a738ead3533d3ef89e87e31b193044fb42f7Virustotal results 31.67%Heodo
2020-08-13Invoice-75-189731.docdoc 0d943363cc7316d93b7afdeaedc54c7b7f8dd8b7d63b81516d89202f6d95f96dVirustotal results 28.33%Heodo
2020-08-13INVOICE_IXB0083_376014451.docdoc 286f7949f545a67074545aa0830816a560a993143774c4468d041d5e656d2897Virustotal results 28.33%Heodo
2020-08-13Inv-TCS8-524824.docdoc b8a573213c36923b03e13902ca78fa55cd62d801d34fc7f5ecaf692f7b68482cVirustotal results 28.33%Heodo
2020-08-13invoiceEW8411245657.docdoc 938e03ff3d361fa26c00218160d0ef65786280283d80678e729a73ea503e0d95Virustotal results 28.33%Heodo
2020-08-13invoicePRS2244442732.docdoc 52c981dcee0a9c0bc80ec192b453e8af6b01ced6cb3187645687ad0fd1b13221Virustotal results 27.87%Heodo
2020-08-13invoice-CS40-6339672.docdoc 06166b3489e6b1ba8b3b7abbedf9fa72a55fc82e560c856df36cc781c2470e4bVirustotal results 26.67%Heodo
2020-08-13invoice_ZGV8_41358912.docdoc eeb469414b6509fdd0d204f306b29d55021e2de94608991794b5f59c2add1e07Virustotal results 26.67%Heodo
2020-08-13INVOICE 2 617208981.docdoc 3a957d2e54e658d116c346dcaf0dab5ecaec5e60bf7125b32087746f27cbe35fVirustotal results 29.51%Heodo