URLhaus Database

You are currently viewing the URLhaus database entry for http://nairapath.com/wp-includes/XmYO/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:432359
URL: http://nairapath.com/wp-includes/XmYO/
URL Status:Offline
Host: nairapath.com
Date added:2020-08-13 19:35:04 UTC
Last online:2020-08-14 07:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-13 19:36:05 UTC to abuse{at}ovh[dot]net)
Takedown time:11 hours, 31 minutes Good (down since 2020-08-14 07:08:01 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-14invoice-UML51-8023897.docdoc 865aa27f909822b77734136c2ce238a258cbf8a6041b588f5fb75c284fab5d26n/aHeodo
2020-08-14Inv RB589 59639490.docdoc c32ebf07a4f2324cc33cf6e7c975c375621c519fa654fc27303c9a812293fd7fVirustotal results 39.66%Heodo
2020-08-14Invoice VD3039 7843395.docdoc 854fcd9b34f74cfd7956a1bfd5de137afaa0c79aa3e1e80ccc4f87410e0e6159Virustotal results 40.00%Heodo
2020-08-14Inv XBWS858 205661462.docdoc 3d8831fa48eda1b1975a84cde54f8775ceecc95fa6ae4278a9ee533cf37d9d8fVirustotal results 38.98%Heodo
2020-08-14invoice S8 66556520.docdoc 8b725e5a090dcb30815c5df978e72af9a04372b9fda6729678004e9bdd617ce6Virustotal results 38.33%Heodo
2020-08-14invoice 739 27381635.docdoc 167459762dfa748a07ae8e4d2479e9733ad4d66e0d833453daa2038e833efa29Virustotal results 38.33%Heodo
2020-08-14Invoice-H2571-167715316.docdoc 5b5e18fb115c6b3ac31082a0b3d864e051d30cac7f5a27ce29d97c3deed87a5eVirustotal results 37.70%Heodo
2020-08-14Inv-G7-23178198.docdoc 0b134d91d537beab9f4e700b126eb1b43b69c80126818592cef4697fce08263bVirustotal results 37.70%Heodo
2020-08-14INVOICE-4-137349.docdoc 4398bc31070f761b318b30f297d363b006ed9e84c6af0aa45ad140f57e7c1529Virustotal results 38.98%Heodo
2020-08-14Invoice-R786-7664665.docdoc 532d6be9513e3dea9cfb7040d4e2b0878429f90b84e8c3229ba775ff99dcfbbcVirustotal results 37.29%Heodo
2020-08-13Inv-QLGR870-586812.docdoc 1ffe441dc57cc6d6fab94949536fc37e1ee200c8108f3345a48a04ca268d097eVirustotal results 36.67%Heodo
2020-08-13Invoice-521-8294881.docdoc 5631e8cae72c63a40c3b2b7558736633f75b424eff6bad19103ca6d559955528Virustotal results 36.67%Heodo
2020-08-13INVOICE-UBAO01-7589133.docdoc 88d310c1de24f5a780b5269aeff8f47a6715c4fcc531df6ad2e8b2fce834773bVirustotal results 35.00%Heodo
2020-08-13Invoice841303218.docdoc ff68f4adbb2d5f421b94ec8c2ca343c8dc807544237928a2617bb4c1dd32b7b8Virustotal results 36.67%Heodo
2020-08-13INVOICE-RGA66-81136886.docdoc 653065e50db8318e4c980f45418849681df513e216b29c07cc7036442b0f9cfeVirustotal results 36.07%Heodo
2020-08-13Inv 56 16571270.docdoc 49d66f1859784a289e46f5690a521c15cb397cb29ad8db6882806c03628a4b97Virustotal results 35.59%Heodo
2020-08-13invoiceBZKT10700087.docdoc 5068ac1fc3ea1af3eb637bed169df3a72f14ab7db56ff2996f718fbe8c05642eVirustotal results 36.67%Heodo