URLhaus Database

You are currently viewing the URLhaus database entry for https://dweixin.cn/gttu/xOfSL/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:432722
URL: https://dweixin.cn/gttu/xOfSL/
URL Status:flame Online (spreading malware for 5 years, 4 months, 2 days, 18 hours, 13 minutes)
Host: dweixin.cn
Date added:2020-08-14 00:37:37 UTC
Threat:Malware download Malware download
URLhaus blocklist:Blocked
Spamhaus DBL :Abused domain (malware)
SURBL :Not blocked
Quad9 :Blocked
AdGuard :Blocked
Cloudflare :Blocked
dns0.eu :Not blocked
ProtonDNS :Blocked
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2025-04-28 01:16:06 UTC to abuse-noc{at}west[dot]cn)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2025-04-28021126154b19050b5091c0751943ee22c06c1ce31f51c9720fd3feb87eb06e6b.jsonjson 021126154b19050b5091c0751943ee22c06c1ce31f51c9720fd3feb87eb06e6bVirustotal results 0.00% 
2020-08-15Invoice L6 7876015.docdoc fadbd33657aa2e9150143d82b696f5792afa254e412b4954693fbc91b55641e1Virustotal results 41.38%Heodo
2020-08-15INVOICE-TW2-71059048.docdoc c377dc79e60a07fedd6917cb54f6488abd8bc32518e611f3bc0af5114c86b9b9Virustotal results 41.38%Heodo
2020-08-15invoice-RISK29-995699351.docdoc 7685045c26c2b57ea45d561d8f6b9d4746939825e90633a6e3d72480686c1858Virustotal results 42.37%Heodo
2020-08-15invoiceNOYI054363750453.docdoc 608640cc09523824170abe5439a993ab6057204ad82c3c3af46ac0ebcf7cf38dVirustotal results 41.38%Heodo
2020-08-15Invoice V3 063995569.docdoc 903b4b0dbf79ba01b1c8a324c887cf2e6e7ddff21d2cb2091ab77cbc6c13b467Virustotal results 40.68%Heodo
2020-08-15INVOICE5189798114596.docdoc 6f7885a8876fa4d1cbc42c10aba9d34cb52a2965ef6b3927e8fd820da075660bn/aHeodo
2020-08-14Invoice-K5532-531955.docdoc d99946584345419df67e395ca69df43a7bf3aa628f35da4c7d7c6780c6268e44Virustotal results 37.93%Heodo
2020-08-14invoice_OI73_184822.docdoc 2ae0fb0ffcfdb106a9a9f0e5ca0e092207da05903f4126376ad7f2e153491abbVirustotal results 37.93%Heodo
2020-08-14invoiceEGQ616496151503.docdoc b8e3d4836d24b41192ee8a17ec384debcf3b71ad18e5a77361963c10ff28f3bfVirustotal results 38.60%Heodo
2020-08-14InvoiceLOV948548257.docdoc 3810fd4f070d74f98d715443319d9bfbf24cecae0fe9e2ca232db005db698ffaVirustotal results 39.29%Heodo
2020-08-14invoice F4 591028098.docdoc 13919f6948b28dafabdb158b97648c943e1759e43fbee6a487ccb5545d1beb9cVirustotal results 37.93%Heodo
2020-08-14INVOICE-93-92962470.docdoc 78ffd6c8749436f656b7f77eb1bf11edaf3ee4c2411dce4a22b8bbd6cb1ed515Virustotal results 37.29%Heodo
2020-08-14INVOICE15569450.docdoc ecad5745af706bbb7ea9c6ec69d389e2e6c4899ca17cb7fdf29ac1230375503cVirustotal results 37.29%Heodo
2020-08-14Inv-IXBP5596-7942330.docdoc 95cc5ce9259454f349e823d4c1e4c546a303dacfd17dd01c60af5f9dfb171cb6Virustotal results 36.21%Heodo
2020-08-14Inv XSBH6 073299.docdoc 4a01c8e6ec280343403441c5e17c55359032885ef2cfae8ad4fc165f3911bac3Virustotal results 38.33%Heodo
2020-08-14INVOICE-ZO8-9382429.docdoc 9b4854075266029833675d652902a1baea75b0755d7ebcd141125072d0967b65Virustotal results 38.33%Heodo
2020-08-14Invoice 057 206878.docdoc 7d38ec42e6eb68452eba752c599430e99516bd8186f16dd2a57fe52e9d5a6d5aVirustotal results 30.51%Heodo
2020-08-14invoice-CKC90-608308.docdoc 8c7b70ac18632b9f9a785376d2b3052c939dc86148c26b710dcae2e8072c836dVirustotal results 31.15%Heodo
2020-08-14Invoice OPME2 953169.docdoc 30a1ebc7ccadab73a1c6463cf44298031c3f083c146a97526e66aeb4f851e881Virustotal results 31.67%Heodo
2020-08-14Inv A800 028736784.docdoc 7547919d586a1ab27cf87b4e8b7031345a0ac4b24ac352d54627ede945055aa2Virustotal results 28.81%Heodo
2020-08-14Invoice-0688-798120.docdoc e25abc26006918a7b3aebd6972159b23fd0188c75af859831bf0c870f839a487Virustotal results 27.59%Heodo
2020-08-14Invoice-61-465863.docdoc 8668a5aae3e7db513fdb925e16313049037536bc67a86ed756b682c98b7f6f09Virustotal results 25.86%Heodo
2020-08-14InvTLW571270766.docdoc 946ce7bab4b96c0fd40f3bb134b7d616880bc04dc8eacdf9d4cf10f4c0287cb5Virustotal results 26.23%Heodo
2020-08-14invoice-TS4-6985879.docdoc fe58e66ba70c6c395732f2c817dbd2c6454463fc5104633ec022c7d1fac1bed9Virustotal results 25.00%Heodo
2020-08-14INVOICE_XO05_00668159.docdoc 287b1c2cdc4b225da919062620fa3a273db58864387add5e91f642613c416075Virustotal results 25.00%Heodo
2020-08-14Invoice 048 193067976.docdoc 78933fecf248691aab0f40469c0dcd29e03ea9922aaf89b7cdc830b802cfa8a9Virustotal results 25.00%Heodo
2020-08-14Inv-778-06185546.docdoc 187f385bef1fda1bcb05ef62b9e4189a16432875e3fba2d0b7cf1fd6e6739de4n/aHeodo
2020-08-14Inv C2809 0962132.docdoc b580ef15f157d6c19b61810ddb5f085007685d55693d05cb54782cb52bac7e2bVirustotal results 24.14%Heodo
2020-08-14INVOICE-89-036795.docdoc 73d4b0a7ca15e61e87a8fe48a88037618e4b4aac3d8a94cf4583f52cbab9bcc1Virustotal results 25.00%Heodo
2020-08-14invoice RBE8 601175.docdoc 30030c6895075670e825e0525914a4cd47352951eb3a2a04a2fab5e705f848cfVirustotal results 25.00%Heodo
2020-08-14Invoice_MWZ17_379072922.docdoc 07b144dd0033cf31233b85369f90ddc087ecdf0c5ae378612e504252db7c3f32Virustotal results 23.33%Heodo
2020-08-14invoice23268014.docdoc f841c145c39f74c12260a67c686e4dde761614e633f204a3e68f47750f2e6d1fVirustotal results 23.33%Heodo
2020-08-14INVOICE-FVO11-709381.docdoc 99db7baf30cee72146c4791d36d158ca3ed62a58dd3bd57b7bfa60d0f13b08d9Virustotal results 24.59%Heodo
2020-08-14invoice_9_26010203.docdoc 538aec1c87a88d78a75a417c253579be5fa18cefce592109122505cf70f2eea9Virustotal results 40.68%Heodo
2020-08-14Invoice-PJI808-779655993.docdoc fb17807621969c33d345882ad5ae95cd5294c32509e13a6fe8ce1d317a5c3f4dVirustotal results 38.60% Heodo
2020-08-14Invoice_ARUE2_39373341.docdoc 865aa27f909822b77734136c2ce238a258cbf8a6041b588f5fb75c284fab5d26n/aHeodo
2020-08-14Invoice-MI54-6598181.docdoc c32ebf07a4f2324cc33cf6e7c975c375621c519fa654fc27303c9a812293fd7fVirustotal results 39.66%Heodo
2020-08-14INVOICE-NHTL6241-266332.docdoc 854fcd9b34f74cfd7956a1bfd5de137afaa0c79aa3e1e80ccc4f87410e0e6159Virustotal results 40.00%Heodo
2020-08-14Invoice FY7883 709339294.docdoc d77766273a903661def8286676499fd3cf8f2a337cd8fa867e5788e5509db0e6Virustotal results 40.00%Heodo
2020-08-14Inv_B887_563436416.docdoc a5cebe26ebd797b743940f94cd3b74255ae3864a8042734c1b430e3da0198e2bVirustotal results 40.00%Heodo
2020-08-14Inv-MR8877-21329229.docdoc f740ad05fe75e146443ce0776602fc5828a534f28e1e2f34a1d785083de85bd1Virustotal results 38.60%Heodo
2020-08-14invoice-UMNR59-6386447.docdoc ad1c63f07f872f3b37453d29dce7654dc1b79e4f3e875dd8090977c30093b6f6Virustotal results 37.93%Heodo
2020-08-14INVOICE_KRJH5742_926096248.docdoc 0b134d91d537beab9f4e700b126eb1b43b69c80126818592cef4697fce08263bVirustotal results 37.70%Heodo
2020-08-14Invoice-NZ4107-20920316.docdoc 2879a9d705300779c0269f3a6847fb725a3564c7ae27f44226fe17f422474ca3Virustotal results 36.67%Heodo