URLhaus Database

You are currently viewing the URLhaus database entry for http://www.tekfark.com/newsletter/EN_en/Available-invoices/Invoice-668913590-081418 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:43538
URL: http://www.tekfark.com/newsletter/EN_en/Available-invoices/Invoice-668913590-081418
URL Status:Offline
Host: www.tekfark.com
Date added:2018-08-16 08:50:37 UTC
Last online:2018-10-09 13:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: unixronin
Abuse complaint sent (?): Yes (2018-08-16 09:19:34 UTC to abuse{at}cizgi[dot]net[dot]tr)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-08-16Invoice Query.docdoc 02e8d868a2c2bf0c0611ff91262e6baf2f2fee64565f35c92506347f1a9080ebVirustotal results 25.00% Heodo
2018-08-16New invoice 66MJL7255.docdoc 0be4241572bb34864bce4a92517d2087cc96edfe8d943f8340b7b91f59eb9619Virustotal results 27.12% Heodo
2018-08-16Latest invoice - 729624.docdoc c9ac91c9915eba1cf9ee1ce5d8680ab5c37167d17a618fd2c493e73b9c10b853Virustotal results 28.33% Heodo
2018-08-16Month notice.docdoc f6544b2096cd45209e5b18f355f1c22168362990626bf6546bfe0688754f9e33n/a Heodo