URLhaus Database

You are currently viewing the URLhaus database entry for https://ffforest.com/wp-content/31lvk0-7502/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry



Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:436582
URL: https://ffforest.com/wp-content/31lvk0-7502/
URL Status:Offline
Host: ffforest.com
Date added:2020-08-19 13:07:20 UTC
Last online:2020-08-25 11:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-19 13:08:05 UTC to abuse{at}digitalocean[dot]com)
Takedown time:5 days, 22 hours, 5 minutes Bad (down since 2020-08-25 11:13:29 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-21Invoice.docdoc 438aaef09f18c29d20a8a5a144a2ec60b59c645a3945b40f6f55c229b1efd099Virustotal results 22.03%Heodo
2020-08-21Invoice #307810.docdoc d3d3fa5a2c2eaa01efb9e027e292340107ca8435c312a037fb69809c454e64e5Virustotal results 22.41%Heodo
2020-08-21invoice.docdoc a4144c641d91901e22abbefc33604f1e8afd8706524f72d73dde59e468f985fcn/aHeodo
2020-08-21invoices 28415 & 31497.docdoc 69eab92915bca8074c0e4c4a14a6d4532a6d4162923b7c51799ae872c647ee21Virustotal results 21.05%Heodo
2020-08-21invoices 6330 & 9995.docdoc eeee33ce9e2286f03410cca48f68b1eac155b167eb430f7cb01333cc359a4d4an/aHeodo
2020-08-21Invoice #4861.docdoc 3a974dd5a6056d44b63cf6bf29defe20ee009bcda0ff1d809a2642a32bcdafb2Virustotal results 19.30%Heodo
2020-08-21INV_854064.docdoc ebf536cc3ab147667e77823b5feaa2f72da1042d653ad11a26298800a7a86d77Virustotal results 19.64%Heodo
2020-08-21invoice #499774.docdoc 4da5e980866878da930be670800361fd6b9b6ec73983dd60cdba9eb29bd09ab6Virustotal results 22.03%Heodo
2020-08-21Payment.docdoc 787b14bfeb8561a5053f8ef91cecff83bea99a6acf52f2aea33414fa780bc5deVirustotal results 20.69%Heodo
2020-08-21Invoice 009483216.docdoc bfa9030c4923b22a26ab343f17ace0c0b90cb5a79c02e635937d73b994c50b42Virustotal results 18.64%Heodo
2020-08-21August invoice.docdoc 1379c04142852211fa0a0fa5b67d4f96ec3109824d6c39002d6691ffc2c7b9c7Virustotal results 20.00%Heodo
2020-08-21Inv_8116.docdoc 7552ebec57d7bd58dbd5e68f18c92abaabee85b838225aaf83ab280ad6a56c63Virustotal results 20.34%Heodo
2020-08-21Form.docdoc 77eff3d8be8f0619c0ed160d57d5a1cbca19e40f899c3d91ccda258cac6d28f0Virustotal results 20.34%Heodo
2020-08-21Invoice 69671.docdoc da6cfd72a982796c23b85856bdad5e44b0a6b35b120440b1be740f5424b3dffen/aHeodo
2020-08-21August Invoice.docdoc e6554a2e22bd668e8d313c650ce0c96376d32455aa01d0dadb819d9e7705491cVirustotal results 21.05%Heodo
2020-08-21Payment status.docdoc 97b387cc7ac53574e95b7d09f100821989778d4fc076acebf7b546f24b500280Virustotal results 18.97%Heodo
2020-08-21WW0429883487ZS.docdoc 3d0173175bbc0f83d9a5a2b8324c817f6a433756949f63691ec5374d82859a6fVirustotal results 18.33%Heodo
2020-08-21Payment.docdoc 1956596f7ed909a0c2291a2a8b6ce38918255ae87ced9b557c898972bcce4d42n/aHeodo
2020-08-21Copy invoice #069744.docdoc 056422ba5efdd400cd3e984dd7bbfa462d6e94a0307fdb3221896725d9343799Virustotal results 17.24%Heodo
2020-08-21INV_650816.docdoc 132bee064e373b5e7447b79bba27ef8041e4b127fa866cbbc09387f7f2fdbccaVirustotal results 20.00%Heodo
2020-08-215105729635QY.docdoc ad61f377cd0d259cfabac17a4a874cd5dbd88b076e00680d5fb1d31706816ca7n/aHeodo
2020-08-21PO# 08212020.docdoc 6c9f9211442fdf99897ba3034da0ea04349bbfd3975f0176220c4e19f3e52b23Virustotal results 18.64%Heodo
2020-08-20Payment.docdoc ed8f3cd480b6fef9996f65e02cc1cb3d295447728fd009032ac3838d32e01f37Virustotal results 33.33%Heodo
2020-08-20invoices 999 & 48575.docdoc 9c2952185499dfb564607790c299bf8a01a0bd16d64484be1812bfc88c5f5a06n/aHeodo
2020-08-20Y7726151282EL.docdoc 7e65999218e740149ebaffa84725ce3f6f0cecd5b565bf4f0e3c5f546785513cVirustotal results 32.20%Heodo
2020-08-20Inv_3132.docdoc beb2d3691a0096ad6f8d004ee7df158d8580aa530e57b2872c943df21d056b60Virustotal results 32.20%Heodo
2020-08-20Payment.docdoc a5257e575894b7fdceb18f36985ab8d6394e335b4458d40dc376703089368bb7Virustotal results 32.20%Heodo
2020-08-20INV_412788.docdoc 5fa853ef0f61449fd95c38ca7e61ac05ab40c240e9d88e8cb0a80e9a3f8f82b0n/aHeodo
2020-08-20Form - Aug 20, 2020.docdoc 0c9bdaf25bc6465c491f19c920faa56544188ae9d41c7a0905bda06a835b6ec4n/aHeodo
2020-08-20Electronic form.docdoc f457c31693c17d7acdb742f48c6956eacee52a2ecc0a3e126b6741050d067c58Virustotal results 30.00%Heodo
2020-08-20Copy invoice #3351.docdoc acf06f69fc335f401184ad3a218aec5075641fe29bce91e0f71b698c062b3e0bn/aHeodo
2020-08-20August Invoice.docdoc e79f874f85e1c3d9217c3f5c561ccc6fedc03704529d9b29e5908a7e61b1d847Virustotal results 28.33%Heodo
2020-08-20INV #00529 FOR PO #09077007.docdoc dfa76e9900bf8cbd12e33296a77b645201adf2d0fd4977e777eb203cd11f1b3dn/aHeodo
2020-08-20WSZ-080120 GHTV-082020.docdoc ae09a760faec9e5c8f9d147329271cb1fa3971b119943d8cc9e16ce71c8e5fd3Virustotal results 25.00%Heodo
2020-08-20PO# 08202020.docdoc e3b9adfab9f86293c439dc64a2392bdf6645cd200616eb185bc3c8fa23cb0839n/aHeodo
2020-08-20D2078103507IL.docdoc 1c104db579e861c4c2e39952f6bdf68c5f428c16939b3bfc8d3ba3e68e01c387n/aHeodo
2020-08-20PO# 08202020.docdoc e443378d873265488a567b773f21b158d57af083c5cc445816d2614bab276bdbn/a Heodo
2020-08-20B06 invoicing.docdoc 5156e2526958c387a88519d9be71196ec810c2e00341e7df0cd8cb8a05913a79n/aHeodo
2020-08-20Copy invoice #43538.docdoc 59bcdfaf3c246f428683928bb6cd81d848f24678c624c51b53617c3b00c71c62Virustotal results 21.05%Heodo
2020-08-20form.docdoc 7e06ee4704f2c5f8a4ed2f68565f3f7518dd9ae22b9ae4fde59b898d8d9647d0Virustotal results 21.67%Heodo
2020-08-20O004 invoicing.docdoc 7177e2e37fc39a2e6a83875aca9a3ee888a88d8bc6538b81556edebfe11067ban/a Heodo
2020-08-20Payment status.docdoc ccbcad2a9942d0f7bf92e15755b8a683672cd6ec815358a55c4d2b2a74f6b93cVirustotal results 22.03%Heodo
2020-08-20invoices 2016 & 72083.docdoc 08b3de55dad98d0f5d6da607f88353e781d425a5751a0c605e694309401b9a48n/aHeodo
2020-08-20invoice #5712.docdoc 700b22e0508a889751892ce66df22fe34fcf52222db541d24e6d338aa351cfedn/aHeodo
2020-08-20August Invoice.docdoc 65d358d5c25eda27078f168b3fd190c5250bfdf1b58bceb28681f2535de96423Virustotal results 41.67%Heodo
2020-08-20Form - Aug 20, 2020.docdoc 35cdbc32f50870b20e2cd551f4805152d7ff4c9a9977739de4036d9fe76a6e0cVirustotal results 42.31%Heodo
2020-08-20INV #005139356 FOR PO #1131514514.docdoc dfe1b54460ef167e73d717605365e9af278254cbdc15c6010a4a59f18a9a53f1Virustotal results 38.98%Heodo
2020-08-20form.docdoc 1ded2d7cc228ed55fcd64164252d2a2da11cf10ad774d7315bcccd449336ae72n/aHeodo
2020-08-20Inv. 0792105.docdoc 65888689126472383a73d6085058a25ef793eee01025368fa775fceb4d8b0f0cVirustotal results 40.00%Heodo
2020-08-20234392.docdoc 6d2b21d6252c4659acfd6b04ba63540c373507ab3df7cf2d209a7eb70c693654Virustotal results 40.00%Heodo
2020-08-20Payment status.docdoc f1a7f5de80b5f75e5e52318197ab69af5a862ec92c7d2c27680503abc81e989cVirustotal results 40.00%Heodo
2020-08-20Invoice 2755329.docdoc 252905fc07b8d4de77b22dd1c68bba23716cb7bfbf56bae15a624f59b7e69c70Virustotal results 38.33%Heodo
2020-08-20Invoice.docdoc a0601dc3c3afeb7471b9fe739ce24e0b476d100c3f2ee756df211888184f67f0Virustotal results 36.67%Heodo
2020-08-20Inv_12274.docdoc e10d9e51f37cac947f9dac20f25fe6c9cdbc9a27072d1f54575087d0d63179fbVirustotal results 38.33%Heodo
2020-08-20Electronic form.docdoc 7525c4f7d0c94e9857d4b84b20357ed327900e78defe3291bbed47d0d29e1de4Virustotal results 38.33%Heodo
2020-08-20invoices 5185 & 4203.docdoc 416a4f17b5bc066941020cd43640276363268db7cb067a8cc7f1d27c3cb3cdb2n/aHeodo
2020-08-20invoice.docdoc fa10393ccc08487ee9b80a41d01c9e5e87c3c7690a74327b1b19e47f3638b66cn/aHeodo
2020-08-20Form.docdoc 2cceef317fac265bf56fc5819196f6a58b95574e8085a889f61ed9cd5c6c387bn/aHeodo
2020-08-20Electronic form.docdoc 741eedc40d043df1d8abba1e18fdeab3d276fd970087ad3b980243aba3c4878fVirustotal results 38.33%Heodo
2020-08-20Electronic form.docdoc 04a14a477cf1d1d2e5a426b932542d931d6264a101a10da26141be2752db8a72Virustotal results 38.33%Heodo
2020-08-20invoice.docdoc e138a2d8f76c4e6fea232fce64cf92aaa0e8ad25dc803478feb65bf7e4c0f1abVirustotal results 35.59%Heodo
2020-08-19Copy invoice #38845.docdoc 8fef0fa03aec63f50c5f6c1b055fc5c7c90f092a2b4549ef022e6696d49c9bb7Virustotal results 35.00% Heodo
2020-08-19004403338.docdoc d225f5ee78fabc34f19b2f3cce92c9ba74649bd52222615bc3c7d4301e1d174dVirustotal results 32.20%Heodo
2020-08-19WE003 invoicing.docdoc 0afb1e2bd8f57fd4721ea9c6c4aaa2d17869152f7af2ee64c444c1aa14a65b88Virustotal results 28.81%Heodo
2020-08-19August invoice.docdoc 00dc8f4dbf138ff2622714c0e902f76f4c7aad0f80d9b5951f570ffba07b06a3Virustotal results 25.42%Heodo
2020-08-19Inv_51006.docdoc 9271eec0c9ac0b607ce4f61e6a1af1443a1dada74751a30a1824022f5997ad93Virustotal results 26.67%Heodo
2020-08-19Invoice.docdoc 6c8f3d6b5662de56ce339803e730310d732baafb6c5cd44684a5d269aef0a715n/aHeodo
2020-08-19form.docdoc c6ba91f71d6bc297c2e22dff614dea1beeac08da4c5542c6f39965f56a1652ban/aHeodo
2020-08-19invoices 65023 & 76782.docdoc 3f264f86c32db58fb77b92f83cd9c55e90ce8506c3acb23643f7f822963c8d87n/aHeodo
2020-08-19INV #00289328 FOR PO #00687526683.docdoc 1d7c159e33def581945c754f2c428b759d067183638935b4197577049daca27fVirustotal results 26.67%Heodo
2020-08-1942555274.docdoc a23ca8534d64de0d28633de7ca8c1802694a85fb66d51390b0344a3996a49480Virustotal results 26.67%Heodo
2020-08-19invoices 1882 & 04321.docdoc a5abee611970f9e6c8147181b70132988d7a3172a65a2d4a3fec299e44113f15n/aHeodo
2020-08-19Electronic form.docdoc 9c4ad6afe20cf5ec9f5ef847b33041852fcf6ed32ab7c7c3d479101605763c84n/aHeodo
2020-08-19Invoice.docdoc a549ded3d409be938da9e0c2edc8533ecf31481dd2762e2c1a966e364bb686ebVirustotal results 26.67%Heodo
2020-08-19Payment status.docdoc 13f3878257ee674faf2a168745bae7b45ac31d3119b8387fb65e15e96ca2c73bVirustotal results 26.67%Heodo
2020-08-19invoices 38348 & 0322.docdoc 4801e4662a0e3eb0b952cfde8e51befa860b24d706108489b61d0d7365370989Virustotal results 26.67%Heodo
2020-08-19Copy invoice #617571.docdoc f31fa30ff617de311b5d96af69598b8ff711c495f94050572f7526409fb52748Virustotal results 26.67%Heodo
2020-08-19Copy invoice #81606.docdoc 4aa9f8c313d451e41422cb938583ccb7a44710e464a36df27f5a17d9ffc1ea9dn/aHeodo
2020-08-19Payment status.docdoc 5be435a1e0f024b46ac482841e2934df38ce00228c68caa2544d8aeac2406f14Virustotal results 27.12%Heodo
2020-08-190287650.docdoc 2368a75646ebe203cd37e3fca50910ce66c81dfd0acd46b32dbb8beba11508dfVirustotal results 23.33%Heodo
2020-08-19PO# 08192020.docdoc 78737d52c859f6e61c3348c7dbcbab3e263c5681593fe7eebbcecb9ef5b6db9dVirustotal results 22.03%Heodo
2020-08-19invoice.docdoc a6c0f9b77a2740ff615cb245fce18051af9e8f3be6f8e11512279f1abc121cd4Virustotal results 20.34%Heodo
2020-08-19Invoice #84647266.docdoc 50555f93c192790f2fa8ef0da88a9a708b644a533bf12b06e715ee633443116bVirustotal results 18.64%Heodo
2020-08-19Inv. 15175.docdoc aa142e756ab71382537a9bd7ef4e44a30f03c0e4230fe206ebc5e59377185b5eVirustotal results 20.34%Heodo
2020-08-19Electronic form.docdoc 3e203903e5cdf3d17235cef242ea85595d43db52734aafd935a4ae3e15d812b7Virustotal results 20.69%Heodo
2020-08-19Payment status.docdoc 3ae576ac839b49e7e34fc2bde74bee0f3226bd15de0db3a4eefd2bd6dc32410cVirustotal results 19.67%Heodo
2020-08-19Invoice.docdoc a92858c7d16363d08ba03ff81e5e5dff691bbd7ad892c4bec53ded0df684ecddVirustotal results 20.00%Heodo
2020-08-19Invoice.docdoc 69eb339c87a2847b96f8e1c697e0b016e8d2fc43fcc1b4febde910ac670906aeVirustotal results 20.00%Heodo
2020-08-19Form.docdoc 42be46b7e7ccf6d6be453438d6f35ff2bea5b39159fa232ed6f57591e77cd390Virustotal results 18.33%Heodo
2020-08-19Inv_49783.docdoc c9c48ce3b5223bf7e806d210c38ab6e3afc01b30ef9b733f57ef9e97efd1de21Virustotal results 18.33%Heodo
2020-08-19Form - Aug 19, 2020.docdoc 68f834bf0b3fd263cca6689079b684efdc29334393e65641bae50d9a4a2b75e1n/aHeodo
2020-08-19Invoice.docdoc facc2829ba5651fc3556e4b8463e4f15f15cd7dcbeeb3927463ccb70c882595eVirustotal results 18.33%Heodo
2020-08-19Inv. 0048383.docdoc 1bfd6c3bbd2b6796b634a07c27b257b30fd1d8380032ab835bc064dd384fa55aVirustotal results 18.33%Heodo