URLhaus Database

You are currently viewing the URLhaus database entry for http://cd-shl.com/wp-admin/sites/TDyA/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:437190
URL: http://cd-shl.com/wp-admin/sites/TDyA/
URL Status:Offline
Host: cd-shl.com
Date added:2020-08-20 10:48:07 UTC
Last online:2020-08-21 03:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-08-20 10:50:07 UTC to abuse{at}kfglobal[dot]hk)
Takedown time:16 hours, 18 minutes Good (down since 2020-08-21 03:08:16 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-20ZMC-080120 NVNM-082120.docdoc ed8f3cd480b6fef9996f65e02cc1cb3d295447728fd009032ac3838d32e01f37Virustotal results 33.33%Heodo
2020-08-20Form.docdoc 9c2952185499dfb564607790c299bf8a01a0bd16d64484be1812bfc88c5f5a06n/aHeodo
2020-08-20INV #006304 FOR PO #03643028117.docdoc 73edfc2aba2a5e763fb0b40b55a4695a6d9e6f0069b17e693c982385b150b4c7Virustotal results 32.76%Heodo
2020-08-20Invoice #819481.docdoc 4e132ba6d019767be2f8156e367e5c0f60ee91db33f3517c525d22cace8bfa9bn/aHeodo
2020-08-20INV_760523.docdoc 5f721fa567c8707cbefd2292d75f13cbe60f70a768b9a902547ae56d954a7b81n/aHeodo
2020-08-20Form.docdoc 5fa853ef0f61449fd95c38ca7e61ac05ab40c240e9d88e8cb0a80e9a3f8f82b0n/aHeodo
2020-08-20August invoice.docdoc 0c9bdaf25bc6465c491f19c920faa56544188ae9d41c7a0905bda06a835b6ec4n/aHeodo
2020-08-20X006 invoicing.docdoc a103c5322646cc9b595ae3a661b33e07325e1462f53bbc5955a3c738d3fc6827n/aHeodo
2020-08-20INV #03611 FOR PO #005833746618.docdoc acf06f69fc335f401184ad3a218aec5075641fe29bce91e0f71b698c062b3e0bn/aHeodo
2020-08-200658044.docdoc 6d8877c3fe622e60ade68b560890183ab6a8f3808d4425263f61709f82496187n/aHeodo
2020-08-20POP-080120 GGKZ-082020.docdoc 91c51b6adfe6595da08931a5894071e6388a4cf770a95f00ee37480f8213916an/aHeodo
2020-08-20RM6400863861JT.docdoc ae09a760faec9e5c8f9d147329271cb1fa3971b119943d8cc9e16ce71c8e5fd3Virustotal results 25.00%Heodo
2020-08-20GC007 invoicing.docdoc 565a658a52901c5f0f0106f96c8e83c5bc9b0c91b259f8ece0aef34b546c57f3n/aHeodo
2020-08-20invoices 7820 & 07846.docdoc 1c104db579e861c4c2e39952f6bdf68c5f428c16939b3bfc8d3ba3e68e01c387n/aHeodo
2020-08-20Inv_80929.docdoc e443378d873265488a567b773f21b158d57af083c5cc445816d2614bab276bdbn/a Heodo
2020-08-20Form.docdoc 5156e2526958c387a88519d9be71196ec810c2e00341e7df0cd8cb8a05913a79n/aHeodo
2020-08-20August invoice.docdoc 7e06ee4704f2c5f8a4ed2f68565f3f7518dd9ae22b9ae4fde59b898d8d9647d0Virustotal results 21.67%Heodo