URLhaus Database

You are currently viewing the URLhaus database entry for http://duck.org/NATURALDOGTRAININGNC.COM/public/5633610272/fFL/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:437362
URL: http://duck.org/NATURALDOGTRAININGNC.COM/public/5633610272/fFL/
URL Status:Offline
Host: duck.org
Date added:2020-08-20 16:33:06 UTC
Last online:2020-08-21 16:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-20 16:34:02 UTC to abuse{at}servercentral[dot]com)
Takedown time:23 hours, 32 minutes Good (down since 2020-08-21 16:06:21 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-21form.docdoc 78a36b1f41b0c09c31d6bc4665036ff311e872b98404bb726312e26f0d559803Virustotal results 24.56%Heodo
2020-08-21092277870.docdoc c6c8fb9bb0d155bb4fe8b4b7904de586efbf5c79f49877313b380b848ad12da1Virustotal results 27.12%Heodo
2020-08-21Payment.docdoc 49612d16c5034da0d220d8300787064bc2c03459f17a84b5eda167e9a2e50cfcVirustotal results 21.43%Heodo
2020-08-2152716.docdoc 2ce951fdd23668dc604d3edaaa4e54fa607e9bdf62e6d471a60ec5671ac4b9a3Virustotal results 22.81%Heodo
2020-08-21Inv_60723.docdoc 1b0e2d810c06da0602e0fdc4a558ebf38c6fe9c8d2caf30fbbb4d364dcafcde8Virustotal results 22.81%Heodo
2020-08-21August Invoice.docdoc abedafc5e19de68937c53f7be30c1b392975062ba9a11d34a991ca703cd3c578n/aHeodo
2020-08-21Form.docdoc c50a12add2e3c75f860f563d042901761cb7ec0a2f4fa64ddc37c1dbbef8bbcan/aHeodo
2020-08-21PO# 08212020.docdoc 69eab92915bca8074c0e4c4a14a6d4532a6d4162923b7c51799ae872c647ee21Virustotal results 21.05%Heodo
2020-08-21Form.docdoc eeee33ce9e2286f03410cca48f68b1eac155b167eb430f7cb01333cc359a4d4an/aHeodo
2020-08-21PO# 08212020.docdoc ba4bb5f049cb59a1eb23f083cf22fe726a7d87f12e9b577f2eb52102b55496bcn/aHeodo
2020-08-21RC-080120 YNLV-082120.docdoc ebf536cc3ab147667e77823b5feaa2f72da1042d653ad11a26298800a7a86d77n/aHeodo
2020-08-21INV #009857 FOR PO #56885965.docdoc 4da5e980866878da930be670800361fd6b9b6ec73983dd60cdba9eb29bd09ab6Virustotal results 22.03%Heodo
2020-08-21Form.docdoc 1c8f1124a4ccfc01bfc51367aeeda6685df4fc2ffc245deca3430582af9e816aVirustotal results 17.54%Heodo
2020-08-21VWY-080120 PSLI-082120.docdoc 6bfe2a94bb14cb68d7ac4a146d4ebd2ece1cacec94b5260c9d59be8816a63601Virustotal results 20.69%Heodo
2020-08-21invoice.docdoc 7b92a86dabe99c11df1d176607cf155dba7ed15763592e1525e8c003d12a7e98n/aHeodo
2020-08-21Inv. 00775756446.docdoc 8ffb84f76b863917f3ef52c3c75dfa70bc77599b7deb86067b43c413c8ff681cn/aHeodo
2020-08-21form.docdoc 74b2828f7b7c61552b965a77ae1b071c06059f184a24b685be5f3094ade311ecn/aHeodo
2020-08-21INV_52931.docdoc 0d9f1f173fd3806d10312760c50f85b6fa23b65193732358ef675b670c84f5eeVirustotal results 21.67%Heodo
2020-08-21Form - Aug 21, 2020.docdoc e194c7cc8ffedeb69d1b752e312fd6605be5ae9f49e9b652a38246d0c865dab2Virustotal results 18.97%Heodo
2020-08-2100516224.docdoc 97b387cc7ac53574e95b7d09f100821989778d4fc076acebf7b546f24b500280Virustotal results 18.97%Heodo
2020-08-21Payment status.docdoc 9863cd177f065c8ae1efb649be3ccae73cbcfcf0ccfd4f7a1956bcdd5d599bcaVirustotal results 18.64%Heodo
2020-08-21Copy invoice #02789.docdoc 1956596f7ed909a0c2291a2a8b6ce38918255ae87ced9b557c898972bcce4d42n/aHeodo
2020-08-21HG6898202769YB.docdoc 5e37f5354f96cd177c761ca52c57c90a54d60875be3c4f6ce46dcdc0c5ee9884Virustotal results 18.97%Heodo
2020-08-21Form.docdoc 56e0e49883a186240907a045e8933efbbaa016d71dec86c1ae477064db00a160Virustotal results 18.33%Heodo
2020-08-21Form.docdoc 43a46142f7621ade3d5201623975cdd2f46d750261c13be021a2069028076099Virustotal results 18.64%Heodo
2020-08-21422336847.docdoc f18c5d3941f1fe1232a82e045cba9ab62b797025b1b7b5477a19a08b9b3fcae0n/aHeodo
2020-08-20OSA-080120 JSNJ-082120.docdoc ed8f3cd480b6fef9996f65e02cc1cb3d295447728fd009032ac3838d32e01f37Virustotal results 33.33%Heodo
2020-08-20form.docdoc 9c2952185499dfb564607790c299bf8a01a0bd16d64484be1812bfc88c5f5a06n/aHeodo
2020-08-20invoice.docdoc 73edfc2aba2a5e763fb0b40b55a4695a6d9e6f0069b17e693c982385b150b4c7Virustotal results 32.76%Heodo
2020-08-20Invoice #628.docdoc beb2d3691a0096ad6f8d004ee7df158d8580aa530e57b2872c943df21d056b60Virustotal results 32.20%Heodo
2020-08-20invoice.docdoc 5f721fa567c8707cbefd2292d75f13cbe60f70a768b9a902547ae56d954a7b81n/aHeodo
2020-08-20INV_5756.docdoc 0ce1f9eb5a77c80202cc0a91a877c8385bcbc61b6c7c2a5fd5a093a7b181fb1bn/aHeodo
2020-08-20062181988.docdoc 0c9bdaf25bc6465c491f19c920faa56544188ae9d41c7a0905bda06a835b6ec4n/aHeodo
2020-08-20Inv. 00703973632.docdoc 205b245311901312ed7d08e486ee280d59cf15060b656390f4ea347a7eb6d485n/aHeodo
2020-08-20Electronic form.docdoc acf06f69fc335f401184ad3a218aec5075641fe29bce91e0f71b698c062b3e0bn/aHeodo
2020-08-20Form.docdoc 6d8877c3fe622e60ade68b560890183ab6a8f3808d4425263f61709f82496187n/aHeodo
2020-08-20Payment status.docdoc dfa76e9900bf8cbd12e33296a77b645201adf2d0fd4977e777eb203cd11f1b3dn/aHeodo
2020-08-20Invoice 0040939.docdoc ae09a760faec9e5c8f9d147329271cb1fa3971b119943d8cc9e16ce71c8e5fd3Virustotal results 26.67%Heodo