URLhaus Database

You are currently viewing the URLhaus database entry for http://cnaantours.co.il/wp-content/ztpl/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:438067
URL: http://cnaantours.co.il/wp-content/ztpl/
URL Status:Offline
Host: cnaantours.co.il
Date added:2020-08-21 09:11:34 UTC
Last online:2020-09-05 08:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-21 09:12:02 UTC to abuse{at}upress[dot]io)
Takedown time:14 days, 23 hours, 4 minutes Bad (down since 2020-09-05 08:16:28 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-22invoice #6699.docdoc d264878eae29d3da022f38e67a38560346ba42cbb6dbebbf0e6c852c666fb1acn/aHeodo
2020-08-22Form.docdoc 51bb6063711677f1823d4b10c0ae073a340c8392a7b233485d1e181fab2197fen/aHeodo
2020-08-22August Invoice.docdoc 564105a864ba17349c0c70d8c11883b4edaf7b9f653bc074d57ec92e33923d61Virustotal results 36.21%Heodo
2020-08-22Electronic form.docdoc 5d343c4cc60ceae7c55758376842b90845f6d3dd1d7ab8fd2bed44ee745bf527Virustotal results 37.93%Heodo
2020-08-22Q-080120 INFF-082220.docdoc 90f17bd24601e8b3707503a6768ee606d3133da51a9d9e539bf906a83fcdda4bVirustotal results 37.29%Heodo
2020-08-22Invoice 41540.docdoc 27e2a7ad7764b75f11753d945f9b7b087f89fa4b8b9bc1198bf7992c7c85d1e8Virustotal results 37.29%Heodo
2020-08-21Inv. 00951408.docdoc d09a4703239b8dd258d5174bc65647fa6b951cecfcb7c2f9c46a29a061a7a769Virustotal results 36.84%Heodo
2020-08-21Inv_5800.docdoc 31ef2257cdb7b9006892fb9754673511beaf648f6c3a899b9bff3031310a9acfVirustotal results 37.50%Heodo
2020-08-21PO# 08222020.docdoc c7abec97a993780d8d6bdd8fbc2a7c77bb49fdd61e57637ac36ecefc9f748350Virustotal results 35.59%Heodo
2020-08-21Form.docdoc 2d4370eba117c88617870ab941572195d2facde4eb4e1d768507d37840812da2Virustotal results 33.33%Heodo
2020-08-21INV #00357574 FOR PO #494645545.docdoc e5c9f8c0ccfa47835d30be512636ad1b0e40d75587d5a309f586b67796aae5cdVirustotal results 33.33%Heodo
2020-08-21Form.docdoc 75afa5e681f780ff3ac189da47ea1eddeba7face6bc94ac9d07db672b9c00ef5Virustotal results 32.76%Heodo
2020-08-21A9225198192BM.docdoc 43057d3c74a6fbe3be2660879e861ae3d0b2118866abb1e3fe8bc169c526d957n/aHeodo
2020-08-21invoices 4150 & 5784.docdoc 214116ae52ad96af88fa41e0ea271fecb493e2afbc403bc3ca2c184ffd03d996Virustotal results 32.76%Heodo
2020-08-21invoice.docdoc 9e8252eaa40d9995798d1c88f2ee30e36cac7ac88bbddd38c4dd2d4c8d19385cVirustotal results 32.76%Heodo
2020-08-21INV_003846.docdoc c2df091253a5c3fd605759d6e277f88a01de99b7cf35b2ba5b1dfe70689726f5n/aHeodo
2020-08-21INV_744019.docdoc b99da0701a16d0df2895790bf84db62ee0da6b42fa8ea0c2a5b103a131d98f13n/aHeodo
2020-08-21Copy invoice #9174.docdoc 5ad1d00e81e5e6bbc93829790980fabae6eab63a8638ed9bc024a27d083ffb87n/aHeodo
2020-08-21August invoice.docdoc 43638c344ac4a446af722c229682fee9a8434923ce1cf6dd1a19bd2a0fc78c21Virustotal results 25.86%Heodo
2020-08-21Payment.docdoc dfb4a0445bee97a362ee8ea96a3cb6444bc3ef4b7c96beaa5edf0508e6343c56Virustotal results 25.42%Heodo
2020-08-21Payment.docdoc 4ab72d91d0e85daec3f451ceb24b75e35a698aec75707fa853f10d780396df0dn/aHeodo
2020-08-21Payment status.docdoc fa793702b351ab1f22fa5ff1d20c7f6bf822bd6954f637389577767a163275bdVirustotal results 25.86%Heodo
2020-08-21067870925.docdoc cafc557261c0f9e0e43f24e43efbf14505b54d38271152c48e4a6dd3279769c7n/aHeodo
2020-08-2118779.docdoc 78a36b1f41b0c09c31d6bc4665036ff311e872b98404bb726312e26f0d559803n/aHeodo
2020-08-21August Invoice.docdoc c6c8fb9bb0d155bb4fe8b4b7904de586efbf5c79f49877313b380b848ad12da1Virustotal results 27.12%Heodo
2020-08-21Form - Aug 21, 2020.docdoc fa73c7c4709f00943c0995e1c8b64edce7bd0443e3a2fa1c4940c978d35fa794Virustotal results 23.33%Heodo
2020-08-21Inv_1604.docdoc 224d0b30bfff0d484bbc3b3cf1f7a97443aaa5656865fa5af8a3d545b3d5048dn/aHeodo
2020-08-21M-080120 HMVP-082120.docdoc a99b807165ca13d9f9b50acacbb5c81c8e155e9347c5ff01cee84f4f19806a22Virustotal results 22.41%Heodo
2020-08-21INV_2368.docdoc abedafc5e19de68937c53f7be30c1b392975062ba9a11d34a991ca703cd3c578n/aHeodo
2020-08-2105602367306.docdoc 3e4b8326cfd9bfaeb2956b955bf3644032eb675cfd32a6284f371b2d6f68a47bVirustotal results 22.81%Heodo
2020-08-21invoice.docdoc 69eab92915bca8074c0e4c4a14a6d4532a6d4162923b7c51799ae872c647ee21Virustotal results 21.05%Heodo
2020-08-21Inv_61090.docdoc eeee33ce9e2286f03410cca48f68b1eac155b167eb430f7cb01333cc359a4d4an/aHeodo
2020-08-21Invoice.docdoc ba4bb5f049cb59a1eb23f083cf22fe726a7d87f12e9b577f2eb52102b55496bcn/aHeodo
2020-08-2105979954774.docdoc ebf536cc3ab147667e77823b5feaa2f72da1042d653ad11a26298800a7a86d77n/aHeodo
2020-08-21P8 invoicing.docdoc 4da5e980866878da930be670800361fd6b9b6ec73983dd60cdba9eb29bd09ab6Virustotal results 20.34%Heodo