URLhaus Database

You are currently viewing the URLhaus database entry for http://linkintec.cn/wp-content/paclm/XRRCi/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:438362
URL: http://linkintec.cn/wp-content/paclm/XRRCi/
URL Status:Offline
Host: linkintec.cn
Date added:2020-08-21 16:36:09 UTC
Last online:2022-08-16 04:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-21 16:38:02 UTC to ipas{at}cnnic[dot]cn)
Takedown time:2 years, 0 months, 4 days, 11 hours, 29 minutes Bad (down since 2022-08-16 04:07:35 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2021-02-02Invoice 033335.docdoc 4b62592e2362d6cf5d365d2bcb2acf3e31a1b582ab1d6766c3b514ffd01ae6e4n/a Heodo
2021-02-02Invoice 033335.docdoc ea630be5f93830356229fe3f93e62df04fd8dad1e6e64e51808404acc3c8f707n/a Heodo
2020-11-08Invoice 033335.docdoc 2adb056e7c2e47627312df7d6bd9bb9c068e2d908f642aa56760badfe6ff496bn/a 
2020-08-22Form.docdoc d264878eae29d3da022f38e67a38560346ba42cbb6dbebbf0e6c852c666fb1acn/aHeodo
2020-08-22form.docdoc 6f6e1037eabcdd4495abaec04471ac97398c57eb88493b324e2d89ad9bd7af08Virustotal results 38.60%Heodo
2020-08-22E304 invoicing.docdoc 564105a864ba17349c0c70d8c11883b4edaf7b9f653bc074d57ec92e33923d61Virustotal results 36.21%Heodo
2020-08-22H3333749063QG.docdoc 2e74991bb85eca7f7f2a23a4d66723c0fd913e04060037642abc2f9525560cdbn/aHeodo
2020-08-2208156578.docdoc 88fafca4b3195bc1843721aa1d78221a5d05be8d88f43ceb0e85aab917c67a43n/aHeodo
2020-08-22Electronic form.docdoc b199113c89d1f14f205054c9a7cce7b661199224054e035b6f5044205dc27cf8n/aHeodo
2020-08-2103341184.docdoc d09a4703239b8dd258d5174bc65647fa6b951cecfcb7c2f9c46a29a061a7a769n/aHeodo
2020-08-21002653268.docdoc 31ef2257cdb7b9006892fb9754673511beaf648f6c3a899b9bff3031310a9acfVirustotal results 37.50%Heodo
2020-08-21Form - Aug 22, 2020.docdoc c7abec97a993780d8d6bdd8fbc2a7c77bb49fdd61e57637ac36ecefc9f748350Virustotal results 35.59%Heodo
2020-08-2124715.docdoc f08a4bd810866942876f3fbc7edb2f0b9409f4fd7f0b6b36254450693dfd88f3Virustotal results 31.58%Heodo
2020-08-21050298.docdoc e5c9f8c0ccfa47835d30be512636ad1b0e40d75587d5a309f586b67796aae5cdVirustotal results 33.33%Heodo
2020-08-21N-080120 YNRS-082220.docdoc df8d09457a129b57c4740b237ac226b0e0245d035dc20930563bab681e98e8c9n/aHeodo
2020-08-21TZ0381 invoicing.docdoc 43057d3c74a6fbe3be2660879e861ae3d0b2118866abb1e3fe8bc169c526d957n/aHeodo
2020-08-21Invoice 00460155.docdoc 214116ae52ad96af88fa41e0ea271fecb493e2afbc403bc3ca2c184ffd03d996Virustotal results 32.76%Heodo
2020-08-21Copy invoice #189713.docdoc d594bcea91f0259160c0122a56ad8ec4a7896173295fb3b2c197781cb1bbfddcn/aHeodo
2020-08-21PIG-080120 PCVD-082220.docdoc 83e013279f45dc89d5efc3717634b746a611baee472756272e91e1673d8fc3efVirustotal results 32.14%Heodo
2020-08-21Form.docdoc b99da0701a16d0df2895790bf84db62ee0da6b42fa8ea0c2a5b103a131d98f13n/aHeodo
2020-08-21August invoice.docdoc 5ad1d00e81e5e6bbc93829790980fabae6eab63a8638ed9bc024a27d083ffb87n/aHeodo
2020-08-21Invoice 015952.docdoc 43638c344ac4a446af722c229682fee9a8434923ce1cf6dd1a19bd2a0fc78c21Virustotal results 25.86%Heodo
2020-08-21INV #0555 FOR PO #731721818975.docdoc dfb4a0445bee97a362ee8ea96a3cb6444bc3ef4b7c96beaa5edf0508e6343c56Virustotal results 25.42%Heodo
2020-08-21PO# 08212020.docdoc b76166d90236fcf6a548f8e77f55c56ee763ee2278a941d20f1c0a360fd63171n/aHeodo