URLhaus Database

You are currently viewing the URLhaus database entry for http://heerdmann.de/cgi-bin/g59n6e0-880841/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:438743
URL: http://heerdmann.de/cgi-bin/g59n6e0-880841/
URL Status:Offline
Host: heerdmann.de
Date added:2020-08-21 22:18:34 UTC
Last online:2020-08-24 18:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-21 22:20:03 UTC to abuse{at}strato[dot]de)
Takedown time:2 days, 19 hours, 54 minutes Poor (down since 2020-08-24 18:14:24 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-22Invoice.docdoc d264878eae29d3da022f38e67a38560346ba42cbb6dbebbf0e6c852c666fb1acn/aHeodo
2020-08-22Form.docdoc 51bb6063711677f1823d4b10c0ae073a340c8392a7b233485d1e181fab2197fen/aHeodo
2020-08-226833327695.docdoc 31c1361e8baf77b4fb015cde0ac73df4a7476022d35614113a88c60fe658cb9cn/aHeodo
2020-08-22invoice #0933.docdoc 5d343c4cc60ceae7c55758376842b90845f6d3dd1d7ab8fd2bed44ee745bf527Virustotal results 37.93%Heodo
2020-08-22INV #00203147 FOR PO #00064849493657.docdoc 88fafca4b3195bc1843721aa1d78221a5d05be8d88f43ceb0e85aab917c67a43n/aHeodo
2020-08-21268951.docdoc 27e2a7ad7764b75f11753d945f9b7b087f89fa4b8b9bc1198bf7992c7c85d1e8Virustotal results 37.29%Heodo
2020-08-21August Invoice.docdoc d09a4703239b8dd258d5174bc65647fa6b951cecfcb7c2f9c46a29a061a7a769n/aHeodo
2020-08-21Inv. 7826828.docdoc 31ef2257cdb7b9006892fb9754673511beaf648f6c3a899b9bff3031310a9acfn/aHeodo
2020-08-21invoices 09971 & 4799.docdoc c7abec97a993780d8d6bdd8fbc2a7c77bb49fdd61e57637ac36ecefc9f748350Virustotal results 35.59%Heodo
2020-08-21Electronic form.docdoc 2d4370eba117c88617870ab941572195d2facde4eb4e1d768507d37840812da2Virustotal results 33.33%Heodo
2020-08-21Electronic form.docdoc e5c9f8c0ccfa47835d30be512636ad1b0e40d75587d5a309f586b67796aae5cdVirustotal results 33.33%Heodo
2020-08-21Copy invoice #631963.docdoc 75afa5e681f780ff3ac189da47ea1eddeba7face6bc94ac9d07db672b9c00ef5Virustotal results 32.76%Heodo
2020-08-21Invoice 08764350.docdoc 74d14109b204bc9660f0586a12014c72a0ca67f943cb4a757132e29160a6e3d7Virustotal results 34.48%Heodo