URLhaus Database

You are currently viewing the URLhaus database entry for http://voogorn.ru/files/US/INVOICES/Payment/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry



Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:43880
URL: http://voogorn.ru/files/US/INVOICES/Payment/
URL Status:Offline
Host: voogorn.ru
Date added:2018-08-17 03:38:16 UTC
Last online:2018-10-26 06:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Status unknown
Cloudflare :Blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2018-08-17 03:53:20 UTC to ip-box{at}ripn[dot]net)
Tags:doc emotet link heodo link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-08-17Billing Invoice - Job # 471403.docdoc f22854c22874450d65d9ba61013cca2cbf24ef8eba2e7b70611ed9e501b67675n/a Heodo
2018-08-17Invoice Confirmation SH1846.docdoc 45d7a562e28bc0c462453f4c44cc7635f0e9fce97a88f10f8d1f967ca716210bn/a Heodo
2018-08-17Customer No 339862.docdoc b0a0586bcff7d67e40d678e813beaa2a434292e2e999e0a0b86bd48a6e672f06Virustotal results 40.00% Heodo
2018-08-17Invoice Confirmation 3F748418.docdoc cb0255d5a66fcd202c8b1059b90f537e5dec105d4442dd537e44b2029dffbfe6n/a Heodo
2018-08-17Inv. no. 49IA0915651.docdoc c7564a0b7217de732c46ccd4a35588c0df5ee1e809009aaaac2d98dde8c26b28Virustotal results 31.67% Heodo
2018-08-17Review invoice required.docdoc 6c35d34c2f0b61d54cd902edd49a3aa9478b9a38815db93db036dc5c4f304d38n/a Heodo