URLhaus Database

You are currently viewing the URLhaus database entry for http://mehertab.blueshieldmedical.pk/wp-includes/sites/tupwxrjgyzn4l-0796/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:444856
URL: http://mehertab.blueshieldmedical.pk/wp-includes/sites/tupwxrjgyzn4l-0796/
URL Status:Offline
Host: mehertab.blueshieldmedical.pk
Date added:2020-08-27 01:43:14 UTC
Last online:2020-08-28 15:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-27 01:44:03 UTC to abuse{at}a2hosting[dot]com)
Takedown time:1 day, 13 hours, 56 minutes Poor (down since 2020-08-28 15:40:25 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-27Payment status.docdoc 54875c28931e2d255c9453f30f5b357a4261f20614c1b603dd3d9f4507f4412cVirustotal results 27.59%Heodo
2020-08-27Payment status.docdoc 7dc0a6093d70ccee91389c1ad23fb90c465444cb47b4af89f487c4769fc039d9n/aHeodo
2020-08-27Payment.docdoc 1653613e54e13601c4799c80c854d900b5b794b6f042130935272db8d6d1e2dfn/aHeodo
2020-08-27INV #007499742 FOR PO #00097571963.docdoc 842b433e1fc26b5e7e972fb6ef675ef6997cc2b8cd9311fb2f330707cad0dc0aVirustotal results 28.33%Heodo
2020-08-27Invoice.docdoc 0befe4e5aeedf24370f7392f7f92db4a8a693147966ae22a291459835a15b8c8n/aHeodo
2020-08-27HT-080120 ZXDC-082720.docdoc 50910a1746d08448bbe4453475ccbb09c9f2380766c2b9357d5e343212636102n/aHeodo
2020-08-27INV #00120456 FOR PO #0079877832.docdoc 3655157b27b8b084443564d11a050740b1e72edf7bb35e9b2cc619eb795c52acn/aHeodo
2020-08-27Invoice 0097870.docdoc 46708b3e324abd5c337910c83e84ce92a571c91a385f0bd417af825e5d38ad53Virustotal results 27.59%Heodo
2020-08-27Invoice 072258.docdoc 36960985eb5fac4be748ffe766e2d2115dd8a2ac0b9be81f28fa48cc4bec0e23Virustotal results 28.07%Heodo
2020-08-27Inv_6397.docdoc 2e31c7b64974a192985f4fbddb6d92fcdb1878c74e159d430a97e8ba0611aeebVirustotal results 27.59%Heodo
2020-08-27Invoice.docdoc 08531c896c900816e373957872ce7e55db50203fd681019719dca8fc27882b40Virustotal results 28.81%Heodo
2020-08-27Electronic form.docdoc 767ec0f39324fa5f9e2566956b732cdf27a690960ed8f6e6fdcf9648e363a877n/aHeodo
2020-08-27invoices 808 & 6092.docdoc 8961b61c4631b8c84367078e44fc1066f57830e0bc0622af1de7769f82e6442eVirustotal results 28.07%Heodo
2020-08-27PO# 08272020.docdoc f663b206e32202cdb2b7fe26738d009a4c1fb76352cb8e9a46bd1a7bc6060bb3Virustotal results 27.59%Heodo
2020-08-27022759.docdoc 2bae2742fb283aa2f35ef1722797919ff00e34f7e1868ca7841fc5baafdefe96Virustotal results 44.83%Heodo
2020-08-27invoice.docdoc dcab189bda6e7d076cfbc0f53566282de853a7676cf630a340bb8fd1288adfabn/aHeodo
2020-08-27Payment status.docdoc c741db44bb434a01cb739da0ba7df5ad5e396e7a3a5afcf79c11d071a5339b4bVirustotal results 43.10%Heodo
2020-08-27August invoice.docdoc 94105da5eacb6335fe9b4b5bcf8eef7393f90e7d4e09fb4b98a4d73418aa8968Virustotal results 44.07%Heodo
2020-08-27FI000 invoicing.docdoc 11f958d598c4e1b0b0978b6e9d9ea6f5e1a8fa34f1af035d657f13b04bb128ben/aHeodo
2020-08-2706032799.docdoc 469ac8a418f2dbb4e433d022cc757fe2ddb270878b4c7ab13ebf4f8a316c30e6Virustotal results 41.38%Heodo
2020-08-27PO# 08272020.docdoc b87a064c66cdd9719e97ee49c21b6435c4f769164c1195b5d14cf15b9dc81a19Virustotal results 31.58%Heodo
2020-08-27August Invoice.docdoc e45a7277159aac8916096aa45b400cdd23c26f876fb6a1753d95e1119c352259Virustotal results 31.03%Heodo
2020-08-27PO# 08272020.docdoc f92eeeee023f763c255c41615d314bdd95628f511d7650771f8bbe9ef73742b9Virustotal results 32.14%Heodo
2020-08-27Invoice.docdoc a12169bfd5b2999a36e090c627578d1d8c9a00225ae68ec13361f8c61de5cee6Virustotal results 28.57%Heodo
2020-08-27Payment.docdoc b27e8c6c5a1f2ca799c9e70469734034437ef96227b7c5394ab56dc4d55ca8b8Virustotal results 28.81%Heodo