URLhaus Database

You are currently viewing the URLhaus database entry for http://americanrelieffundingagent.org/42ds/sites/1987160/kDqNUIo/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:444929
URL: http://americanrelieffundingagent.org/42ds/sites/1987160/kDqNUIo/
URL Status:Offline
Host: americanrelieffundingagent.org
Date added:2020-08-27 03:08:35 UTC
Last online:2020-08-28 07:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-27 03:10:03 UTC to eig-abuse{at}endurance[dot]com)
Takedown time:1 day, 3 hours, 51 minutes Poor (down since 2020-08-28 07:01:16 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-28invoice #85235.docdoc 1d2b270375ae00907412647180a7dffae422dac066c42966c9cca4bd1dd8dfe2n/aHeodo
2020-08-28Payment status.docdoc 7e0d6fc8bc7a69d5e27e2130c83b434512af52a5337145098c2426f62abf97eeVirustotal results 33.33%Heodo
2020-08-27PM0059 invoicing.docdoc b1f8d82d19d6020ac3606afc8e0699ddde66a03ce07d5d7f6b6bc45a238084f2Virustotal results 35.09%Heodo
2020-08-27invoices 300 & 89337.docdoc 474fe5a4009da897047f91b9d9b8f40aaa5d674955f0815934507029c7038976Virustotal results 33.90%Heodo
2020-08-27form.docdoc 907ddcc7b2dd5151f379c7897b9de25bfcf3e3f5a8a58043b3339a540ee5ab76Virustotal results 32.20%Heodo
2020-08-27PO# 08282020.docdoc 6404e3e703da64c594a45e59e02f1ebd13380fdfb4462b7f6086317f46432f3dn/aHeodo
2020-08-27SPA-080120 EVSV-082820.docdoc 5eb93964840290b1a5e35577b2e7ed1c0f212ef275113d5ecdb4a85c127ae57an/aHeodo
2020-08-27Payment.docdoc 249258e389c57dae809f34520051324f678dda2c946e37189377ac5ee3a7c8f2Virustotal results 32.76%Heodo
2020-08-272630714.docdoc 9293848a589af567094cd2bdce0ee80f984253bfc03742c8784009050f881b36n/aHeodo
2020-08-27Payment.docdoc 5bf845e70cde6a5112d1aec081e98995bc8494ce31682762bad07ec7c92a2889n/aHeodo
2020-08-27DH5262800042XF.docdoc 46311c56735daaa51d8a66e1083b0a7e9c481284ce049527d40b15584da4e44eVirustotal results 32.76%Heodo
2020-08-27Payment.docdoc 13da78d90cace28cd0e40dbd890ee0a9213761726b36feaae5f25868b88b9201Virustotal results 34.48%Heodo
2020-08-27Copy invoice #985655.docdoc c2c840c18a5cd6eb5a60c30afe7695b1068bd8ebf0e5fbd5c6a166f9c15767c4Virustotal results 35.00%Heodo
2020-08-27Inv_356836.docdoc 8974b88d7ce674207d02e5c3dbefe723b7284f76bc41295fe5c6f7504ce06b06Virustotal results 33.90%Heodo
2020-08-27form.docdoc 7edd3c85a54dac34d665264c15e59c4129b3804b480c865caa8e08c21b401febVirustotal results 35.00%Heodo
2020-08-27VAN-080120 QVIP-082720.docdoc 8cbfae0d71257239c022f08d8cc5f6b38f4715d245b5d54cbb0db48e2b0dea00Virustotal results 34.55%Heodo
2020-08-27Form.docdoc d3753d5631e4ba1a1f54981afc907afec8ab5de670c56e8baa294137af8e9998Virustotal results 33.90%Heodo
2020-08-27Form - Aug 27, 2020.docdoc 6d21bf28344fa399827eca42d2f6d3aca11a6a098587268bf42154aaa18a6292Virustotal results 33.90%Heodo
2020-08-27Invoice.docdoc 5d6f892d3a27c0036838a9ed0851de7ab16016a83452253649b704a2d3dc65f1n/aHeodo
2020-08-27Copy invoice #650181.docdoc 12e784d605d2bdcef1d692ca150cab45dc7446df28f4e787ed6f5ef939b9d751Virustotal results 34.48%Heodo
2020-08-27Invoice #686658519.docdoc ddff49cf8e07d1993383483d2d6d1b965048988f50a8b7933c4142c8475b5054Virustotal results 33.90%Heodo
2020-08-27Form.docdoc 5da02687ea0cf4bdf8b5c5850f907655ed663cd8d5bf9004703bae3a2272e397Virustotal results 34.48%Heodo
2020-08-27INV_57384.docdoc 919898648f1ad14efa50dae1a420ecea6c4803bbeeb881a940cffc2f46fa51c3n/aHeodo
2020-08-27form.docdoc 3eb7f379c90d0ef72209f56f75159ec517d0e03c45fef2d299f6a7e1e6badc64n/aHeodo
2020-08-27INV_6000.docdoc b196cb7d02828aaaff50bc1a6d2399bbfd48b257f524e55e23d7f3fb2097842fVirustotal results 35.09%Heodo
2020-08-27Electronic form.docdoc da3b782e6c4b16798bcb8fac5b5492d7cb66148eef2014f9706a9773dc1b19ceVirustotal results 33.90%Heodo
2020-08-27Invoice.docdoc 1dc605f92983247bd4cacb9a3bfd0654b1adb33f1c49003d7419af9b11576090Virustotal results 33.90%Heodo
2020-08-27Inv_4834.docdoc 6dc1fb576692231c12eaedeb19d6f481586673ad6666e1bfddebd6e0a8a3a748Virustotal results 30.51%Heodo
2020-08-27August Invoice.docdoc 262880b400d99283c606eac7c8f305097817ae5c81aca9961970efb5176cd961n/aHeodo
2020-08-27August invoice.docdoc 9732d75740a7a624d5ee933c6cd49e15cd59c7c4f692e895dc9a219981028e27Virustotal results 32.20%Heodo
2020-08-27Form - Aug 27, 2020.docdoc da824fbeb1aca76e08e78a0e568930de8ef2c71147fcdc20943bf61f59e8a477Virustotal results 29.31%Heodo
2020-08-27invoice #86162.docdoc c48f047235aef5e47fa8fdbe08dc7b9c9bf5625f22e2e5c48bd9cf09dbe31d27Virustotal results 31.58%Heodo
2020-08-27Invoice.docdoc 02db21d12dc0b5d4da95ae253092f640997129f192be9c9bf0ca6132f5cd7e2en/aHeodo
2020-08-27invoices 84904 & 0772.docdoc 8bdcec34c84cc135921583dd376cf67fc6cd99932b93cce14aa3fcfad9a2b0dbVirustotal results 27.12%Heodo
2020-08-27INV #219482 FOR PO #4833681531.docdoc 0abe748102c354778262121f25bd6d445be4c21e6c3d5ea5f11982bbd8e10ecdn/aHeodo
2020-08-27Invoice 005399794.docdoc cbe78f7b605decf53999dc44e92f4b8d9bb13637f7f40d771a04903ad9ec15d4n/aHeodo
2020-08-27068962.docdoc 50910a1746d08448bbe4453475ccbb09c9f2380766c2b9357d5e343212636102n/aHeodo
2020-08-27FU-080120 KJBN-082720.docdoc b570c09b7284b1917d0059370f79e94031a444a40c3f64c7bc32090a1e38ed11Virustotal results 30.51%Heodo
2020-08-27INV #03835357 FOR PO #01360188041.docdoc d1ce94995d38fb4478f96585dd2cfa3427899e1d34645aaa4a83f0abd1a25e69n/aHeodo
2020-08-27PO# 08272020.docdoc 52619ff393616193f81714ef0f313f3e78f4bf34f0841bf1351fd864f0df17e0Virustotal results 27.59%Heodo
2020-08-27invoice #767182.docdoc 1e01a8df8f521e0db311144288882290f51f66435f7ef11584a1d8c4166ec7aen/aHeodo
2020-08-27IS9109577733WX.docdoc 9599d77c08084c7dd63df5fe268e6302cb249f876136659c5ddcff3e9f1683eeVirustotal results 29.31%Heodo
2020-08-27INV_0950.docdoc 982ec1619efb871fbcb238050b05cb55e526b8ea31b8759bde9e20c45ec482b8n/aHeodo
2020-08-27Electronic form.docdoc 00993b12381962ddf42f0785a5a6660035dea597c5782a819714f2ce29ba2701Virustotal results 27.12%Heodo
2020-08-27form.docdoc de3a26eecedf1be057cea2d07ee52ec75fa41f8b7a3a00ea7d1a4920d971c902Virustotal results 25.42%Heodo
2020-08-27Form.docdoc 2bae2742fb283aa2f35ef1722797919ff00e34f7e1868ca7841fc5baafdefe96Virustotal results 44.83%Heodo
2020-08-27Form - Aug 27, 2020.docdoc 021d2338b8a706fbd77f04cf43db3bf9dea03a1afff732ece042614c35e369edVirustotal results 44.07%Heodo
2020-08-27186722.docdoc c741db44bb434a01cb739da0ba7df5ad5e396e7a3a5afcf79c11d071a5339b4bVirustotal results 43.10%Heodo
2020-08-27Invoice 716192.docdoc 469ac8a418f2dbb4e433d022cc757fe2ddb270878b4c7ab13ebf4f8a316c30e6Virustotal results 41.38%Heodo
2020-08-27Invoice #216612443.docdoc dbfbc13ff098e5c8ed87a620e5e73f075dc9ac85963d50111843d28ea929a4d1Virustotal results 41.38%Heodo
2020-08-27Payment.docdoc a7de5e7039339ecbff062dcb58d75a469ea8240a5f7d1549f67e69e56443865cVirustotal results 38.98%Heodo
2020-08-27invoice #546724.docdoc 51e8d7e9b932160412051214a425fef59df6f9dc2af61df554b8595363c861c9Virustotal results 32.76%Heodo