URLhaus Database

You are currently viewing the URLhaus database entry for http://schaefer-frank.de/cgi-bin/esp/zlmma9anzpl/ysy66d6576996146z5sx0bf1stbg15l/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry



Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:452765
URL: http://schaefer-frank.de/cgi-bin/esp/zlmma9anzpl/ysy66d6576996146z5sx0bf1stbg15l/
URL Status:Offline
Host: schaefer-frank.de
Date added:2020-09-03 21:25:04 UTC
Last online:2020-09-04 21:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-09-03 21:26:02 UTC to abuse{at}strato[dot]de)
Takedown time:23 hours, 50 minutes Good (down since 2020-09-04 21:16:13 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-09-04S_DVE_090120_POQ_090420.docdoc 58d07d4495dc0a6bfd46263f25301032d3562ca22a5cf2ea19e557d9e58b89e4Virustotal results 37.29%Heodo
2020-09-04REP_3458141964.docdoc d63243bbf6aaf08d0f887d546e29bac2af6459e3439674829c8e7afc06c08741Virustotal results 36.07%Heodo
2020-09-04M_PO_09042020EX.docdoc e7b7be72edf9cf0cba4c20c1ec7200523f770ca222733b0162cad70bd7ade444Virustotal results 37.29%Heodo
2020-09-04FILE_NTB_090120_HDM_090420.docdoc 0ccc2086f49d393bf08092469d40a557d9b68c3653500e5826e7479b69b84c6aVirustotal results 37.29%Heodo
2020-09-04BQISDKKFW23SEB4.docdoc d23faf09d666b06ecc0248933f0050591863e4e0eca630cb4c1be7f58512fb3bn/aHeodo
2020-09-04C_2NIYAO4K4V34BP70.docdoc fbd8470b180c9fd6fb38a881fc1a42abc34fade3e3dd008244ca9b64a1504103Virustotal results 37.29%Heodo
2020-09-04PO_09042020EX.docdoc 43af1c1a7217bdf25ca13e05da10ae43fba636ce003e77e41f31fec75eacaf1dn/aHeodo
2020-09-04JQK_090120_LLO_090420.docdoc 4bdad9499437443baa2a71d4808d355930f5c949852bfec67101ae162a82c7cfVirustotal results 36.21%Heodo
2020-09-04PO_09042020EX.docdoc b704f4df9369996d3f77982e46cd1d4b080de1817ffbd8d68f5f4a82e16b1993Virustotal results 33.33%Heodo
2020-09-04Q_OVY_090120_HBX_090420.docdoc 5b90408d4dc272f4943f37e60d8892e8663d56e2b299acec7cc5d8ad5be7a40cVirustotal results 33.33%Heodo
2020-09-04REP_42307498122433012121311.docdoc a2fdc9abbb2377b367097472c437e5a8ffedbf8e9b27eaa1e230d8cde71f89f7Virustotal results 33.33%Heodo
2020-09-04QCK_090120_NPH_090420.docdoc cfe4b358946c9eef325f5aa66f80f7db38ac84fbd985117f1bbf039bba8a3d9fn/aHeodo
2020-09-049615150346373314140974.docdoc 4d13bae45c5b53ec799d6cb16c7b8ba1964b3f47d368d5a9a47afa34f682bcfcVirustotal results 33.33%Heodo
2020-09-04INV_WD7268514403XI.docdoc 3212bb6c80b78835f1e18093791987c2ad8b31e57c295a67264ca87c4edb0ad2Virustotal results 33.33%Heodo
2020-09-04DOC_UNT_090120_PMM_090420.docdoc c99544deda23186b369a81f93f9f4be19cc02ec6a2a5f37fea01a28c579733abVirustotal results 33.90%Heodo
2020-09-04BAL_PO_09042020EX.docdoc 308d65483edaee979e4cbe7b8dcbb65535fdb089adb31687e325468799efcaf8Virustotal results 33.33%Heodo
2020-09-04FILE_NZA_090120_VGW_090420.docdoc 9d7477c430c37a6ba3189e8b577e47855bb188be4c54e0f2265e445dc2e1f71fVirustotal results 33.33%Heodo
2020-09-04REP_HWM_090120_BWB_090420.docdoc a227569c5807e9c5cd458bd007b476f167c46ff6544302690f81d5f50bd39566Virustotal results 33.33%Heodo
2020-09-04INV_9AGTUGVBENVC0Q.docdoc 242d81a9bb313e320c1367d234308deb892617e918ef25922449ead23e766f31Virustotal results 33.90%Heodo
2020-09-041XLVHF2ZBX8F6HG6.docdoc f19b7c3502d8e70e4a41fc4676cf0ba7a1de47cc19b1e961be4ceb8511119637Virustotal results 41.67%Heodo
2020-09-04BAL_70448380.docdoc db8ec99d40ab02d4ccd48a1c7b15bf169acb5b672dad9862e19dcb7f2805cde6Virustotal results 42.37%Heodo
2020-09-04L_11317638.docdoc bd6d04f3dae6135958f29487917cf501c1fa74ddb6efc7ce60d56f2d71551b26Virustotal results 41.67%Heodo
2020-09-04REP_5259995138209860.docdoc 58688db2a10ad53af04287f0d28ff7a01d056a48dcb725797d9c1f724d13ff2cVirustotal results 42.37%Heodo
2020-09-049LHLNCMR.docdoc 1348492e73a12dca11baf904fd17a8f5ec479e7a535229a1d05f753cb81dc49fVirustotal results 42.37%Heodo
2020-09-04REP_9FGFYEVKYN.docdoc bf52c7ee63e57eab046b65369d5d9bca719accc2b77b4541ddbe5924711aa9c1Virustotal results 41.67%Heodo
2020-09-04INV_MTY_090120_UWN_090420.docdoc c189d47783e317fad94867d3dda3a2cbbfba58dc3cda5f354b7f43b8d80daadaVirustotal results 41.67%Heodo
2020-09-04E_PO_09042020EX.docdoc af94a807ad27af0322ecdce2f282be8b0d3037615f7d64915e271c5db9016d18Virustotal results 42.62%Heodo
2020-09-04U_OB2F8VST3A5Y.docdoc d4e4779bc7a595b54aef09d0febad3b0412b7919c11c7d60fb1350f25f9d8731Virustotal results 42.62%Heodo
2020-09-04OU0828887500DJ.docdoc d39068244f6daf99e7f26840e26f7a22a79b149f93546294945973683aa5e749Virustotal results 42.62%Heodo
2020-09-04WJL_HYFHQ2N4.docdoc 6213a6690c58fe48fb522c125a84a5b500e3e17bead81239b107cc1fd336ee1eVirustotal results 42.37%Heodo
2020-09-0491NTSMXYOZSV3ZV.docdoc 3bd6f6031787d67083679740e8f556ee96066d268960bd6a6eb4b23260e39c17Virustotal results 41.67%Heodo
2020-09-04HZHC_NK1TYVZH50REVP8L.docdoc 1d3c23422da9f070996381406668d34699557d693bf4db1e3cf752fe8b83b560n/aHeodo
2020-09-04BAL_VZZ_090120_LKI_090420.docdoc 615736850fd6ace5e3359e30427d4ef5824b28c6d1e0bd9dbd2cc12340dfeda8n/aHeodo
2020-09-04BAL_00141937.docdoc 628bd28e635f7fa6ca78c666cd219873a82d1c749dcd80ca407469194fb0064cVirustotal results 41.67%Heodo
2020-09-04I_016YVQPS.docdoc 781509afe3329ab61b29f3b67394eca12b43b25e82a4f1b9ed2c4f178b3a6d8bVirustotal results 41.67%Heodo
2020-09-04I_016YVQPS.docdoc 781509afe3329ab61b29f3b67394eca12b43b25e82a4f1b9ed2c4f178b3a6d8bVirustotal results 41.67%Heodo
2020-09-04BAL_SQE_090120_KGL_090420.docdoc f0e89834b4906361a067ea23efa018387f75a2dbf921d028779c2ad15a19bf47Virustotal results 43.33%Heodo
2020-09-0472821752.docdoc 0e17461c84992dd3117448367cb38d7d6323d37b5c3314a0105ee4dc59a908ban/aHeodo
2020-09-04AD8923070597DB.docdoc edc285fb056f220eaf6bd0fac0b68417b1a433e5a1da2fcec0c518277f1cbbd6n/aHeodo
2020-09-04DOC_FN0440402932OF.docdoc bf8ba4d58a232e576705b37030a7df091539bafb0051f4f28032d54fe49c4c98Virustotal results 42.37%Heodo
2020-09-04DOC_29324957.docdoc b1e73e0f563ed6755fa8532cabda1fbed433aa1ff09b85178288cde0b86292d2Virustotal results 38.33%Heodo
2020-09-03PO_09042020EX.docdoc 2e96dcfe760df7dd6db7de3e4a51f33e031a3c1c8d3aa5545cfe92fa072b6189Virustotal results 36.67%Heodo
2020-09-03FILE_1Q9DKONT7YF.docdoc bfb730608ea4de6d4d60292f703782a118e42cee42d7c0b1077e6c70b3fe5491Virustotal results 36.67%Heodo
2020-09-03BAL_PO_09042020EX.docdoc cc9003f91bf87c927888e7e0aeb7bdd5e450fa8da4e378412fa1f8df8a04cd44Virustotal results 35.00%Heodo
2020-09-0397785680.docdoc fed00393d41370e30988376edbbde0a569d0229091e193fc5258cddf22820acbn/aHeodo
2020-09-03FZ3987145892SK.docdoc 5609621875af24a1bdfe33810c7f333e1853792610f7828310b0bdf8e891e237Virustotal results 31.15% Heodo
2020-09-03BAL_QPN_090120_VXZ_090420.docdoc f8642c869c224dbe6adb98e13e148e8a62ff97af2fca4cc61327bf66c78267e3Virustotal results 31.15%Heodo
2020-09-03DOC_WLJ_090120_VNB_090420.docdoc fc9e4656d99b0f3f630a84da99c604feaac1aada1ce97dee65cfcfa63931e8a4Virustotal results 32.20% Heodo
2020-09-03FILE_EX8377987019NJ.docdoc 661032fc62d0e8d7e61ba8aed8826655acbed44ef1112ff783518509aa6abf8eVirustotal results 32.20%Heodo
2020-09-03II1505876924AQ.docdoc 70456cbd5863ba0a0589d9c519d57d90f5ff4276ddfea58d14f1ebdcfcb43ff1n/aHeodo
2020-09-03REP_PO_09042020EX.docdoc 239a7ae434b146c6144586fc720dd2e24209c1b5c3af1923fe94d4783f75732dVirustotal results 31.67%Heodo