URLhaus Database

You are currently viewing the URLhaus database entry for http://www.tekfark.com/088020ICR/PAYMENT/Personal/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:54665
URL: http://www.tekfark.com/088020ICR/PAYMENT/Personal/
URL Status:Offline
Host: www.tekfark.com
Date added:2018-09-11 05:20:32 UTC
Last online:2018-10-09 13:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2018-09-11 05:22:46 UTC to abuse{at}cizgi[dot]net[dot]tr)
Takedown time:28 days, 7 hours, 38 minutes Bad (down since 2018-10-09 13:01:43 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-09-12BIZ #3581L.docdoc 9b88ff4c7a6c39af6293e1b5a8002b9f56f2621d2dfdf33d55b5e1d7794511deVirustotal results 31.15% Heodo
2018-09-12PAYMENT #3LQWVF.docdoc 9115ac3af709e3d318f6ffe826b06d6c5a168b9e336501d78f0513bc8e00b0c5Virustotal results 31.15% Heodo
2018-09-12SWIFT #336PGHB.docdoc ed63bc2a9f676ebc2a695681cd8a952ec5167ccde77740c7f17d2f2598de835fn/a Heodo
2018-09-12PAY #8232YSVKJFBL.docdoc 907aeb750eb680cb57c7e93fdb76af114de2bcd12fb4ea47af5e76e755f832c9n/a Heodo
2018-09-12SWIFT #9N.docdoc ea8dba08b3a950db78076bf7bcd42dd9410ab5b87a344cf4051c5fb072dac165n/a Heodo
2018-09-12SWIFT #39204OOR.docdoc 2ceb81f9c7601592ac7b99888c1c7611f0cb9053aed8a7a9306078f4c1d9fb92n/a Heodo
2018-09-12PAY #967VPYCLEP.docdoc 980595ba0f4687c8c114bedcdefc993f4d92ba183865ec263a71892737f317dan/a 
2018-09-12PAYROLL #8592266HKVLKA.docdoc 874c4105a4609af1cac382c4f8b299da6c1628871ec0f3e80f48cc6962dae534Virustotal results 21.31% Heodo
2018-09-12PAY #33753F.docdoc a1cbeb26b1fc114888a3bc7bb0f5b20cbfc5176d05cf6f558e64ebd222f7f779n/a Heodo
2018-09-12BIZ #56KUAGTEAX.docdoc bf4347f058fbff52cb765801ca395209ebdbee4777bc66e0007b6d4e1ffd3ad1Virustotal results 29.51% Heodo
2018-09-12SWIFT #24YB.docdoc e44ad7d54c33963149c77ee31940482540e8ec955cd9077aefdf938ba5c6c933Virustotal results 29.51% Heodo
2018-09-12PAYROLL #09XSX.docdoc 4608081124b344ef507249229619af7a618eff762fce719a89e9f82a9e2b023bVirustotal results 29.82% Heodo
2018-09-12SEP #2129PCEJDYNK.docdoc 055db0508235a00ecc6986f08b083dbd713bfcb53aa215f992523875acb831fbVirustotal results 28.33% Heodo
2018-09-12SEP #50ZJBBDEF.docdoc eaaad8afbef1ee4ff3504f7600e05b96ecaf6243a7f84b9275ccc2d614029508Virustotal results 27.87% Heodo
2018-09-12PAYROLL #6505744LYW.docdoc 0953c77f94f2b2a224fcbb9e4e32fc7bac365417a78a8d7827b9dbe438145cefVirustotal results 28.33% Heodo
2018-09-12PAY #615193CBVH.docdoc 834d2c131a08577c53405dfccfa2f79d14cc1423a2ca55eb708c7e7876bd0872Virustotal results 28.33% Heodo
2018-09-12PAY #3137ZEMXV.docdoc fb79164ee252899c5a3b973a2c9255e70b8c45b456d97d417e901991b2c502b4Virustotal results 36.07% Heodo
2018-09-12PAYROLL #072UBVSETTC.docdoc e9bd4b34417efe2b90df2ceb5f20cdb304395a073ab3583421e4646252efbc6cVirustotal results 36.07% Heodo
2018-09-11PAYROLL #8ZJQPXR.docdoc b9a1fd3df1308972767d89dddad29a4248f90634c32dcabcf61e89f4ef9cb8f8Virustotal results 36.07% Heodo
2018-09-11PAYMENT #13570LUQNV.docdoc c32ae9190a5e6730bf66bf724815b1bfc417b917af49a7f96d0a66aa0ebf4bf6Virustotal results 33.33% Heodo
2018-09-11BIZ #2NIFJVO.docdoc 97386dc0f1e12dd77272154eedeea6057876513296307a3956b00d079eaef348Virustotal results 29.51% Heodo
2018-09-11SWIFT #17587ZL.docdoc 3374d863e7f6de3611ff4aadaecacdc54784571f27631b87f7fdd9e9f8b39237Virustotal results 26.23% Heodo
2018-09-11PAYMENT #68693WHFEPYGR.docdoc acb7cfc42385964e696f993ce767720b4f5d015eb1baca791270d2fedb5720cfVirustotal results 30.00% Heodo
2018-09-11SEP #4YKA.docdoc 30204787f9f4b5d37ea3dfe47dd19805c6e5ac33181080f8bedc7edbeb533468Virustotal results 26.23% Heodo
2018-09-11PAY #9GLA.docdoc eed14bc5002147fd5197466ebb78a42e1756035ea183327b304cee5260ca72b8Virustotal results 34.43% Heodo
2018-09-11SEP #3956630SXLP.docdoc f35232c8fc432c0939ed388f6a4c3ab4ae2a6a437ad9bdfbd5f75313044da632n/a Heodo