URLhaus Database

You are currently viewing the URLhaus database entry for http://tomas.datanom.fi/testlab/338OXHSDP/biz/Smallbusiness which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:54962
URL: http://tomas.datanom.fi/testlab/338OXHSDP/biz/Smallbusiness
URL Status:Offline
Host: tomas.datanom.fi
Date added:2018-09-11 14:17:30 UTC
Last online:2018-09-27 21:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: unixronin
Abuse complaint sent (?): Yes (2018-09-11 14:19:04 UTC to abuse{at}multi[dot]fi)
Takedown time:16 days, 7 hours, 14 minutes Bad (down since 2018-09-27 21:33:24 UTC)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-09-12PAY #508OYN.docdoc 9dcfac123de75bcfc9f7c7583b6592522dbc3f8cf4a09cd0f29708255ec19e47Virustotal results 31.15% Heodo
2018-09-12BIZ #596099CZKWKIN.docdoc a3fb9df5e722abe9b8ae3e3ca64379da758492cd5b9ce43ddbe29b41178b6d66n/a Heodo
2018-09-12BIZ #2437156ZUHMBCRB.docdoc 9bf0d95cb5f73ff4945a61379a9d058f520376aacd4eae89d82165c1e67c35c9Virustotal results 26.32% Heodo
2018-09-12SEP #6634MOXNCH.docdoc 907aeb750eb680cb57c7e93fdb76af114de2bcd12fb4ea47af5e76e755f832c9Virustotal results 31.15% Heodo
2018-09-12SEP #61056GSTEYF.docdoc ea8dba08b3a950db78076bf7bcd42dd9410ab5b87a344cf4051c5fb072dac165Virustotal results 22.03% Heodo
2018-09-12PAYMENT #749RFWHEFB.docdoc 2ceb81f9c7601592ac7b99888c1c7611f0cb9053aed8a7a9306078f4c1d9fb92n/a Heodo
2018-09-12SEP #227806MCU.docdoc 980595ba0f4687c8c114bedcdefc993f4d92ba183865ec263a71892737f317dan/a 
2018-09-12BIZ #64PRY.docdoc d4482c6be7b3208e3668f55f40b2207dfe7acd33c26f93e7100757827eafe66fVirustotal results 21.31% Heodo
2018-09-12SWIFT #8754219BNPDDDRA.docdoc 1858e2a692ef2d989e4cc717bb602057d9fb6d6bf7b65af08260f6a3cb39eff9Virustotal results 30.00% Heodo
2018-09-12PAY #81PFXI.docdoc 853d14eeef037c34cafb7897787c46c5a10505965d526094f7f3a4fe4207d3cfVirustotal results 25.86% Heodo
2018-09-12SEP #662413ZZJZJQB.docdoc 055db0508235a00ecc6986f08b083dbd713bfcb53aa215f992523875acb831fbn/a Heodo
2018-09-12SEP #4YQAIGM.docdoc 0953c77f94f2b2a224fcbb9e4e32fc7bac365417a78a8d7827b9dbe438145cefVirustotal results 28.33% Heodo
2018-09-12PAYMENT #78721H.docdoc e9bd4b34417efe2b90df2ceb5f20cdb304395a073ab3583421e4646252efbc6cVirustotal results 36.07% Heodo
2018-09-11BIZ #0684038HZOLQHW.docdoc b9a1fd3df1308972767d89dddad29a4248f90634c32dcabcf61e89f4ef9cb8f8Virustotal results 36.07% Heodo
2018-09-11PAYROLL #4649798ZJMLJKLU.docdoc c32ae9190a5e6730bf66bf724815b1bfc417b917af49a7f96d0a66aa0ebf4bf6n/a Heodo
2018-09-11BIZ #965326KATIXQ.docdoc 97386dc0f1e12dd77272154eedeea6057876513296307a3956b00d079eaef348Virustotal results 29.51% Heodo
2018-09-11SWIFT #20739KXDLNG.docdoc 3374d863e7f6de3611ff4aadaecacdc54784571f27631b87f7fdd9e9f8b39237Virustotal results 26.23% Heodo
2018-09-11PAY #5981178GOSBN.docdoc 20dc9bef3d5831a71cc98aebcd3b84ae259a5a9b882a7fb7ae41567777eb1cb3Virustotal results 29.51% Heodo