URLhaus Database

You are currently viewing the URLhaus database entry for http://grandautosalon.pl/Sep2018/US/Invoices-Overdue which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:55353
URL: http://grandautosalon.pl/Sep2018/US/Invoices-Overdue
URL Status:Offline
Host: grandautosalon.pl
Date added:2018-09-12 02:10:00 UTC
Last online:2018-09-17 12:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2018-09-12 02:10:54 UTC to abuse{at}nazwa[dot]pl)
Takedown time:5 days, 10 hours, 26 minutes Bad (down since 2018-09-17 12:37:28 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-09-12Invoice Query.docdoc 7e965a456c81c968a556ce3bfb04c4a3531dc9675e986fd3bed9d8754fb30c8bVirustotal results 31.15% Heodo
2018-09-12Invoice.docdoc 853d14eeef037c34cafb7897787c46c5a10505965d526094f7f3a4fe4207d3cfn/a Heodo
2018-09-12Invoice Query.docdoc 0953c77f94f2b2a224fcbb9e4e32fc7bac365417a78a8d7827b9dbe438145cefn/a Heodo
2018-09-12Accounts - Invoice.docdoc 94df0548c49c02344e33f971d5b03449afc8d9423c0ce84590101cfe0014633dVirustotal results 27.87% Heodo