URLhaus Database

You are currently viewing the URLhaus database entry for http://www.plasdo.com/MNXfUEtpo/702DXQ/PAYROLL/Commercial which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:55554
URL: http://www.plasdo.com/MNXfUEtpo/702DXQ/PAYROLL/Commercial
URL Status:Offline
Host: www.plasdo.com
Date added:2018-09-12 11:33:10 UTC
Last online:2018-09-18 02:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: unixronin
Abuse complaint sent (?): Yes (2018-09-12 11:34:09 UTC to hm-changed{at}vnnic[dot]vn)
Takedown time:5 days, 14 hours, 43 minutes Bad (down since 2018-09-18 02:17:25 UTC)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-09-14PAYMENT #708772PKD.docdoc c3f2233ec52a49433a093f5e83ea01228c7088ead6cef9b914543b2268085bc6Virustotal results 29.51% Heodo
2018-09-14PAYMENT #52RRFZ.docdoc 9349ca5c47141bc0277a0dd9f25c5767e7d6378057c985488ccd3b4b552a25dan/a Heodo
2018-09-14PAY #8AYNGHL.docdoc a5207d69b06370cac30aa2f58046957fd42810ca4efd0b67dcd8f05f9179e7c4n/a Heodo
2018-09-14PAY #6590C.docdoc 56be3018493c1b5f47eddfbd3ae3309607dfe38aef9a20f75835acac73dd082bn/a 
2018-09-13PAY #771762YNKM.docdoc 5f0ad3642213289274ff254fed176dff2e17eb410a4d2aad34244b119ecb6e72Virustotal results 26.23% Heodo
2018-09-13SWIFT #366P.docdoc f919d7e922a27ffcca7450ca40ca9647e52771346197f606ae02275ae67b3268Virustotal results 26.23% Heodo
2018-09-13BIZ #0X.docdoc 3faa88ea91d876995945b8ca680036a4c2d9f7d77e0f21681508b0cc85fee7e6n/a Heodo
2018-09-13SWIFT #206052Y.docdoc 7f2da553eae249a03e752f53c31f7c55bbf041a0d09779cf615f6ac0e12319feVirustotal results 24.59% Heodo
2018-09-13SEP #674409YZ.docdoc 5eb986d05ad832897acbc13e870ee4f2971f1901374615a41ee2f5f5fe91d68fVirustotal results 22.95% Heodo
2018-09-13PAYMENT #2351NRDBRDVH.docdoc 1c84d3a7b02bd30a0884d5a0ff5840f77490945045ae7b8055d408e8ec6de8abn/a Heodo
2018-09-13PAYMENT #39L.docdoc 4f3b20b026bdadbc5b9744834db42bf6858f4a238068f44f335967461755578aVirustotal results 22.95% Heodo
2018-09-13PAYROLL #156120EBLVQXY.docdoc 0432b3023902e6923a125718c35108cdd55b58ddf985e3cc7efb5a4b79e1c208Virustotal results 18.03% Heodo
2018-09-13BIZ #457515VFATIQY.docdoc 764122c8c7d3c80f2c4c5c812333b6d804683a90cd5c6ffe28d36e6bbd2ac90en/a Heodo
2018-09-13SEP #23SEJC.docdoc 8870a62f875161882a0c93807ccc85209554a068953ae16190484414b427b173Virustotal results 36.07% Heodo
2018-09-13BIZ #84Q.docdoc 30594291490a1928a7bf89f633c88b3e8bb41c4ae795156309a0f076652d072cn/a Heodo
2018-09-13BIZ #58847RLAMJA.docdoc 1316c887d94e24f942b882ecbe7314ef4746e2800122b27bb0086e8aacbb8b00n/a Heodo
2018-09-13PAYROLL #993380UPYA.docdoc da2a56412ba9240e01d478074dfee4cd0ef92d0d8d1d2b42b01411212c2e6e83Virustotal results 33.33% Heodo
2018-09-12SWIFT #0QRF.docdoc e6a578c89917327adb9fcd46a34823c0f2b34ec26d7e0bcdd08f2fdd0b3e534aVirustotal results 29.51% Heodo
2018-09-12PAYMENT #775087G.docdoc 9bf0d95cb5f73ff4945a61379a9d058f520376aacd4eae89d82165c1e67c35c9Virustotal results 26.32% Heodo
2018-09-12SWIFT #548YTVOFLHL.docdoc 961a7252c607c4675cfda69848006780ee9886b7d011c30cbe4aaae3b244abb3Virustotal results 31.15% Heodo
2018-09-12BIZ #967602XG.docdoc 2ceb81f9c7601592ac7b99888c1c7611f0cb9053aed8a7a9306078f4c1d9fb92n/a Heodo
2018-09-12SWIFT #3492020MKELWKT.docdoc d4482c6be7b3208e3668f55f40b2207dfe7acd33c26f93e7100757827eafe66fn/a Heodo
2018-09-12SWIFT #360SQCUARSU.docdoc 4e12f2597757d29a510136a07205cab71f04755e39063e13de5ecacc6dad0bd3Virustotal results 31.15% Heodo