URLhaus Database

You are currently viewing the URLhaus database entry for http://voogorn.ru/xerox/En_us/Invoice-32711287-September which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:58303
URL: http://voogorn.ru/xerox/En_us/Invoice-32711287-September
URL Status:Offline
Host: voogorn.ru
Date added:2018-09-20 14:38:31 UTC
Last online:2018-09-25 15:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Status unknown
Cloudflare :Blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: unixronin
Abuse complaint sent (?): Yes (2018-09-20 14:41:06 UTC to ip-box{at}ripn[dot]net)
Takedown time:5 days, 1 hours, 2 minutes Bad (down since 2018-09-25 15:44:05 UTC)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-09-20Review invoice required.docdoc ccb56825261f6f07d6bdc49d538151068293ed820c3ff1d304ad2616e6d4d620Virustotal results 37.70% Heodo
2018-09-20Invoice # 68QZ48330.docdoc ba14418a9d5912760225d7ee8fa2875162f8916416f56089cd4ae150f513cec8n/a Heodo
2018-09-20Invoice.docdoc d2a9bd24b83974cdaec64852e3caf32f579383b197d68db6040f2007f5803d2dn/a Heodo
2018-09-20Outstanding invoice.docdoc 84dcd046e8c97a577024f100d210c5fd78f330483133cc9c0c413dea4633e4d9Virustotal results 22.95% Heodo
2018-09-20New invoice 97W2T29445.docdoc c14ce5258ac49dafd20edd36fe971d014cffb45de0190e7a0267795142f32aeaVirustotal results 21.67% Heodo