URLhaus Database

You are currently viewing the URLhaus database entry for http://tomas.datanom.fi/testlab/427704YTQLGGZ/BIZ/Personal which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:58519
URL: http://tomas.datanom.fi/testlab/427704YTQLGGZ/BIZ/Personal
URL Status:Offline
Host: tomas.datanom.fi
Date added:2018-09-21 09:14:04 UTC
Last online:2018-09-25 21:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: unixronin
Abuse complaint sent (?): Yes (2018-09-21 09:16:42 UTC to abuse{at}multi[dot]fi)
Takedown time:4 days, 12 hours, 41 minutes Bad (down since 2018-09-25 21:58:08 UTC)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-09-22PAYROLL #439868TOTFDIK.docdoc fa964842244e752950fd4ed711759382a8950e13cc2794d6f73ab7eb9169e5eeVirustotal results 40.00% Heodo
2018-09-22BIZ #657ERGSORC.docdoc 23f16fce010a88b7d1170feebec531f0be11fefd68a7b42d00c4dc80a7b3bcb7Virustotal results 40.00% Heodo
2018-09-22PAYROLL #97IDXXRE.docdoc 345ab111b5c267ac9a36eadbf12d6840ef2eac5efd177d94d6cdbf3570f7fd17n/a Heodo
2018-09-22SWIFT #9YLAT.docdoc 85f57a86e855fc2f64cd9b43e12a6def19fe8b881b2360c20e0ab6750206ed09n/a Heodo
2018-09-22SWIFT #93RCCYD.docdoc 5c6f0d4213853c76808f7a345745235ccde96164cc92c4bd2d30efc0ad9a5d7fn/a Heodo
2018-09-21PAYROLL #0AYOAO.docdoc f0affe5fe7659ce4b9f6af0e2b92a04f6b2480e847433a8fcb884d340d733fd0n/a Heodo
2018-09-21SEP #52NXCM.docdoc 512e4b3c402dcd131cf1736cbfdf55800e9018323486844ab4546613b980c57fVirustotal results 31.67% Heodo
2018-09-21PAY #501389VX.docdoc 4b04d7245c1d6f64efd042317a07da392972823797bb84e8ecbf5f23077ec31dVirustotal results 28.81% Heodo
2018-09-21BIZ #0347L.docdoc bb839aed2b11325ff6bdd2b86ca9016aae312e1f33c2f4b0e91427067afcf07aVirustotal results 30.00% Heodo
2018-09-21PAYROLL #77UCA.docdoc 4886251faf8dccf313bfbf1a0929ebfaf769099433ee7739622873aeb6922439Virustotal results 30.00% Heodo
2018-09-21PAY #0420YW.docdoc 7e7eb5fbfa21524784a4c5756fa5cf19091ebf441651ea2d02211f569d602a60n/a Heodo
2018-09-21SEP #47RSTJW.docdoc adec52219ae1e3c12f40b2e32442d0347cf283b9d11960b5c6d6967fb8c5c1a0n/a Heodo