URLhaus Database

You are currently viewing the URLhaus database entry for http://dresslikevs.com/wp-admin/sites/zwf739n4e/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:590644
URL: http://dresslikevs.com/wp-admin/sites/zwf739n4e/
URL Status:Offline
Host: dresslikevs.com
Date added:2020-09-21 22:07:09 UTC
Last online:2020-09-22 11:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-09-21 22:08:45 UTC to abuse{at}iv[dot]lt)
Takedown time:12 hours, 56 minutes Good (down since 2020-09-22 11:05:43 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-09-22BAL_31369853.docdoc 3ed5e00e046ce19a840746219ff3efcd6fcc4ddd0b608e51203398bfe2360da2Virustotal results 31.67%Heodo
2020-09-2279649725820791971018922.docdoc 58dca36db6814be3bc7016599693d84cc074f17451bebe7eb98baee99cef0ac9Virustotal results 32.79%Heodo
2020-09-22REP_WC1169287888OP.docdoc d937aee7869b57f5784a642a274c6c32b57ed26aaf0594e7adbbf3f980c4ff98Virustotal results 32.79%Heodo
2020-09-22INV_22654365.docdoc d1083829516cf0b07a7ebf52d747d76ab73da99f9cb042d583f241687917a433Virustotal results 33.33%Heodo
2020-09-22PO_09222020EX.docdoc b9ae26c8fc56943d82223a7d3c26671f4247a42d3d56fc25a455217cb84674b7Virustotal results 32.79%Heodo
2020-09-22FILE_SYO_090120_JKE_092220.docdoc 23184d215b3db4bb670b2c1e70e1b7f81760cdec7e35b8a0a90cebc4a6797eccVirustotal results 31.67%Heodo
2020-09-22DOC_PO_09222020EX.docdoc ccc41f0194e3ea4cd0460cdb76391a4edf6732e895a600acaeb6099a6796c558Virustotal results 32.79%Heodo
2020-09-22T_97222901023954.docdoc 6f9bccda375580566f4824b5dad0662ea49be1f410eb2bd5c38f3561dbac29e4Virustotal results 33.33%Heodo
2020-09-22H4C36KZ65SOW.docdoc ce04dad796a1819d846a6a981c97426c43b0943deed734991bc6780eb54ba074Virustotal results 30.00%Heodo
2020-09-21BAL_0066349230517442185852.docdoc 6aaa5d1200a0ddb1900acfe0f5b79eac2ce5b928d30db37c4f21e43cea55d69eVirustotal results 32.20% Heodo
2020-09-21INV_PO_09222020EX.docdoc 3366930cc13338eb0661795bbde1d36e686105df071793c4080d1483b27d2d84Virustotal results 29.31%Heodo
2020-09-21D_50858414.docdoc 86a8ee1c5f1f5ce84a8f3b31c04f51e324a47d2de0936339357ee0e9a139e0c6Virustotal results 30.00%Heodo
2020-09-21GE_795498226633952628635434.docdoc 75aacb9b9e0f3b4113358caf49078bb79286fb9637c523807a8f533d0df7c834Virustotal results 30.00%Heodo
2020-09-2152329722.docdoc 39de97c9d5604bd29ee471559a22ce1c35ad2157fb4d71802c96e7621cde7fe2Virustotal results 30.00% Heodo