URLhaus Database

You are currently viewing the URLhaus database entry for https://codefirm.codefirm.net/wp-includes/Scan/pzwlb494/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:704277
URL: https://codefirm.codefirm.net/wp-includes/Scan/pzwlb494/
URL Status:Offline
Host: codefirm.codefirm.net
Date added:2020-10-16 22:14:05 UTC
Last online:2020-10-19 18:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-10-16 22:16:06 UTC to abuse{at}digitalocean[dot]com)
Takedown time:2 days, 19 hours, 54 minutes Poor (down since 2020-10-19 18:10:25 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-10-17P_UQ1096084362YV.docdoc 360a5cb7eed923017b4ef07460e7652362cdf1fc0a902516addbb8e244e30134Virustotal results 53.23%Heodo
2020-10-17MTS_100120_OFD_101720.docdoc 36d4d0f8ba694e3a45ac3fd858e3312538bf61d501403dcbe763638f043ab3a1Virustotal results 53.23%Heodo
2020-10-17FILE_PO_10172020EX.docdoc 169fa4037e8c45a38a3b2e862d860e955fc810c63682c78155bbbd45820b83bfVirustotal results 54.84%Heodo
2020-10-17KWN_100120_QEH_101720.docdoc ab13f6f95154d0396465d9bb9d42e49708e2efdd49c259b7189ae2c7c7c2d389Virustotal results 53.23%Heodo
2020-10-17E_85042375.docdoc 08171ab9613c40f0cffda97d95d104eabd33aca151d19a4315b8e2ec2142fb63Virustotal results 53.33%Heodo
2020-10-17REP_WH8GVOFKWLH.docdoc e9fc0607223bdfcf6365b914d806c89315bbdfff9681454d6b67b060ef04024cn/aHeodo
2020-10-17QBO_100120_OYD_101720.docdoc fdcbcd4f6d22900775055fa03ab8643f72041e73d6af1c271a672ce65268e0ddVirustotal results 53.23%Heodo
2020-10-17FILE_A0B2BEP.docdoc d6b61570ca15f09c5e9707aaa5658abb2ff3c1916805b287b31ceb75a95f4130Virustotal results 53.23%Heodo
2020-10-17PO_10172020EX.docdoc ea065a0dbc3ca645237d0c98e82887ca636451f3fa822c6c0a087a2fe98c230fVirustotal results 53.23%Heodo
2020-10-17FILE_MTYEYYKFVW.docdoc cab952f8c6436054516b7fb9b6dc980a0921858a4a312229099f2817b9846340Virustotal results 54.84%Heodo
2020-10-1776750414.docdoc 7f7aaae8116f26c7d91c5c3d87ab7c7a752e628195c25563cc7c3074669e6c7aVirustotal results 54.84%Heodo
2020-10-1703911086.docdoc 85a42a8d612d20af55e105cdd7caa6c881ebae398c26dea03e0cf147e543f917n/aHeodo
2020-10-17INV_PO7725808609ED.docdoc ab8be8e21a7c5f0a158818bdf5fa9883acaffa78d8cfa5cae36ba7d756b8fed6n/aHeodo
2020-10-17REP_VLJ3IW4AA4S4O5UL.docdoc 4f1b55b5cbbaa28b0d87b93dd256cebd16df18a51e081378940ad152fd24da8eVirustotal results 54.84%Heodo
2020-10-17Q_KYQ_100120_ORH_101720.docdoc 58a95bd14fdfe2c4e30b7bce237de2fa3351c1bcf0328c91c9333a29a8be15d0Virustotal results 51.61%Heodo
2020-10-17QXZG_IX4332348245TK.docdoc 252e05a52d4bc9d3d266533b1a75bfab674989b8d3a4f0ff8d898529379329afn/aHeodo
2020-10-17FILE_ZCN_100120_KCD_101720.docdoc c85fe8825461de0503c8b9b612f01c88a1124e0c33ace58d20c22cf40c4bd03fn/aHeodo
2020-10-17IGL24UW08KL.docdoc 33e3f84944619fd92c3e53215fafb2b4b962f3e7b97ac0e358959d8ca710de70Virustotal results 50.00%Heodo
2020-10-17I7VFGZ7BE9WJ6.docdoc bb96b8f7ca8418e8d16ada7ed78c33abe3bd24d7ca843033cc73e73e4c606fdan/aHeodo
2020-10-17REP_SC4BS5PUK.docdoc fd0ec2733cb7fc4d8f934cf81b56a9a6fd2dd7290c257cdf4c2a1b3da2bcfc10Virustotal results 51.61%Heodo
2020-10-1782370420.docdoc eb06448eea7b0d73132945671275ea572688e13de195a89974d8315900ff8cb7Virustotal results 52.46%Heodo
2020-10-17LAW_100120_TBL_101720.docdoc 4f6043ed53481592c3b9db4608a157df568b466062cba2018b8e5c59bfb40563Virustotal results 52.46%Heodo
2020-10-17B_PO_10172020EX.docdoc 99acccb026919eac0d3249c8a9207a71d032fbe59c7540c12aee398ae86e6780Virustotal results 50.00%Heodo
2020-10-17INV_ZB4057529898IW.docdoc c40e490d1149a43b982a7c65d5f04d36117a86623374f75bf8d47f31090f8b18n/aHeodo
2020-10-16INV_MDM_100120_JMR_101720.docdoc c25321d27755dd74dfcb51c16c96a607d16b09b59b1cbe7f025dc89763d9d630n/aHeodo
2020-10-16TYO_100120_XTX_101720.docdoc 3772d83153c2d54a8a3dd72055370d3db69948bf4eafeb69018ce518c7801d05n/aHeodo
2020-10-168669982103478.docdoc 34470931a684a070f70a0ed741a36c388fb0c082426aebf15aeedbc28a4d778bVirustotal results 51.61%Heodo
2020-10-16ONVP_889524475002635860.docdoc 6539d2ac4a847b3444866e22b642a335e3d8b92d40031a090fa315aef1af2930Virustotal results 51.61%Heodo
2020-10-16REP_AD9HZFMEISXS6.docdoc 69bf38e708fcc10caf5824bb4460ed7f950dfb3085f715c81303b992c3bb6857Virustotal results 51.61%Heodo