URLhaus Database

You are currently viewing the URLhaus database entry for http://merkur.mk/wp/LLC/082703/d2fw5b27sa-177/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:721183
URL: http://merkur.mk/wp/LLC/082703/d2fw5b27sa-177/
URL Status:Offline
Host: merkur.mk
Date added:2020-10-20 02:47:04 UTC
Last online:2020-10-20 14:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-10-20 02:48:10 UTC to abuse{at}hetzner[dot]com)
Takedown time:11 hours, 47 minutes Good (down since 2020-10-20 14:35:43 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-10-20October Invoice.docdoc c31795e9d2a3b7bf6e19d054a2574f0ea3eef997e49bd9318316efd609cada94Virustotal results 50.00% Heodo
2020-10-20Electronic form.docdoc c059700c980038c5bd96da0591c886f34c3e6c0ab17319d89c4aa1e026ca640cVirustotal results 48.39% Heodo
2020-10-20M1189838796HT.docdoc 5cfa1457e7ddb2e7c49419cabef1c969debc4d677e7ca6f72d6edd8e2ac88a32Virustotal results 49.09% Heodo
2020-10-20form.docdoc 03ed194d560f6e7b976f45dd5678707c7132079b5d6d1bf0366c7163e939cb1bVirustotal results 49.06% Heodo
2020-10-20invoice #0767.docdoc d410b71a4badf540641e5b102f7296d63455fb941f370f9c8248d0fa8176896eVirustotal results 50.00% Heodo
2020-10-20Invoice.docdoc 365d3d49f5595f8f953aea3c3d22743b8319fad46a667472b4c3504b8efb805bVirustotal results 52.83% Heodo
2020-10-209089936610UW.docdoc f5996a9cae20e6d4cc8ef73a116b7b97723ef49093a4d518c6c85d757126cdb1Virustotal results 50.00% Heodo
2020-10-20Copy invoice #3917.docdoc 63079c50ac6b966778ae92e6a4d39927b58a475be4b8d095192b40ad5a877756n/a Heodo
2020-10-20invoice.docdoc 31f0b205c09b9d99e10c2626936588bd3b473116e313045031cfa6f9a8bf23c8Virustotal results 57.89% Heodo
2020-10-20October Invoice.docdoc 1d6ddacfa157c7a54a7f33fc1f1941a643a4a4f799268d4f2fdb333e4d6d49a4n/a Heodo
2020-10-20Payment.docdoc 45327af6d3d75a274f4c5d122adc41d42ddff44e520c7c02efb3df87adc64be0Virustotal results 50.82% Heodo
2020-10-20invoice.docdoc 2e687ca36b3132b0704c1da58bfd462aa6bf5272d6ecbc84616059abc2fab4f2Virustotal results 49.06% Heodo
2020-10-20Payment.docdoc 9d08e7c389570de57d78a8cf91e14d9c814ec46202b241acdcea2d9dcf7c427fVirustotal results 50.00%Heodo
2020-10-20Form.docdoc 925df0de20c1970feff21e7c085d0c4ba2f3f2feedec51001b1f2410c2c31846Virustotal results 50.00% Heodo
2020-10-20INV_326994.docdoc 942f47744db5e721c7c600c36f1c1af3455fdf7e3fbb76011c000c221e06b687Virustotal results 51.61% Heodo
2020-10-20EA6 invoicing.docdoc cfbd735346e1dd406313623ca27397cf3cf30e3197a1914b77a6f10f22f11633Virustotal results 50.00% Heodo
2020-10-20Electronic form.docdoc b53ae43743c6308bc894bdee9df0745d8c360217f26cf37ceda3a979b519969bVirustotal results 48.39% Heodo
2020-10-20INV_26138.docdoc 1dbba69603fe6866b9b3762959b8d745e12bd325c1a203a5160e547f7ac4997en/a Heodo
2020-10-20RB0036 invoicing.docdoc b52f4d01a0ab4d1cc721d51d83479234dda82213536075936f096f0d1203552eVirustotal results 45.16%Heodo