URLhaus Database

You are currently viewing the URLhaus database entry for http://rootsdesire.com/wp-admin/report/jjfbx63s-00021886/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:735472
URL: http://rootsdesire.com/wp-admin/report/jjfbx63s-00021886/
URL Status:Offline
Host: rootsdesire.com
Date added:2020-10-22 16:11:08 UTC
Last online:2020-10-23 07:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-10-22 16:12:23 UTC to abuse{at}one[dot]com)
Takedown time:15 hours, 25 minutes Good (down since 2020-10-23 07:38:22 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-10-22PO# 10232020.docdoc 59235980108e00a0011ebeca9348c5a39ef6d6ec0b052e15ddeb825e9c21e3d5Virustotal results 39.66%Heodo
2020-10-22Inv_83230.docdoc c2111a834868da674751a51a03efd41985e59b78f037024440b8cb080e52da89Virustotal results 38.33% Heodo
2020-10-22form.docdoc c62002794ed88e1776376cf0144fdaa74155895bd71f5a69b781acf83818f56cVirustotal results 40.48% Heodo
2020-10-22Payment.docdoc 8f46672fc4bd13f926555000c39b3ff624d7b96f41429e568aa2bad30431bbe8Virustotal results 39.34% Heodo
2020-10-22October Invoice.docdoc 188d183f83a1b99f55ae2810384c67e6f7be09014e6004bb5ddbf245abda02b3Virustotal results 36.54% Heodo
2020-10-22257161.docdoc 2beec2edda2346042fdfa829caaa7403e7842e786b9b9e89baaf4cd5e45d189an/aHeodo
2020-10-22Invoice #80308.docdoc 590f3326107d8c55dee6b4ab08d4a73d007cf21ed92119b2dd72a17a1054564an/a Heodo
2020-10-22Inv_790845.docdoc 966cb3c467c7adddec5950e40aff3b25c8341aeb0919de56c54ec4edc738d19fn/a Heodo
2020-10-22Form.docdoc 0dd7566d93fe470be42c3b43f89d10022539dd21c040c3af9f234f5cdf3f580eVirustotal results 36.07% Heodo
2020-10-22October Invoice.docdoc dfb6817c6e31d81f6a98945394150b500c04fb563d8fe9ae170733fc922f8421n/a Heodo
2020-10-22invoice #26268.docdoc 9b918b3a0a118f50d3c8d4be4526b1fd8ec10563810c7dbb5088495e471f6b26Virustotal results 32.26% Heodo
2020-10-22094429.docdoc 5406fe66b809829db1393154a39470f8da4d7b86a2c0ef2e451ad2f19effdb27n/a Heodo
2020-10-22October Invoice.docdoc 9e05c0fe7a5abfed3c86b44e32efdad88d0417ebb89de20917ca9d131beb1cbcn/a Heodo
2020-10-22Invoice #062.docdoc ba76faaf67244b22ede91ccbdb43e3988b58539eeac446392d0c61afbb5ef437Virustotal results 49.06% Heodo
2020-10-22ZQ006 invoicing.docdoc ea4923d6d51058428ce3cac6ced475b5e024b7ae1974b0ce9f37f563847f89f0Virustotal results 47.06% Heodo
2020-10-22invoice.docdoc 711fafda2f160ff5d89246ee698c4ba0738663a2a0a61469c401fc03f59b4550n/a Heodo