URLhaus Database

You are currently viewing the URLhaus database entry for http://neurologicalcorrelates.com/OXTO-3ohAr0cKnhMduYu_hhCDYLpV-119/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:96433
URL:http://neurologicalcorrelates.com/OXTO-3ohAr0cKnhMduYu_hhCDYLpV-119/
URL Status:Offline
Host:neurologicalcorrelates.com
Date added:2018-12-17 16:52:12 UTC
Threat:Malware download Malware download
Google Safe Browsing:Clean
Spamhaus DBL:Not listed
SURBL:Not listed
Reporter:Anonymous
Abuse complaint sent (?): Yes (2018-12-17 16:54:07 UTC to abuse{at}godaddy[dot]com)
Takedown time:4 hours, 32 minutes Good
Tags:doc emotet heodo

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTSignature
2018-12-17PAYMENT_77256HZNKBPG.docdocd19148ce1eca0f37a7e1c4e7f637b6c740f7f05af5fcda7372917abdfa733788Virustotal results 21 / 60 (35.00)Heodo
2018-12-17ACH_6680905ZIBRCKPQ_12_17_18.docdocb52dee08ca8eadf14798887efcd8359ed58d036c13ad797dd09cb94e3b70f8a3Virustotal results 19 / 59 (32.20)Heodo
2018-12-17PAYROLL_4585104NKYBHQC_12_17_18.docdoc797e7d043032a9320473e52721d09ac18aa8cdf57a70394b71e8003a11e28595Virustotal results 18 / 58 (31.03)Heodo
2018-12-17PAYROLL_9946067SEGHIFYO.docdoc52f1a0d6667ab1f0798b6124494b45d245e70c9fc477515664a83531eb22f668n/aHeodo
2018-12-17PAY_79JIHAHKKU.docdocc28eabedfa27dfa715a7093cbf0ba1532a74cf03936575cb668da8e3fc19879dn/aHeodo
2018-12-17ACH_6334232LUMXUZA.docdocd4c04b211d8b43f3bd9a7bac94d9ed22d7895ec83033804e832f2ecc9d1f6216Virustotal results 19 / 59 (32.20)Heodo
2018-12-17SWIFT_305QOXGLHH.docdoc0379044b2d0cb693797c8adb5a5ff0991df7b767d5df6268536288214bb05377Virustotal results 19 / 58 (32.76)Heodo
2018-12-17PAYMENT_701170UHVCEA.docdoca8068602b148d3dd318f613e132c244dae44ad03a47cffc076f0ad8b42c505e1n/aHeodo
2018-12-17BIZ_19672VZLHKO_12_17_18.docdoc216c7c9300632a99d808ac6c2ba26a53402ac584504bb7eac3cbe35b56994d93Virustotal results 19 / 60 (31.67)Heodo
2018-12-17SWIFT_600NYGCERK.docdocaeb831420f4784da6d463131d145f004e69e04042279afe3b14bc4f2df5cbefdVirustotal results 21 / 59 (35.59)Heodo
2018-12-17PAY_10RGFYUEU.docdoc653f234baee70f8280e05720d0335b5dc898e6b0aa2dc6a04b6a278f51326441Virustotal results 19 / 59 (32.20)Heodo
2018-12-17ACH_00856TNAUDGCS.docdocaf8a59bc575309e2dddb45dec73f0c37b82c72752b6627b235ecc88302238a46Virustotal results 19 / 60 (31.67)Heodo
2018-12-17PAYROLL_90BFOLXDPD.docdoc50db407755a40929b5b6b5dc19cab0fff94b855d471797f5b7246d2fa6c3a280Virustotal results 18 / 60 (30.00)Heodo
2018-12-17ACH_264OZPAIY.docdoc1246ba64abfdec50f3e566a2291b3fc0e96a7b3969fc97ed57d01236c5084259Virustotal results 19 / 60 (31.67)Heodo
2018-12-17PAYMENT_1PHTCNBT_12_17_18.docdoc4a6bd78488989e57f837c67e0439a4e4a276b8bf339aef5dfb177a4d03e89f33Virustotal results 19 / 58 (32.76)Heodo
2018-12-17BIZ_818679OXMWZI.docdoca62f9b138b9ef335233e2f25c1682a516632671334a969fdc15c32558cb6fd5cVirustotal results 16 / 59 (27.12)Heodo
2018-12-17PAYROLL_997255HYAALRRI_12_17_18.docdoc2b73175122d0b0ca5b496fddc02d17032f5984ff4281501e62972e11784f8f0cVirustotal results 16 / 60 (26.67)Heodo