# URLhaus

> Check links, domains and files against URLhaus, abuse.ch's database of websites that spread malware: find out whether a URL is known malware and still online, what a domain or IP address has served, which files a URL dropped and which URLs served a file. Look up tags and malware families, and pull the newest malware URLs and payloads for a blocklist. Needs a free abuse.ch Auth-Key.

App · Compliance & Security · 8 actions. Web page: https://docs.lodol.com/docs/integrations/urlhaus

## Actions

### List recent malware URLs

Get the malware URLs most recently added to URLhaus, newest first: up to 1,000 from the last 3 days, each with whether it is still online, its host, tags and blocklist status. Use it to keep a blocklist or firewall up to date.

**Inputs**

- Maximum URLs (`limit`, number): Optional. How many URLs to get, newest first: up to 1,000 from the last 3 days. 100 when left empty. From 1 to 1000. Default: `100`.

**Outputs**

- `count` (number): How many came back
- `urls` (list): The URLs, newest first

**Example output**

```json
{
  "count": 2,
  "urls": [
    {
      "blacklists": {
        "spamhaus_dbl": "not listed",
        "surbl": "not listed"
      },
      "date_added": "2019-08-10T09:02:05+00:00",
      "host": "45.61.49.78",
      "hosting_provider_notified": true,
      "reporter": "zbetcheckin",
      "tags": [
        "elf"
      ],
      "threat": "malware_download",
      "url": "http://45.61.49.78/razor/r4z0r.mips",
      "url_id": 223622,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/223622/"
    },
    {
      "blacklists": {
        "spamhaus_dbl": "not listed",
        "surbl": "not listed"
      },
      "date_added": "2019-08-10T09:02:03+00:00",
      "host": "45.61.49.78",
      "hosting_provider_notified": true,
      "reporter": "zbetcheckin",
      "tags": [
        "elf",
        "mirai"
      ],
      "threat": "malware_download",
      "url": "http://45.61.49.78/razor/r4z0r.sh4",
      "url_id": 223621,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/223621/"
    }
  ]
}
```

### List recent payloads

Get the payloads (malware files) URLhaus most recently collected from malware URLs, newest first: up to 1,000 from the last 3 days, each with its MD5 and SHA-256 hashes, file type, malware family when known and VirusTotal detections.

**Inputs**

- Maximum payloads (`limit`, number): Optional. How many payloads to get, newest first: up to 1,000 from the last 3 days. 100 when left empty. From 1 to 1000. Default: `100`.

**Outputs**

- `count` (number): How many came back
- `payloads` (list): The payloads, newest first

**Example output**

```json
{
  "count": 2,
  "payloads": [
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/0c415dd718e3b3728707d579cf8214f54c2942e964975a5f925e0b82fea644b4/",
      "file_size": 656896,
      "file_type": "exe",
      "first_seen": "2019-08-10T11:09:23+00:00",
      "imphash": "3b91ed9563d0f99f26b86bd20539306b",
      "magika": "pebin",
      "malware_family": null,
      "md5_hash": "99ad3000abb169e60844a0689dbe9f8c",
      "sha256_hash": "0c415dd718e3b3728707d579cf8214f54c2942e964975a5f925e0b82fea644b4",
      "ssdeep": "3072:HwVYswg6L/wnhOTKuX/2hz9SbwtbS6UOhRP0Ml/5hIowZtQnKZUJkegNS+Gjs:cWInU/8PbRXl/TIoc2h+Gj",
      "tlsh": "7934BF47B4F1C871E4B30D311831D9A05A2F7D715F659E6B2778222A8E342D09E35FAB",
      "virustotal": {
        "detections": null,
        "engines": null,
        "link": null,
        "percent": null
      }
    },
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/b181e6e08cfdebbd9cfcb0e3ccd3976ed51c7edefc69ec826e73d3324d646b2e/",
      "file_size": 416456,
      "file_type": "exe",
      "first_seen": "2019-08-10T11:08:49+00:00",
      "imphash": "3b91ed9563d0f99f26b86bd20539306b",
      "magika": "pebin",
      "malware_family": null,
      "md5_hash": "379e008c8e6aa462cbc9f93c7519d36a",
      "sha256_hash": "b181e6e08cfdebbd9cfcb0e3ccd3976ed51c7edefc69ec826e73d3324d646b2e",
      "ssdeep": "3072:HwVYswg6L/wnhOTKuX/2hz9SbwtbS6UOhRP0Ml/5hIowZtQnKZUJkegNS+Gjs:cWInU/8PbRXl/TIoc2h+Gj",
      "tlsh": "7934BF47B4F1C871E4B30D311831D9A05A2F7D715F659E6B2778222A8E342D09E35FAB",
      "virustotal": {
        "detections": null,
        "engines": null,
        "link": null,
        "percent": null
      }
    }
  ]
}
```

### Look up file hash

Look up a file by its MD5 or SHA-256 hash: its file type and malware family, when it was first and last seen, VirusTotal detections, and up to 100 malware URLs that served it. A file URLhaus doesn't have comes back with found false.

**Inputs**

- File hash (`file_hash`, text, required): The file's MD5 or SHA-256 hash. A link that holds one, like the download link URLhaus returns or a VirusTotal file report, is read too.

**Outputs**

- `download_url` (text): URLhaus's download link for a copy of the file, a ZIP archive holding live malware. It needs the Auth-Key header
- `file_size` (number): The file's size in bytes
- `file_type` (text): The file type URLhaus made out, like exe, doc, elf or zip
- `first_seen` (text): When URLhaus first saw the file (ISO 8601, UTC)
- `found` (true/false): True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
- `imphash` (text): The file's import hash (Windows programs only)
- `last_seen` (text): When URLhaus last saw the file (ISO 8601, UTC). Empty when it saw it only once
- `magika` (text): The file type Google's Magika made out, like pebin or doc
- `malware_family` (text): The malware family URLhaus identified in the file, like Heodo or Mozi. Empty when it identified none
- `md5_hash` (text): The file's MD5 hash
- `sha256_hash` (text): The file's SHA-256 hash
- `ssdeep` (text): The file's ssdeep fuzzy hash
- `tlsh` (text): The file's TLSH fuzzy hash
- `url_count` (number): How many malware URLs served it, in all
- `urls` (list): The malware URLs that served it, up to 100
- `virustotal` (object): VirusTotal's verdict on the file. Empty when VirusTotal has none

**Example output**

```json
{
  "download_url": "https://urlhaus-api.abuse.ch/v1/download/35e304d10d53834e3e41035d12122773c9a4d183a24e03f980ad3e6b2ecde7fa/",
  "file_size": 241664,
  "file_type": "exe",
  "first_seen": "2019-01-19T13:59:06+00:00",
  "found": true,
  "imphash": "3b91ed9563d0f99f26b86bd20539306b",
  "last_seen": "2019-01-19T14:48:08+00:00",
  "magika": "pebin",
  "malware_family": "Heodo",
  "md5_hash": "1585ad28f7d1e0ca696e6c6c2f1d008a",
  "sha256_hash": "35e304d10d53834e3e41035d12122773c9a4d183a24e03f980ad3e6b2ecde7fa",
  "ssdeep": "3072:HwVYswg6L/wnhOTKuX/2hz9SbwtbS6UOhRP0Ml/5hIowZtQnKZUJkegNS+Gjs:cWInU/8PbRXl/TIoc2h+Gj",
  "tlsh": "7934BF47B4F1C871E4B30D311831D9A05A2F7D715F659E6B2778222A8E342D09E35FAB",
  "url_count": null,
  "urls": [
    {
      "filename": "PAY2632216543098764.doc",
      "first_seen": "2019-01-19",
      "last_seen": null,
      "url": "http://www.mother-earth.net/bn/wp-content/KwmW-WSOO_jYDW-B2t/PaymentStatus/EN_en/277-20-468894-239-277-20-468894-861/",
      "url_id": 105243,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/105243/"
    },
    {
      "filename": "5518475554292.doc",
      "first_seen": "2019-01-19",
      "last_seen": null,
      "url": "http://demo.trydaps.com/gzVv-22Omv_aIQZybVK-aJ/En/Question/",
      "url_id": 105214,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/105214/"
    }
  ],
  "virustotal": {
    "detections": 17,
    "engines": 69,
    "link": "https://www.virustotal.com/file/35e304d10d53834e3e41035d12122773c9a4d183a24e03f980ad3e6b2ecde7fa/analysis/1547905746/",
    "percent": 24.64
  }
}
```

### Look up host

Check a domain, host name or IP address: how many malware URLs it has served and since when, its Spamhaus and SURBL blocklist status, and up to 100 of its malware URLs with whether each is still online. A host URLhaus doesn't have comes back with found false.

**Inputs**

- Host (`host`, text, required): A domain, host name or IPv4 address, like example.com or 203.0.113.7. A URL is read as its host.

**Outputs**

- `blacklists` (object): Whether the domain is on the Spamhaus DBL and SURBL blocklists. Empty when URLhaus doesn't say, as for an IP address in Look up host
- `first_seen` (text): When URLhaus first saw a malware URL on it (ISO 8601, UTC)
- `found` (true/false): True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
- `host` (text): The host looked up
- `url_count` (number): How many malware URLs URLhaus has seen on it, in all
- `urlhaus_link` (text): Its page on URLhaus
- `urls` (list): Its malware URLs, up to 100

**Example output**

```json
{
  "blacklists": {
    "spamhaus_dbl": "abused_legit_malware",
    "surbl": "not listed"
  },
  "first_seen": "2019-01-15T07:09:01+00:00",
  "found": true,
  "host": "vektorex.com",
  "url_count": 120,
  "urlhaus_link": "https://urlhaus.abuse.ch/host/vektorex.com/",
  "urls": [
    {
      "date_added": "2019-02-11T07:45:05+00:00",
      "hosting_provider_notified": false,
      "reporter": "abuse_ch",
      "tags": [
        "AZORult",
        "exe"
      ],
      "takedown_time_seconds": null,
      "threat": "malware_download",
      "url": "http://vektorex.com/source/Z/5016223.exe",
      "url_id": 121319,
      "url_status": "online",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/121319/"
    },
    {
      "date_added": "2019-02-11T06:47:03+00:00",
      "hosting_provider_notified": false,
      "reporter": "abuse_ch",
      "tags": [
        "exe",
        "Loki"
      ],
      "takedown_time_seconds": null,
      "threat": "malware_download",
      "url": "http://vektorex.com/source/Z/Order%20839.png",
      "url_id": 121316,
      "url_status": "online",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/121316/"
    }
  ]
}
```

### Look up malware family

Get the malware URLs whose files URLhaus identified as a malware family (its signature), like Heodo or Gozi, newest first, with each file's hashes and how many URLs and files the family has. Unlike a tag, the family is URLhaus's own finding.

**Inputs**

- Malware family (`malware_family`, text, required): The malware family, as URLhaus names it, like Gozi or Heodo. Capitals don't matter. A family with very many URLs, like Mozi, can take URLhaus minutes to list, or longer than it allows.
- Maximum URLs (`limit`, number): Optional. How many of its URLs to return, newest first, up to the 1,000 URLhaus sends. 100 when left empty. From 1 to 1000. Default: `100`.

**Outputs**

- `count` (number): How many URLs came back
- `first_seen` (text): When URLhaus first saw the family (ISO 8601, UTC)
- `found` (true/false): True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
- `last_seen` (text): When URLhaus last saw the family (ISO 8601, UTC)
- `malware_family` (text): The malware family looked up
- `payload_count` (number): How many of its files URLhaus has, in all
- `url_count` (number): How many URLs served the family, in all
- `urls` (list): URLs that served the family, newest first, with the file each served

**Example output**

```json
{
  "count": 2,
  "first_seen": "2018-03-27T13:48:55+00:00",
  "found": true,
  "last_seen": "2019-01-24T13:08:08+00:00",
  "malware_family": "Gozi",
  "payload_count": 12787,
  "url_count": 2125,
  "urls": [
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/254ca6a7a7ef7f17d9884c4a86f88b5d5fd8fe5341c0996eaaf1d4bcb3b2337b/",
      "file_size": 125952,
      "file_type": "exe",
      "filename": null,
      "first_seen": "2019-01-02T12:42:23+00:00",
      "imphash": "3b91ed9563d0f99f26b86bd20539306b",
      "last_seen": "2019-01-02T13:13:25+00:00",
      "magika": "pebin",
      "md5_hash": "a820381c8acf07cfcb4d9b13498db71d",
      "sha256_hash": "254ca6a7a7ef7f17d9884c4a86f88b5d5fd8fe5341c0996eaaf1d4bcb3b2337b",
      "ssdeep": "3072:HwVYswg6L/wnhOTKuX/2hz9SbwtbS6UOhRP0Ml/5hIowZtQnKZUJkegNS+Gjs:cWInU/8PbRXl/TIoc2h+Gj",
      "tlsh": "7934BF47B4F1C871E4B30D311831D9A05A2F7D715F659E6B2778222A8E342D09E35FAB",
      "url": "http://185.189.149.164/adobe_update.exe",
      "url_id": 100211,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/100211/",
      "virustotal": {
        "detections": null,
        "engines": null,
        "link": null,
        "percent": null
      }
    },
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/462f6a7560ef2a1a815febebf60b1fcb472a8227d6db05ac09e5266b774c3722/",
      "file_size": 137216,
      "file_type": "exe",
      "filename": null,
      "first_seen": "2019-01-02T12:11:02+00:00",
      "imphash": "3b91ed9563d0f99f26b86bd20539306b",
      "last_seen": "2019-01-10T16:49:17+00:00",
      "magika": "pebin",
      "md5_hash": "24ba99e7fffa82660f61fcdfc941caa4",
      "sha256_hash": "462f6a7560ef2a1a815febebf60b1fcb472a8227d6db05ac09e5266b774c3722",
      "ssdeep": "3072:HwVYswg6L/wnhOTKuX/2hz9SbwtbS6UOhRP0Ml/5hIowZtQnKZUJkegNS+Gjs:cWInU/8PbRXl/TIoc2h+Gj",
      "tlsh": "7934BF47B4F1C871E4B30D311831D9A05A2F7D715F659E6B2778222A8E342D09E35FAB",
      "url": "http://66.55.64.137/e07f11vm2ghf.exe",
      "url_id": 101092,
      "url_status": "online",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/101092/",
      "virustotal": {
        "detections": 47,
        "engines": 72,
        "link": "https://www.virustotal.com/file/462f6a7560ef2a1a815febebf60b1fcb472a8227d6db05ac09e5266b774c3722/analysis/1546191578/",
        "percent": 65.28
      }
    }
  ]
}
```

### Look up tag

Get the malware URLs reporters gave a tag, like elf or a malware name, newest first, with how many URLs carry it and when it was first and last used.

**Inputs**

- Tag (`tag`, text, required): A tag reporters put on malware URLs, like a malware name such as Retefe. Capitals don't matter. A tag on very many URLs, like elf or Mozi, can take URLhaus minutes to list, or longer than it allows.
- Maximum URLs (`limit`, number): Optional. How many of its URLs to return, newest first, up to the 1,000 URLhaus sends. 100 when left empty. From 1 to 1000. Default: `100`.

**Outputs**

- `count` (number): How many URLs came back
- `first_seen` (text): When the tag was first used (ISO 8601, UTC)
- `found` (true/false): True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
- `last_seen` (text): When the tag was last used (ISO 8601, UTC)
- `tag` (text): The tag looked up
- `url_count` (number): How many URLs carry the tag, in all
- `urls` (list): URLs that carry the tag, newest first

**Example output**

```json
{
  "count": 2,
  "first_seen": "2018-03-06T15:27:00+00:00",
  "found": true,
  "last_seen": "2018-12-21T06:00:11+00:00",
  "tag": "Retefe",
  "url_count": 265,
  "urls": [
    {
      "date_added": "2018-12-21T06:00:11+00:00",
      "reporter": "abuse_ch",
      "threat": "malware_download",
      "url": "https://tagmanager.vn//wp-content/themes/pridmag/sup.exe",
      "url_id": 98627,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/98627/"
    },
    {
      "date_added": "2018-12-20T15:47:14+00:00",
      "reporter": "switchcert",
      "threat": "malware_download",
      "url": "http://tagmanager.vn/wp-content/themes/pridmag/sup.exe",
      "url_id": 98349,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/98349/"
    }
  ]
}
```

### Look up URL

Check whether a URL is a known malware URL: whether it is still online, when it was added, its tags, its Spamhaus and SURBL blocklist status, and the files (payloads) it served. A URL URLhaus doesn't have comes back with found false, not an error.

**Inputs**

- URL (`url`, text, required): The whole URL, as it was found, like http://example.com/invoice.exe. URLhaus matches it exactly, so keep http or https and any slash at the end. A defanged URL, like hxxp://example[.]com/x, is read too.

**Outputs**

- `blacklists` (object): Whether the domain is on the Spamhaus DBL and SURBL blocklists. Empty when URLhaus doesn't say, as for an IP address in Look up host
- `date_added` (text): When the URL was added to URLhaus (ISO 8601, UTC)
- `found` (true/false): True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
- `host` (text): The URL's host: a domain or IP address
- `hosting_provider_notified` (true/false): True when URLhaus has told the hosting provider about it, so it can be taken down
- `last_online` (text): When an offline URL last served malware (ISO 8601, UTC). Empty while it is online
- `payloads` (list): The files (payloads) the URL served, up to 100, with their hashes and malware family
- `reporter` (text): Who reported it to URLhaus, or anonymous
- `tags` (list): The tags reporters gave it, like elf, exe or a malware name
- `takedown_time_seconds` (number): How long the hosting provider took to take the URL down, in seconds. Empty while it is up, or when URLhaus doesn't know
- `threat` (text): What the URL does: malware_download, a site that spreads malware
- `url` (text): The URL looked up, as URLhaus has it
- `url_id` (number): URLhaus's ID for the URL, which Look up URL by ID takes
- `url_status` (text): online (serving malware now), offline (not anymore) or unknown (URLhaus could not tell)
- `urlhaus_link` (text): Its page on URLhaus

**Example output**

```json
{
  "blacklists": {
    "spamhaus_dbl": "abused_legit_malware",
    "surbl": "listed"
  },
  "date_added": "2019-01-19T01:33:26+00:00",
  "found": true,
  "host": "sskymedia.com",
  "hosting_provider_notified": true,
  "last_online": null,
  "payloads": [
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403/",
      "file_size": 179664,
      "file_type": "doc",
      "filename": "5616769081079106.doc",
      "first_seen": "2019-01-19",
      "imphash": "4e4a95a7659118e966a42f4a73311fda",
      "magika": "doc",
      "malware_family": null,
      "md5_hash": "fedfa8ad9ee7846b88c5da79b32f6551",
      "sha256_hash": "dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403",
      "ssdeep": "3072:+hcypCDJeA/9LH1sQx+YiSP2eiLe8/Gq2CeFUzJCfaDehYbAg9u/AJOOxxSEeXq1:LFZj1f+YiSP2Re8J2AehiQxOHSERtIgN",
      "tlsh": "1D340235A5E22807ED4F8479F75F8068BD4A8C96DE9DF244993C6A1A2077020C6F7F93",
      "virustotal": {
        "detections": 16,
        "engines": 58,
        "link": "https://www.virustotal.com/file/dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403/analysis/1547871259/",
        "percent": 27.59
      }
    },
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/01fa56184fcaa42b6ee1882787a34098c79898c182814774fd81dc18a6af0b00/",
      "file_size": 174928,
      "file_type": "doc",
      "filename": "ATT932454259403171471.doc",
      "first_seen": "2019-01-19",
      "imphash": "4e4a95a7659118e966a42f4a73311fda",
      "magika": "doc",
      "malware_family": "Heodo",
      "md5_hash": "12c8aec5766ac3e6f26f2505e2f4a8f2",
      "sha256_hash": "01fa56184fcaa42b6ee1882787a34098c79898c182814774fd81dc18a6af0b00",
      "ssdeep": "3072:+hcypCDJeA/9LH1sQx+YiSP2eiLe8/Gq2CeFUzJCfaDehYbAg9u/AJOOxxSEeXq1:LFZj1f+YiSP2Re8J2AehiQxOHSERtIgN",
      "tlsh": "1D340235A5E22807ED4F8479F75F8068BD4A8C96DE9DF244993C6A1A2077020C6F7F93",
      "virustotal": {
        "detections": null,
        "engines": null,
        "link": null,
        "percent": null
      }
    }
  ],
  "reporter": "Cryptolaemus1",
  "tags": [
    "emotet",
    "epoch2",
    "heodo"
  ],
  "takedown_time_seconds": null,
  "threat": "malware_download",
  "url": "http://sskymedia.com/VMYB-ht_JAQo-gi/INV/99401FORPO/20673114777/US/Outstanding-Invoices/",
  "url_id": 105821,
  "url_status": "online",
  "urlhaus_link": "https://urlhaus.abuse.ch/url/105821/"
}
```

### Look up URL by ID

Get a malware URL by its URLhaus ID, with the same details as Look up URL: whether it is still online, its tags, blocklist status and the files it served. An ID URLhaus doesn't have comes back with found false.

**Inputs**

- URL ID (`url_id`, text, required): The number URLhaus gives a URL, like 105821, or the link to its page on URLhaus, like https://urlhaus.abuse.ch/url/105821/. The other URLhaus actions return both.

**Outputs**

- `blacklists` (object): Whether the domain is on the Spamhaus DBL and SURBL blocklists. Empty when URLhaus doesn't say, as for an IP address in Look up host
- `date_added` (text): When the URL was added to URLhaus (ISO 8601, UTC)
- `found` (true/false): True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
- `host` (text): The URL's host: a domain or IP address
- `hosting_provider_notified` (true/false): True when URLhaus has told the hosting provider about it, so it can be taken down
- `last_online` (text): When an offline URL last served malware (ISO 8601, UTC). Empty while it is online
- `payloads` (list): The files (payloads) the URL served, up to 100, with their hashes and malware family
- `reporter` (text): Who reported it to URLhaus, or anonymous
- `tags` (list): The tags reporters gave it, like elf, exe or a malware name
- `takedown_time_seconds` (number): How long the hosting provider took to take the URL down, in seconds. Empty while it is up, or when URLhaus doesn't know
- `threat` (text): What the URL does: malware_download, a site that spreads malware
- `url` (text): The URL looked up, as URLhaus has it
- `url_id` (number): URLhaus's ID for the URL, which Look up URL by ID takes
- `url_status` (text): online (serving malware now), offline (not anymore) or unknown (URLhaus could not tell)
- `urlhaus_link` (text): Its page on URLhaus

**Example output**

```json
{
  "blacklists": {
    "spamhaus_dbl": "abused_legit_malware",
    "surbl": "listed"
  },
  "date_added": "2019-01-19T01:33:26+00:00",
  "found": true,
  "host": "sskymedia.com",
  "hosting_provider_notified": true,
  "last_online": null,
  "payloads": [
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403/",
      "file_size": 179664,
      "file_type": "doc",
      "filename": "5616769081079106.doc",
      "first_seen": "2019-01-19",
      "imphash": "4e4a95a7659118e966a42f4a73311fda",
      "magika": "doc",
      "malware_family": null,
      "md5_hash": "fedfa8ad9ee7846b88c5da79b32f6551",
      "sha256_hash": "dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403",
      "ssdeep": "3072:+hcypCDJeA/9LH1sQx+YiSP2eiLe8/Gq2CeFUzJCfaDehYbAg9u/AJOOxxSEeXq1:LFZj1f+YiSP2Re8J2AehiQxOHSERtIgN",
      "tlsh": "1D340235A5E22807ED4F8479F75F8068BD4A8C96DE9DF244993C6A1A2077020C6F7F93",
      "virustotal": {
        "detections": 16,
        "engines": 58,
        "link": "https://www.virustotal.com/file/dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403/analysis/1547871259/",
        "percent": 27.59
      }
    },
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/01fa56184fcaa42b6ee1882787a34098c79898c182814774fd81dc18a6af0b00/",
      "file_size": 174928,
      "file_type": "doc",
      "filename": "ATT932454259403171471.doc",
      "first_seen": "2019-01-19",
      "imphash": "4e4a95a7659118e966a42f4a73311fda",
      "magika": "doc",
      "malware_family": "Heodo",
      "md5_hash": "12c8aec5766ac3e6f26f2505e2f4a8f2",
      "sha256_hash": "01fa56184fcaa42b6ee1882787a34098c79898c182814774fd81dc18a6af0b00",
      "ssdeep": "3072:+hcypCDJeA/9LH1sQx+YiSP2eiLe8/Gq2CeFUzJCfaDehYbAg9u/AJOOxxSEeXq1:LFZj1f+YiSP2Re8J2AehiQxOHSERtIgN",
      "tlsh": "1D340235A5E22807ED4F8479F75F8068BD4A8C96DE9DF244993C6A1A2077020C6F7F93",
      "virustotal": {
        "detections": null,
        "engines": null,
        "link": null,
        "percent": null
      }
    }
  ],
  "reporter": "Cryptolaemus1",
  "tags": [
    "emotet",
    "epoch2",
    "heodo"
  ],
  "takedown_time_seconds": null,
  "threat": "malware_download",
  "url": "http://sskymedia.com/VMYB-ht_JAQo-gi/INV/99401FORPO/20673114777/US/Outstanding-Invoices/",
  "url_id": 105821,
  "url_status": "online",
  "urlhaus_link": "https://urlhaus.abuse.ch/url/105821/"
}
```