Report - b.dxiazaicc.com/down2/pos58qudong

Report Overview

Submitted URL
b.dxiazaicc.com/down2/pos58qudong_downcc.com.zip
IP
163.171.134.108
ASN
#54994 ML-1432-54994
Submitted
2024-04-25 09:11:20
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
b.dxiazaicc.com	unknown	2022-06-04	2022-06-16	2024-04-13	418 B	1.9 MB	163.171.134.108

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
b.dxiazaicc.com/down2/pos58qudong_downcc.com.zip
IP
163.171.134.108
ASN
#54994 ML-1432-54994

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
1.9 MB (1910817 bytes)
Hash
697990624e528f37435b98ab37e7bb74
5515ffb7eb3be5f4c78311ee2a45f84f34d121f8
7466a7c6c7baf8d91ece9fe5cad10b09954fbe2bc9161712b89b5f1cbbf6bcf5

Archive (5)

Filename

Md5

File type

SP-POS58 Series Thermal Printer Driver.exe

a09cf2d43521b0f26dcb7156c9eee29d

PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive, 4 sections

SP-POS58系列驱动使用说明书.pdf

0aee3e161ae2cde15739542bf13cc1ba

PDF document, version 1.4, 4 pages

SP-POS58系列驱动安装说明书.pdf

b255ba61488a52bedd793bd949b8991c

PDF document, version 1.4, 9 pages

绿色资源网.url

457ba37468a50d85cee3a3cac64a4981

MS Windows 95 Internet shortcut text (URL=<http://www.downcc.com/?d>), ASCII text, with CRLF line terminators

说明.txt

610dc5341815a0547eff4e7a3b6e1daf

DOS executable (COM), start instruction 0xb8c3c7fd b6afcaca

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 6/57

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

b.dxiazaicc.com/down2/pos58qudong_downcc.com.zip

163.171.134.108

200 OK

1.9 MB

URL User Request GET HTTP/1.1
b.dxiazaicc.com/down2/pos58qudong_downcc.com.zip
IP
163.171.134.108:80
ASN
#54994 ML-1432-54994

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
1.9 MB (1910817 bytes)
Hash
697990624e528f37435b98ab37e7bb74
5515ffb7eb3be5f4c78311ee2a45f84f34d121f8
7466a7c6c7baf8d91ece9fe5cad10b09954fbe2bc9161712b89b5f1cbbf6bcf5

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 6/57

HTTP Headers

GET /down2/pos58qudong_downcc.com.zip HTTP/1.1
Host: b.dxiazaicc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:10:54 GMT
Content-Type: application/zip
Content-Length: 1910817
Connection: keep-alive
Server: nginx
Last-Modified: Sat, 08 Dec 2018 01:23:23 GMT
ETag: "5c0b1d0b-1d2821"
Accept-Ranges: bytes
x-via: 1.1 PSjsczsx2ip52:1 (Cdn Cache Server V2.0), 1.1 dx110:0 (Cdn Cache Server V2.0), 1.1 PSrdsdgemSTO1ab82:4 (Cdn Cache Server V2.0)
x-ws-request-id: 662a1e1e_PSrdsdgemSTO1ab82_31097-42679

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (5)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers