Report - dn.hi.cn/%E5%90%B8%E7%8C%AB%E5%AE%8C%E6%95%B4%E5%AE%A2%E6%88%B7%E7%AB%AF%E5%AE%89%E8%A3%85%E5%99%A8win10.exe

Report Overview

Submitted URL
dn.hi.cn/%E5%90%B8%E7%8C%AB%E5%AE%8C%E6%95%B4%E5%AE%A2%E6%88%B7%E7%AB%AF%E5%AE%89%E8%A3%85%E5%99%A8win10.exe
IP
154.9.229.235
ASN
#979 NETLAB-SDN
Submitted
2024-04-25 20:48:15
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.trust-provider.cn	unknown	2015-04-09	2022-02-10	2024-04-24	334 B	1.4 kB	112.50.95.96
dn.hi.cn	unknown	unknown	No data	No data	562 B	4.5 MB	154.9.229.235

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
dn.hi.cn/%E5%90%B8%E7%8C%AB%E5%AE%8C%E6%95%B4%E5%AE%A2%E6%88%B7%E7%AB%AF%E5%AE%89%E8%A3%85%E5%99%A8win10.exe
IP
154.9.229.235
ASN
#979 NETLAB-SDN

File type
PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
Size
4.5 MB (4536320 bytes)
Hash
359476395f6a29d84040118866747635
63c0f0a6bf90bfd485abc424d5254d870248f045
605aed487f7d25eef888b67c844e677d1975a38180312f702b8ef990ca55cd7a

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 22/69

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

ocsp.trust-provider.cn/

112.50.95.96

599 B

URL
ocsp.trust-provider.cn/
IP
112.50.95.96:0
ASN
#9808 China Mobile Communications Group Co., Ltd.

File type
data
Size
599 B (599 bytes)
Hash
8509c6daa401fb3b5ac1756c2bb69a51
b70937450e4732cb93c818f514452666d6c3a15f
bd7fa08d983cccc70a672a4cc973114b60068728dbe3b702366b2e3b5d044556

HTTP Headers

POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 599
Connection: keep-alive
expires: Mon, 29 Apr 2024 11:18:34 GMT
x-ccacdn-proxy-id: scdpinlb6
last-modified: Mon, 22 Apr 2024 11:18:35 GMT
date: Thu, 25 Apr 2024 20:47:49 GMT
request-id: 662ac175b219302460e079e898ab2a22
cf-cache-status: EXPIRED
accept-ranges: bytes
etag: "b70937450e4732cb93c818f514452666d6c3a15f"
x-frame-options: SAMEORIGIN
cache-control: max-age=3600
age: 0
cf-ray: 87867f5ed9275fae-SIN
ctl-cache-status: MISS from hk-xianggang4-ca01, HIT from fj-quanzhou7-ca36, HIT from fj-fuzhou4-ca22
via: n172-013-214.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 17140780691348b176caa68435ead0ed3a85b5c3b2
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=370, edge;dur=0

dn.hi.cn/%E5%90%B8%E7%8C%AB%E5%AE%8C%E6%95%B4%E5%AE%A2%E6%88%B7%E7%AB%AF%E5%AE%89%E8%A3%85%E5%99%A8win10.exe

154.9.229.235

200 OK

4.5 MB

URL User Request GET HTTP/1.1
dn.hi.cn/%E5%90%B8%E7%8C%AB%E5%AE%8C%E6%95%B4%E5%AE%A2%E6%88%B7%E7%AB%AF%E5%AE%89%E8%A3%85%E5%99%A8win10.exe
IP
154.9.229.235:443
ASN
#979 NETLAB-SDN

Certificate
IssuerTrustAsia Technologies, Inc.
Subjectdn.hi.cn
FingerprintAA:C6:B1:F8:DB:87:DF:28:FD:4A:F7:79:FD:5E:32:7A:36:21:C6:EE
ValiditySat, 13 Apr 2024 00:00:00 GMT - Sun, 13 Apr 2025 23:59:59 GMT

File type
PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
Size
4.5 MB (4536320 bytes)
Hash
359476395f6a29d84040118866747635
63c0f0a6bf90bfd485abc424d5254d870248f045
605aed487f7d25eef888b67c844e677d1975a38180312f702b8ef990ca55cd7a

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 22/69

HTTP Headers

GET /%E5%90%B8%E7%8C%AB%E5%AE%8C%E6%95%B4%E5%AE%A2%E6%88%B7%E7%AB%AF%E5%AE%89%E8%A3%85%E5%99%A8win10.exe HTTP/1.1
Host: dn.hi.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
ETag: "453800-Y8Dwpr+Qv9SFq8Qk1SVNhwJI8EU"
Server: nginx
Date: Thu, 25 Apr 2024 20:47:50 GMT
Content-Type: application/octet-stream
Vary: Accept-Encoding
Last-Modified: Thu, 25 Apr 2024 07:50:04 GMT
Age: 1
X-Cache: MISS, MISS from HKCDN-154.9.229.235
Content-Length: 4536320

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers