Report - www.huifuqi.cn/down/weixinhuifuqi.zip

Report Overview

Submitted URL
www.huifuqi.cn/down/weixinhuifuqi.zip
IP
61.160.192.97
ASN
#4134 Chinanet
Submitted
2024-04-24 00:01:34
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.huifuqi.cn	unknown	2016-06-29	2017-04-16	2024-03-26	491 B	1.9 MB	61.160.192.97

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.huifuqi.cn/down/weixinhuifuqi.zip
IP
61.160.192.97
ASN
#4134 Chinanet

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
1.9 MB (1859179 bytes)
Hash
0099ff0026e6e03eead56e8fbb8222e6
9cbc7e5d2fdebbaa5f68dc6030ca3607214cf6ce
bd2027e2068512cd7ad989c4f10d5bc487a80c310b5e2d680ffb3c64e30b3b86

Archive (4)

Filename

Md5

File type

libeay32.dll

872a4bd3578d6d3705fe677174fb1759

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

sqlite2.log

72a0d25e44156a0d2bea70ea6fc93126

HTML document, ISO-8859 text, with very long lines (491), with CRLF line terminators

sqlite3.dll

948394f9810c9a84137c3a8fbf1cfd30

PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections

΢��¼�ָ��.exe

64ba14fd94217af925f86f90c8a39b3e

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

	URL	IP	Response	Size
	www.huifuqi.cn/down/weixinhuifuqi.zip	61.160.192.97	200 OK	1.9 MB
URL User Request GET HTTP/1.1 www.huifuqi.cn/down/weixinhuifuqi.zip IP 61.160.192.97:443 ASN #4134 Chinanet Certificate IssuerDigiCert Inc Subjecthuifuqi.cn Fingerprint84:66:64:B1:96:3E:89:F9:29:77:FB:DC:7D:1C:23:31:4D:A8:55:A1 ValidityTue, 26 Mar 2024 00:00:00 GMT - Mon, 24 Jun 2024 23:59:59 GMT File type Zip archive data, at least v1.0 to extract, compression method=store Size 1.9 MB (1859179 bytes) Hash 0099ff0026e6e03eead56e8fbb8222e6 9cbc7e5d2fdebbaa5f68dc6030ca3607214cf6ce bd2027e2068512cd7ad989c4f10d5bc487a80c310b5e2d680ffb3c64e30b3b86 HTTP Headers `GET /down/weixinhuifuqi.zip HTTP/1.1 Host: www.huifuqi.cn User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 200 OK Server: Tengine Content-Type: application/x-zip-compressed Content-Length: 1859179 Connection: keep-alive Accept-Ranges: bytes X-Powered-By: ASP.NET Date: Wed, 24 Apr 2024 00:00:50 GMT Ali-Swift-Global-Savetime: 1713916850 Via: cache68.l2cn3160[85,16,304-0,C], cache50.l2cn3160[18,0], kunlun10.cn6425[0,0,200-0,H], kunlun5.cn6425[1,0] Last-Modified: Mon, 28 Mar 2022 01:04:46 GMT ETag: "3e8411d13f42d81:0" Age: 18 X-Cache: HIT TCP_MEM_HIT dirn:5:1375276218 X-Swift-SaveTime: Wed, 24 Apr 2024 00:00:50 GMT X-Swift-CacheTime: 3600 Timing-Allow-Origin: * EagleId: 3da0c00f17139168682636098e

www.huifuqi.cn/down/weixinhuifuqi.zip

61.160.192.97

200 OK

1.9 MB

URL User Request GET HTTP/1.1
www.huifuqi.cn/down/weixinhuifuqi.zip
IP
61.160.192.97:443
ASN
#4134 Chinanet

Certificate
IssuerDigiCert Inc
Subjecthuifuqi.cn
Fingerprint84:66:64:B1:96:3E:89:F9:29:77:FB:DC:7D:1C:23:31:4D:A8:55:A1
ValidityTue, 26 Mar 2024 00:00:00 GMT - Mon, 24 Jun 2024 23:59:59 GMT

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
1.9 MB (1859179 bytes)
Hash
0099ff0026e6e03eead56e8fbb8222e6
9cbc7e5d2fdebbaa5f68dc6030ca3607214cf6ce
bd2027e2068512cd7ad989c4f10d5bc487a80c310b5e2d680ffb3c64e30b3b86

HTTP Headers

GET /down/weixinhuifuqi.zip HTTP/1.1
Host: www.huifuqi.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/x-zip-compressed
Content-Length: 1859179
Connection: keep-alive
Accept-Ranges: bytes
X-Powered-By: ASP.NET
Date: Wed, 24 Apr 2024 00:00:50 GMT
Ali-Swift-Global-Savetime: 1713916850
Via: cache68.l2cn3160[85,16,304-0,C], cache50.l2cn3160[18,0], kunlun10.cn6425[0,0,200-0,H], kunlun5.cn6425[1,0]
Last-Modified: Mon, 28 Mar 2022 01:04:46 GMT
ETag: "3e8411d13f42d81:0"
Age: 18
X-Cache: HIT TCP_MEM_HIT dirn:5:1375276218
X-Swift-SaveTime: Wed, 24 Apr 2024 00:00:50 GMT
X-Swift-CacheTime: 3600
Timing-Allow-Origin: *
EagleId: 3da0c00f17139168682636098e

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (4)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers