| r11.o.lencr.org/ |  23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash50a89b39234eb6cc4eda70d7e27be17f 306340eb26b6817fd8851a085563a88eed7e2b6b eaabd011ed0722deeee97e566b8318b17d8e993d31db4c2cc31cf0e3cd8191f5
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "EAABD011ED0722DEEEE97E566B8318B17D8E993D31DB4C2CC31CF0E3CD8191F5"
Last-Modified: Mon, 19 Aug 2024 12:55:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10548
Expires: Wed, 21 Aug 2024 04:05:57 GMT
Date: Wed, 21 Aug 2024 01:10:09 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash845d79542d05f08c933181b3750ce01b 0220d4237c8891f2c270be589e23d0036c397d62 4689a75cc3d66fe81d22664238a8bf82f2c96f28f52752eaf39f5d4aee4b3f51
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "4689A75CC3D66FE81D22664238A8BF82F2C96F28F52752EAF39F5D4AEE4B3F51"
Last-Modified: Sun, 18 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11657
Expires: Wed, 21 Aug 2024 04:24:26 GMT
Date: Wed, 21 Aug 2024 01:10:09 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash5d0dd93e6a07253100201a9c8a3e15a5 30adbd52887825ae2779d7fb12276bed8b1d8178 07bb496669af2e33765f0ad730934dad6f8ad79a628c6b21cd545505335471c6
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "07BB496669AF2E33765F0AD730934DAD6F8AD79A628C6B21CD545505335471C6"
Last-Modified: Mon, 19 Aug 2024 21:59:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11049
Expires: Wed, 21 Aug 2024 04:14:18 GMT
Date: Wed, 21 Aug 2024 01:10:09 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash18f75729f3e25e2eb7f12b70dfce3849 479177b92dda7c4e8763c80a15cbc71c3386d06c 0b7da2da1fcba23c5118479e14828f87a605a32af15d0962f216115a9ff1d02a
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "0B7DA2DA1FCBA23C5118479E14828F87A605A32AF15D0962F216115A9FF1D02A"
Last-Modified: Sun, 18 Aug 2024 15:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7709
Expires: Wed, 21 Aug 2024 03:18:38 GMT
Date: Wed, 21 Aug 2024 01:10:09 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash663683cf83257c4867434f1b98db8939 f0ca9dbee82d2d4031edbf65bc9aa36d25264687 42b541fd8690abf306d19e5601a846c6b5a6c494342f17fe60b6048a340cd67d
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "42B541FD8690ABF306D19E5601A846C6B5A6C494342F17FE60B6048A340CD67D"
Last-Modified: Tue, 20 Aug 2024 09:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10513
Expires: Wed, 21 Aug 2024 04:05:24 GMT
Date: Wed, 21 Aug 2024 01:10:11 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash663683cf83257c4867434f1b98db8939 f0ca9dbee82d2d4031edbf65bc9aa36d25264687 42b541fd8690abf306d19e5601a846c6b5a6c494342f17fe60b6048a340cd67d
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "42B541FD8690ABF306D19E5601A846C6B5A6C494342F17FE60B6048A340CD67D"
Last-Modified: Tue, 20 Aug 2024 09:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10513
Expires: Wed, 21 Aug 2024 04:05:24 GMT
Date: Wed, 21 Aug 2024 01:10:11 GMT
Connection: keep-alive
|
|
| download.spamfighter.com/ |  51.124.128.217 | | 0 B |
URL download.spamfighter.com/ IP51.124.128.217:0 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: download.spamfighter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Microsoft-IIS/10.0
Date: Wed, 21 Aug 2024 01:10:12 GMT
Content-Length: 0
|
|
| download.spamfighter.com/SLOW-PCfighter/11129/SLOW-PCfighterSetup_partner11129_2.1.31Full.exe | 51.124.128.217 | 200 OK | 32 MB |
URL User Request GET HTTP/1.1download.spamfighter.com/SLOW-PCfighter/11129/SLOW-PCfighterSetup_partner11129_2.1.31Full.exe IP51.124.128.217:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
File typePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections Size32 MB (31517048 bytes) Hash7a0618f361f788088b24a7d8d4abeda9 08a2c2af51e51c444f419822bf960d9bda5bd12c 4fbe3d62111c6f287815465cd670dff931eff3e92bdcad9fe91f6cd25d9a0f73
| Analyzer | Verdict | Alert |
|---|
| VirusTotal | malicious | |
| NIDS | Severity | Alert |
|---|
| suricata | high | ET POLICY PE EXE or DLL Windows file download HTTP |
GET /SLOW-PCfighter/11129/SLOW-PCfighterSetup_partner11129_2.1.31Full.exe HTTP/1.1
Host: download.spamfighter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 20 Apr 2016 08:44:23 GMT
Accept-Ranges: bytes
ETag: "3179bad6e09ad11:0"
Server: Microsoft-IIS/10.0
Date: Wed, 21 Aug 2024 01:10:12 GMT
Content-Length: 31517048
|
|