Report - download.pplive.com/PPTV(pplive)_forqw

Report Overview

Visitedpublic

2024-08-19 08:18:48

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Sent	Received	IP
r11.o.lencr.org	unknown	1.3 kB	3.5 kB	23.33.119.57
r10.o.lencr.org	unknown	981 B	2.7 kB	23.33.119.27
ocsp.global.sheca.com	unknown	340 B	1.3 kB	163.181.130.195
download.pplive.com	unknown	417 B	403 B	223.68.136.250
ossapp.suning.com	unknown	508 B	9.8 MB	1.194.172.138

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

ossapp.suning.com/pcoss/dl/PPTV(pplive)_forqw_0001.exe

IP / ASN

1.194.172.138

#139587 China Telecom Henan Zhengzhou Shujugang IDC network

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

Size9.8 MB (9808104 bytes)

MD58f5a0683a1d97e3f383734f0a6b35a84

SHA163ab51352fb6f677a2f4fcebf83c894d44ed6823

SHA2560306423d4d36c8993bfb8bc92843888cc2632f6706df9eedf640a8667a2ac451

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 2/64

JavaScript (0)

HTTP Transactions (10)

URL IP Response Size

r11.o.lencr.org/

23.33.119.57

504 B

URL

r11.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-17

Last Seen2024-08-21

Times Seen36548

Size504 B (504 bytes)

MD5219f59137337a0ee601729cab5ec83f6

SHA185f2e3496820405559fd526b44b9a915e0009a4f

SHA256f9701bf0083b06f4a573774d1a4dd491236216bc08f1006a94ce79144df70a21

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "F9701BF0083B06F4A573774D1A4DD491236216BC08F1006A94CE79144DF70A21"
Last-Modified: Sat, 17 Aug 2024 00:55:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2528
Expires: Mon, 19 Aug 2024 09:00:29 GMT
Date: Mon, 19 Aug 2024 08:18:21 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.27

504 B

URL

r10.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-19

Last Seen2024-08-21

Times Seen14380

Size504 B (504 bytes)

MD5845d79542d05f08c933181b3750ce01b

SHA10220d4237c8891f2c270be589e23d0036c397d62

SHA2564689a75cc3d66fe81d22664238a8bf82f2c96f28f52752eaf39f5d4aee4b3f51

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "4689A75CC3D66FE81D22664238A8BF82F2C96F28F52752EAF39F5D4AEE4B3F51"
Last-Modified: Sun, 18 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3182
Expires: Mon, 19 Aug 2024 09:11:23 GMT
Date: Mon, 19 Aug 2024 08:18:21 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.27

504 B

URL

r10.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-17

Last Seen2024-08-21

Times Seen37163

Size504 B (504 bytes)

MD569a9603269726ce602d708bf57058c4c

SHA18689e9ea81ea9636e7b08c3ed42650553a0c4e3b

SHA2561a2339d740b715f3df1900d80114c8376ead57205961a6f896edf37b3ee3a897

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "1A2339D740B715F3DF1900D80114C8376EAD57205961A6F896EDF37B3EE3A897"
Last-Modified: Sat, 17 Aug 2024 09:59:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2541
Expires: Mon, 19 Aug 2024 09:00:42 GMT
Date: Mon, 19 Aug 2024 08:18:21 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.27

504 B

URL

r10.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-18

Last Seen2024-08-21

Times Seen40508

Size504 B (504 bytes)

MD518f75729f3e25e2eb7f12b70dfce3849

SHA1479177b92dda7c4e8763c80a15cbc71c3386d06c

SHA2560b7da2da1fcba23c5118479e14828f87a605a32af15d0962f216115a9ff1d02a

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "0B7DA2DA1FCBA23C5118479E14828F87A605A32AF15D0962F216115A9FF1D02A"
Last-Modified: Sun, 18 Aug 2024 15:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18806
Expires: Mon, 19 Aug 2024 13:31:47 GMT
Date: Mon, 19 Aug 2024 08:18:21 GMT
Connection: keep-alive

ocsp.global.sheca.com/ovscag5

163.181.130.195

515 B

URL

ocsp.global.sheca.com/ovscag5

IP / ASN

163.181.130.195

#24429 Zhejiang Taobao Network Co.,Ltd

Requested byN/A

Resource Info

File typedata

First Seen2024-08-18

Last Seen2024-08-21

Times Seen4

Size515 B (515 bytes)

MD598e38961ea9979d898981197da0788a7

SHA1e9f37fb04d0d423332e7eb91bcbe44cc35cd0f9c

SHA256b6de87edf7a87dd29432afe9629e86610f04ea9e7fcd40c99432ff7437f474f6

HTTP Headers

POST /ovscag5 HTTP/1.1
Host: ocsp.global.sheca.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Content-Length: 515
Connection: keep-alive
Date: Sun, 18 Aug 2024 13:52:45 GMT
Cache-Control: max-age=86400, public, no-transform, must-revalidate
Etag: "098e38961ea9979d898981197da0788a7"
Expires: Fri, 23 Aug 2024 13:03:40 GMT
Last-Modified: Sun, 18 Aug 2024 13:03:40 GMT
Via: cache14.l2de2[0,0,200-0,H], cache9.l2de2[2,0], ens-cache4.de8[5,4,200-0,M], ens-cache4.de8[7,0]
Age: 66337
Ali-Swift-Global-Savetime: 1723989165
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Mon, 19 Aug 2024 08:18:22 GMT
X-Swift-CacheTime: 20063
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Timing-Allow-Origin: *
EagleId: a3b5828817240555022331084e

GET download.pplive.com/PPTV(pplive)_forqw_0001.exe

223.68.136.250

301 Moved Permanently

177 B

URL

download.pplive.com/PPTV(pplive)_forqw_0001.exe

IP / ASN

223.68.136.250

#56046 China Mobile communications corporation

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2023-04-18

Last Seen2025-03-01

Times Seen2698

Size177 B (177 bytes)

MD5f54c7e6bb75767aca5ccf89f57a211cc

SHA1727eb27cf24bd0f5d8deee8380fa3abdb5fbc255

SHA256f2ad1fe4f548a607486b947a480cfe17aca8e499b0668a5350e36f2e7ca24dc9

HTTP Headers

GET /PPTV(pplive)_forqw_0001.exe HTTP/1.1
Host: download.pplive.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: styx
Date: Mon, 19 Aug 2024 08:18:22 GMT
Content-Type: text/html
Content-Length: 177
Connection: keep-alive
Location: http://ossapp.suning.com/pcoss/dl/PPTV(pplive)_forqw_0001.exe

r11.o.lencr.org/

23.33.119.57

504 B

URL

r11.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-18

Last Seen2024-08-21

Times Seen37247

Size504 B (504 bytes)

MD57944981bcac427aa8d0aa016ec63764d

SHA148bf925b10dc02afa8f597af8d26f5bf5efc0b7e

SHA25626bde594c33cd3386f4e65e3eaf0fc048fca46ed4a185f5c2aa70e8deeaffb0a

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "26BDE594C33CD3386F4E65E3EAF0FC048FCA46ED4A185F5C2AA70E8DEEAFFB0A"
Last-Modified: Sat, 17 Aug 2024 21:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9189
Expires: Mon, 19 Aug 2024 10:51:32 GMT
Date: Mon, 19 Aug 2024 08:18:23 GMT
Connection: keep-alive

r11.o.lencr.org/

23.33.119.57

504 B

URL

r11.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-18

Last Seen2024-08-21

Times Seen37247

Size504 B (504 bytes)

MD57944981bcac427aa8d0aa016ec63764d

SHA148bf925b10dc02afa8f597af8d26f5bf5efc0b7e

SHA25626bde594c33cd3386f4e65e3eaf0fc048fca46ed4a185f5c2aa70e8deeaffb0a

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "26BDE594C33CD3386F4E65E3EAF0FC048FCA46ED4A185F5C2AA70E8DEEAFFB0A"
Last-Modified: Sat, 17 Aug 2024 21:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9189
Expires: Mon, 19 Aug 2024 10:51:32 GMT
Date: Mon, 19 Aug 2024 08:18:23 GMT
Connection: keep-alive

r11.o.lencr.org/

23.33.119.27

504 B

URL

r11.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-18

Last Seen2024-08-21

Times Seen37247

Size504 B (504 bytes)

MD57944981bcac427aa8d0aa016ec63764d

SHA148bf925b10dc02afa8f597af8d26f5bf5efc0b7e

SHA25626bde594c33cd3386f4e65e3eaf0fc048fca46ed4a185f5c2aa70e8deeaffb0a

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "26BDE594C33CD3386F4E65E3EAF0FC048FCA46ED4A185F5C2AA70E8DEEAFFB0A"
Last-Modified: Sat, 17 Aug 2024 21:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9225
Expires: Mon, 19 Aug 2024 10:52:08 GMT
Date: Mon, 19 Aug 2024 08:18:23 GMT
Connection: keep-alive

GET ossapp.suning.com/pcoss/dl/PPTV(pplive)_forqw_0001.exe

1.194.172.138

200 OK

9.8 MB

URL

ossapp.suning.com/pcoss/dl/PPTV(pplive)_forqw_0001.exe

IP / ASN

1.194.172.138

#139587 China Telecom Henan Zhengzhou Shujugang IDC network

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

First Seen2023-07-05

Last Seen2025-03-14

Times Seen90

Size9.8 MB (9808104 bytes)

MD58f5a0683a1d97e3f383734f0a6b35a84

SHA163ab51352fb6f677a2f4fcebf83c894d44ed6823

SHA2560306423d4d36c8993bfb8bc92843888cc2632f6706df9eedf640a8667a2ac451

Certificate Info

IssuerGlobalSign nv-sa

Subject*.suning.com

Fingerprint97:EC:91:10:10:CA:6A:A1:01:E3:97:07:A4:CD:0E:E6:06:85:E0:C9

ValidityWed, 10 Jul 2024 08:12:10 GMT - Mon, 11 Aug 2025 08:12:09 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 2/64

HTTP Headers

GET /pcoss/dl/PPTV(pplive)_forqw_0001.exe HTTP/1.1
Host: ossapp.suning.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Byte-nginx
Content-Type: application/octet-stream
Content-Length: 9808104
Connection: keep-alive
Accept-Ranges: bytes
Age: 556538
Cache-Control: max-age=7776000
Content-Disposition: filename="PPTV(pplive)_forqw_0001.exe"
Etag: fadd50a8
Last-Modified: Fri, 15 Jan 2021 03:37:32 GMT
Requestid: MTAuMTA4LjQ2LjE1Mjo6ODg4OHwxNzIzNDk4OTY2fDc0MzY3MTg3MQ==
Strict-Transport-Security: max-age=300
X-Bdcdn-Cache-Status: TCP_HIT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Request-Id: ce9f22463f452191387154b8735eb66b
X-Request-Ip: 91.90.42.154
X-Response-Cache: edge_hit
X-Response-Cinfo: 91.90.42.154
X-Sdoss-Expiration: 
X-Sdoss-Request-Id: MTAuMTA4LjQ2LjE1Mjo6ODg4OHwxNzIzNDk4OTY2fDc0MzY3MTg3MQ==
X-Tt-Trace-Tag: id=5
X-Xss-Protection: 1; mode=block
Date: Mon, 19 Aug 2024 08:18:24 GMT
via: cache11.hazhengzhou-ct29