Report - ftp.vector.co.jp/41/15/3044/nct.exe?a8=YR

Report Overview

Visitedpublic

2024-05-07 00:46:03

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
ssocsp.cybertrust.ne.jp	21077	2005-09-14	2019-10-07 09:21:25	2024-05-04 14:25:02	345 B	1.7 kB	104.215.29.84
ftp.vector.co.jp	unknown	1994-01-18	2012-05-23 00:47:00	2021-11-10 22:12:52	495 B	11 MB	180.214.37.141

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

ftp.vector.co.jp/41/15/3044/nct.exe?a8=YR

IP / ASN

180.214.37.141

#23637 Equinix Japan Enterprise K.K.

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 7 sections, LHa self-extracting archive

Size11 MB (11271024 bytes)

MD51ea685e64a435cdee8d75abe3cb37f45

SHA114cec6b99738d6563e067611f30566f6281bf009

SHA25670a7452910ecd3080578e31f9031c6d1b55d33147c36754f1dbc1688fe3c5c1a

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/70

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

ssocsp.cybertrust.ne.jp/OcspServer

104.215.29.84

1.5 kB

URL

ssocsp.cybertrust.ne.jp/OcspServer

IP / ASN

104.215.29.84

#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested byN/A

Resource Info

File typedata

First Seen2024-08-20

Last Seen2024-08-20

Times Seen1

Size1.5 kB (1480 bytes)

MD5fe1bb45cbbc0c5e2cc762e94a5f81c00

SHA1582af427d99740c7e2303fe48a6fb1f0a206e2e1

SHA2568a07750bd0676893170002d8122d9b65d1ad9a8c49913624564ab2fff119135c

HTTP Headers

POST /OcspServer HTTP/1.1
Host: ssocsp.cybertrust.ne.jp
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 87
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 May 2024 00:45:37 GMT
Content-Type: application/ocsp-response
Content-Length: 1480
Connection: keep-alive
Keep-Alive: timeout=2

GET ftp.vector.co.jp/41/15/3044/nct.exe?a8=YR

180.214.37.141

200 OK

11 MB

URL

ftp.vector.co.jp/41/15/3044/nct.exe?a8=YR

IP / ASN

180.214.37.141

#23637 Equinix Japan Enterprise K.K.

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 7 sections, LHa self-extracting archive

First Seen2023-07-20

Last Seen2024-08-20

Times Seen3

Size11 MB (11271024 bytes)

MD51ea685e64a435cdee8d75abe3cb37f45

SHA114cec6b99738d6563e067611f30566f6281bf009

SHA25670a7452910ecd3080578e31f9031c6d1b55d33147c36754f1dbc1688fe3c5c1a

Certificate Info

IssuerCybertrust Japan Co., Ltd.

Subject*.vector.co.jp

FingerprintC1:35:21:DA:4A:69:8A:3D:F9:00:D9:97:2C:78:D0:6B:42:63:A0:E6

ValidityThu, 07 Dec 2023 06:13:11 GMT - Thu, 02 Jan 2025 14:59:00 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/70

HTTP Headers

GET /41/15/3044/nct.exe?a8=YR HTTP/1.1
Host: ftp.vector.co.jp
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 00:45:38 GMT
Server: Apache
Last-Modified: Fri, 22 Sep 2006 01:22:18 GMT
ETag: "abfb70-41e00abccc680"
Accept-Ranges: bytes
Content-Length: 11271024
Content-Disposition: attachment; filename=nct.exe
Connection: close
Content-Type: application/octet-stream