Report - fullrecover.blob.core.windows.net/plus/E-Sign_Key.exe

Report Overview

Visited public
2025-05-15 14:17:12
Tags
Submit Tags
URL
fullrecover.blob.core.windows.net/plus/E-Sign_Key.exe
Finishing URL
fullrecover.blob.core.windows.net/plus/E-Sign_Key.exe
IP / ASN
20.150.90.36
#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Title
fullrecover.blob.core.windows.net/plus/E-Sign_Key.exe

Detections

urlquery

0

Network Intrusion Detection

12

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
fullrecover.blob.core.windows.net	unknown	1995-08-10	2025-05-14	2025-05-14	1.4 kB	1.3 kB	20.150.90.36

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-05-15 14:16:59	high	Client IP	192.169.69.25	ETPRO HUNTING Observed Suspicious vbc.exe in URI - Possible Payload Execution
2025-05-15 14:16:59	medium	Client IP	192.169.69.25	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
2025-05-15 14:16:59	medium	Client IP	192.169.69.25	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2025-05-15 14:16:59	medium	Client IP	192.169.69.25	ETPRO HUNTING EXE Request to DuckDNS DynDNS Domain
2025-05-15 14:17:05	high	Client IP	192.169.69.25	ETPRO HUNTING Observed Suspicious vbc.exe in URI - Possible Payload Execution
2025-05-15 14:17:05	medium	Client IP	192.169.69.25	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
2025-05-15 14:17:05	medium	Client IP	192.169.69.25	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2025-05-15 14:17:05	medium	Client IP	192.169.69.25	ETPRO HUNTING EXE Request to DuckDNS DynDNS Domain
2025-05-15 14:17:06	high	Client IP	192.169.69.25	ETPRO HUNTING Observed Suspicious vbc.exe in URI - Possible Payload Execution
2025-05-15 14:17:06	medium	Client IP	192.169.69.25	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
2025-05-15 14:17:06	medium	Client IP	192.169.69.25	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2025-05-15 14:17:06	medium	Client IP	192.169.69.25	ETPRO HUNTING EXE Request to DuckDNS DynDNS Domain

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (3)

	URL	IP	Response	Size
	GET fullrecover.blob.core.windows.net/plus/E-Sign_Key.exe	20.150.90.36	403 The specified account is disabled.	220 B
URL User Request GET fullrecover.blob.core.windows.net/plus/E-Sign_Key.exe IP 20.150.90.36:443 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK Certificate IssuerMicrosoft Corporation Subject.blob.core.windows.net Fingerprint95:B0:99:A6:24:F0:02:0F:18:58:3A:68:73:12:FF:AA:23:78:CB:17 ValidityWed, 22 Jan 2025 00:07:00 GMT - Mon, 21 Jul 2025 00:07:00 GMT File type XML 1.0 document, ASCII text Size 220 B (220 bytes) Hash 5c099ecb0c809c3d2801a088ed43e215 1a0248b90730f265b73f4239371cf3643495cd45 da3f99dae96aabf2baff9f8e97ab229b1a9a6323e7899c2bf3503c6548d78f58 HTTP Headers GET /plus/E-Sign_Key.exe HTTP/1.1 Host: fullrecover.blob.core.windows.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 403 The specified account is disabled. Content-Length: 220 Content-Type: application/xml Server: Microsoft-HTTPAPI/2.0 x-ms-request-id: 5cacf65d-301e-004c-21a3-c5db37000000 Date: Thu, 15 May 2025 14:16:39 GMT`

	GET fullrecover.blob.core.windows.net/plus/E-Sign_Key.exe	20.150.90.36	403 The specified account is disabled.	220 B
URL User Request GET fullrecover.blob.core.windows.net/plus/E-Sign_Key.exe IP 20.150.90.36:80 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK File type XML 1.0 document, ASCII text Size 220 B (220 bytes) Hash 2b7a2235c6cc4d86367fd88f75ab7104 ae894282bdb72658aeb795c701c19cf6a7b81e46 0dfca41316b7be9c76d71282cbbce4073bcbae894d36cca2aa196270f481702c HTTP Headers `GET /plus/E-Sign_Key.exe HTTP/1.1 Host: fullrecover.blob.core.windows.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 403 The specified account is disabled. Content-Length: 220 Content-Type: application/xml Server: Microsoft-HTTPAPI/2.0 x-ms-request-id: 5c508c7c-501e-0075-18a3-c5202b000000 Date: Thu, 15 May 2025 14:16:39 GMT`

	GET fullrecover.blob.core.windows.net/favicon.ico	20.150.90.36	403 The specified account is disabled.	220 B
URL GET fullrecover.blob.core.windows.net/favicon.ico IP 20.150.90.36:80 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK Requested by http://fullrecover.blob.core.windows.net/plus/E-Sign_Key.exe File type XML 1.0 document, ASCII text Size 220 B (220 bytes) Hash 5886cc52b570bd04b256b1a89c75f9ac 6a8d40579655bc6d4eb028a2eab44648b2807b08 124683c6889df41b48137a820a3e77501f87677668f2ff53a788cd30aa79c3be HTTP Headers `GET /favicon.ico HTTP/1.1 Host: fullrecover.blob.core.windows.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://fullrecover.blob.core.windows.net/plus/E-Sign_Key.exe Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 403 The specified account is disabled. Content-Length: 220 Content-Type: application/xml Server: Microsoft-HTTPAPI/2.0 x-ms-request-id: 5c508d8c-501e-0075-11a3-c5202b000000 Date: Thu, 15 May 2025 14:16:39 GMT`