Report - budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

Report Overview

Visited public
2025-05-11 03:19:18
Tags
URL
budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Finishing URL
www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
IP / ASN
217.160.0.143
#8560 IONOS SE
Title
Inhalt leider nicht gefunden – BUDENBERG-Software

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
budenberg.de	unknown	unknown	2017-01-21	2025-05-09	520 B	31 kB	217.160.0.143
www.budenberg.de	unknown	unknown	2014-05-22	2025-05-09	8.2 kB	540 kB	217.160.0.143

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-05-11 03:18:51	high	Client IP	217.160.0.143	ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (9)

	URL	From	Size	First Seen	Last Seen
	www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe	ScriptElement	3.3 kB	2025-05-09	2025-05-11
Pretty URL www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe IP 217.160.0.143 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-09 09:15 Last Seen2025-05-11 03:19 Times Seen3 Hash 326429de597250274cdfda008beb742a 6e1bd62eef10bd08daa20a2226e66d63d532f6e0 61646662ea97fe0221f2b285ab70b53d3158114a37fa1caf224d2e3aa984e341 Loading...

	www.budenberg.de/wp-includes/js/masonry.min.js?ver=4.2.2	ScriptElement	24 kB	2023-03-07	2025-05-27
Pretty URL www.budenberg.de/wp-includes/js/masonry.min.js?ver=4.2.2 IP 217.160.0.143 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-27 18:07 Times Seen8794 Hash 3b3fc826e58fc554108e4a651c9c7848 76778fd446e2ff2377588a7b4ac4d79f258427c9 e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb Loading...

	www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe	ScriptElement	57 B	2023-03-07	2025-05-11
Pretty URL www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe IP 217.160.0.143 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 13:19 Last Seen2025-05-11 03:19 Times Seen19 Hash 0d9c2a0e5f37aa36270df127712c7959 17bdbfc1e7d5ae1931af6a996c079ed173f4a307 cea2fde3ccf8213dffe19862131f7cd2ab78f6c9a817039e9cc960e50ec1e5a3 Loading...

	www.budenberg.de/wp-content/themes/mcluhan/assets/js/global.js?ver=2.1.1	ScriptElement	7.3 kB	2023-03-07	2025-05-11
Pretty URL www.budenberg.de/wp-content/themes/mcluhan/assets/js/global.js?ver=2.1.1 IP 217.160.0.143 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:19 Last Seen2025-05-11 03:19 Times Seen4 Hash e73158de8ab4cd62a5bfe06874898402 5f0472822abcb791067a3780fb61af354d0283d8 869bc02d88d9d8e9ee041269bc6ad1b564ea551e50d675545b811e70c351cd30 Loading...

	www.budenberg.de/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	ScriptElement	14 kB	2023-05-09	2025-05-27
Pretty URL www.budenberg.de/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 IP 217.160.0.143 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-09 19:21 Last Seen2025-05-27 19:13 Times Seen108615 Hash 9ffeb32e2d9efbf8f70caabded242267 3ad0c10e501ac2a9bfa18f9cd7e700219b378738 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89 Loading...

	www.budenberg.de/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	ScriptElement	88 kB	2023-11-03	2025-05-27
Pretty URL www.budenberg.de/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 IP 217.160.0.143 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-03 09:26 Last Seen2025-05-27 19:13 Times Seen95355 Hash 826eb77e86b02ab7724fe3d0141ff87c 79cd3587d565afe290076a8d36c31c305a573d18 cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf Loading...

	www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe	ScriptElement	161 B	2025-05-09	2025-05-11
Pretty URL www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe IP 217.160.0.143 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-09 09:15 Last Seen2025-05-11 03:19 Times Seen3 Hash 854ba7c6d47d122ded206459d4e3c7a5 9c3024034d6700f8d1d667049f14d94096d2aad4 ccace797f6480c00df5f510f1e48927645df1a3db82c16fb4d5406b0976b9d43 Loading...

	www.budenberg.de/wp-includes/js/imagesloaded.min.js?ver=5.0.0	ScriptElement	5.5 kB	2023-11-08	2025-05-27
Pretty URL www.budenberg.de/wp-includes/js/imagesloaded.min.js?ver=5.0.0 IP 217.160.0.143 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 01:34 Last Seen2025-05-27 18:29 Times Seen16086 Hash 6823120876c9afc8929418c9a6f8e343 90b0adb37d70ffec5f9189c36bb0027c310c9502 b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1 Loading...

	www.budenberg.de/wp-includes/js/wp-emoji-release.min.js?ver=6.8.1	ScriptElement	19 kB	2025-04-03	2025-05-27
Pretty URL www.budenberg.de/wp-includes/js/wp-emoji-release.min.js?ver=6.8.1 IP 217.160.0.143 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML false Observations First Seen2025-04-03 04:02 Last Seen2025-05-27 19:13 Times Seen5681 Hash 1dafa7fe14b33c26fef9b0e5ba0c8e72 62f67cdac55d89c43570bf0c338f4edf548b14e1 50cc1a0490008ec62ca8b581fa9cdcfb2eda2d36a08ccbeb1f004da599e9cc61 Loading...

HTTP Transactions (19)

URL IP Response Size

www.budenberg.de/wp-includes/js/imagesloaded.min.js?ver=5.0.0

217.160.0.143

200 OK

5.5 kB

URL GET
www.budenberg.de/wp-includes/js/imagesloaded.min.js?ver=5.0.0
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
JavaScript source, ASCII text, with very long lines (4358)
Size
5.5 kB (5520 bytes)
Hash
6823120876c9afc8929418c9a6f8e343
90b0adb37d70ffec5f9189c36bb0027c310c9502
b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1

HTTP Headers

GET /wp-includes/js/imagesloaded.min.js?ver=5.0.0 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 1977
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 996
Date: Sun, 11 May 2025 03:18:51 GMT
Server: Apache
Vary: Accept-Encoding
Last-Modified: Wed, 08 Nov 2023 17:04:29 GMT
ETag: "1590-609a714938291-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2419200
Expires: Sun, 08 Jun 2025 03:18:51 GMT
Content-Encoding: gzip

www.budenberg.de/wp-content/uploads/2023/10/cropped-dunkelgruen-bube-kind-250-1-32x32.png

217.160.0.143

200 OK

1.9 kB

URL GET
www.budenberg.de/wp-content/uploads/2023/10/cropped-dunkelgruen-bube-kind-250-1-32x32.png
IP
217.160.0.143:443
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Certificate
IssuerSectigo Limited
Subject*.budenberg.de
FingerprintCF:E3:FF:65:B3:11:1C:86:88:77:75:66:4B:84:11:53:D2:64:67:9C
ValidityMon, 18 Nov 2024 00:00:00 GMT - Tue, 02 Dec 2025 23:59:59 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.9 kB (1889 bytes)
Hash
90d490e25da64480220f6589d38587fa
ae6819ee8c25d4a2a3b7b2021a57f550f133d4b5
78d56fbcde29c232138f0ac716ce1a59a8d3df3b3582798809e3b74232181b92

HTTP Headers

GET /wp-content/uploads/2023/10/cropped-dunkelgruen-bube-kind-250-1-32x32.png HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/png
content-length: 1889
x-ws-ratelimit-limit: 1000
x-ws-ratelimit-remaining: 999
date: Sun, 11 May 2025 03:18:53 GMT
server: Apache
vary: Accept-Encoding
last-modified: Tue, 24 Oct 2023 13:27:19 GMT
etag: "761-608764c534d3e"
accept-ranges: bytes
cache-control: max-age=2419200
expires: Sun, 08 Jun 2025 03:18:53 GMT
X-Firefox-Spdy: h2

budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

217.160.0.143

301 Moved Permanently

30 kB

URL User Request GET
budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
IP
217.160.0.143:443
ASN
#8560 IONOS SE

Certificate
IssuerSectigo Limited
Subject*.budenberg.de
FingerprintCF:E3:FF:65:B3:11:1C:86:88:77:75:66:4B:84:11:53:D2:64:67:9C
ValidityMon, 18 Nov 2024 00:00:00 GMT - Tue, 02 Dec 2025 23:59:59 GMT

File type

Size
30 kB (30327 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /wp-content/uploads/2023/10/bb24demo.exe HTTP/1.1
Host: budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
content-type: text/html; charset=UTF-8
location: https://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
x-ws-ratelimit-limit: 1000
x-ws-ratelimit-remaining: 998
date: Sun, 11 May 2025 03:18:50 GMT
server: Apache
x-powered-by: PHP/8.1.32
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0, no-store, private
x-redirect-by: WordPress
X-Firefox-Spdy: h2

www.budenberg.de/wp-content/themes/mcluhan/style.css?ver=2.1.1

217.160.0.143

200 OK

60 kB

URL GET
www.budenberg.de/wp-content/themes/mcluhan/style.css?ver=2.1.1
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
Unicode text, UTF-8 text, with very long lines (493)
Size
60 kB (60310 bytes)
Hash
f6e3d339eded32869e7bef89ce526645
8cefe44c83d3488980fc041b2f958ca48d90d35f
54b728f417941eb7547bd441e6cb83aa42b32702faa1d920583c885d5d8eb941

HTTP Headers

GET /wp-content/themes/mcluhan/style.css?ver=2.1.1 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 14758
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 999
Date: Sun, 11 May 2025 03:18:51 GMT
Server: Apache
Vary: Accept-Encoding
Last-Modified: Sat, 14 Oct 2023 15:17:32 GMT
ETag: "eb96-607aeac0cc5c9-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2419200
Expires: Sun, 08 Jun 2025 03:18:51 GMT
Content-Encoding: gzip

www.budenberg.de/wp-content/themes/mcluhan/assets/fonts/archivo-v18-latin-ext_latin-regular.woff2

217.160.0.143

200 OK

19 kB

URL GET
www.budenberg.de/wp-content/themes/mcluhan/assets/fonts/archivo-v18-latin-ext_latin-regular.woff2
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
Web Open Font Format (Version 2), TrueType, length 18828, version 1.0
Size
19 kB (18828 bytes)
Hash
eab0253407deaa41ceec317071cdca3e
344a739d6f167666e79e77e3e52706961728fd64
f3139ed32116dc534b24447ddb9d8ebd30229a98b69f2280b069c2132de84a42

HTTP Headers

GET /wp-content/themes/mcluhan/assets/fonts/archivo-v18-latin-ext_latin-regular.woff2 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/themes/mcluhan/assets/css/fonts.css?ver=6.8.1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: font/woff2
Content-Length: 18828
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 998
Date: Sun, 11 May 2025 03:18:52 GMT
Server: Apache
Last-Modified: Sat, 14 Oct 2023 15:17:32 GMT
ETag: "498c-607aeac0cb628"
Accept-Ranges: bytes

www.budenberg.de/wp-content/themes/mcluhan/assets/fonts/archivo-v18-latin-ext_latin-600.woff2

217.160.0.143

200 OK

18 kB

URL GET
www.budenberg.de/wp-content/themes/mcluhan/assets/fonts/archivo-v18-latin-ext_latin-600.woff2
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
Web Open Font Format (Version 2), TrueType, length 17476, version 1.0
Size
18 kB (17476 bytes)
Hash
6b7d3e4630e0d80d1e0bb852d73aa25e
b6400bebdcc4baea25d10e4336835bb76cc2dae1
1a0cdaecc16560ed0d816ee09d43f185a59cedd3380c3ea85c76113a0bd69e28

HTTP Headers

GET /wp-content/themes/mcluhan/assets/fonts/archivo-v18-latin-ext_latin-600.woff2 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/themes/mcluhan/assets/css/fonts.css?ver=6.8.1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: font/woff2
Content-Length: 17476
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 991
Date: Sun, 11 May 2025 03:18:52 GMT
Server: Apache
Last-Modified: Sat, 14 Oct 2023 15:17:32 GMT
ETag: "4444-607aeac0cb628"
Accept-Ranges: bytes

www.budenberg.de/wp-includes/js/wp-emoji-release.min.js?ver=6.8.1

217.160.0.143

200 OK

19 kB

URL GET
www.budenberg.de/wp-includes/js/wp-emoji-release.min.js?ver=6.8.1
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
JavaScript source, ASCII text, with very long lines (16290)
Size
19 kB (19264 bytes)
Hash
1dafa7fe14b33c26fef9b0e5ba0c8e72
62f67cdac55d89c43570bf0c338f4edf548b14e1
50cc1a0490008ec62ca8b581fa9cdcfb2eda2d36a08ccbeb1f004da599e9cc61

HTTP Headers

GET /wp-includes/js/wp-emoji-release.min.js?ver=6.8.1 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 5981
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 988
Date: Sun, 11 May 2025 03:18:52 GMT
Server: Apache
Vary: Accept-Encoding
Last-Modified: Wed, 16 Apr 2025 11:14:57 GMT
ETag: "4b40-632e36535b636-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2419200
Expires: Sun, 08 Jun 2025 03:18:52 GMT
Content-Encoding: gzip

www.budenberg.de/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

217.160.0.143

200 OK

88 kB

URL GET
www.budenberg.de/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
88 kB (87553 bytes)
Hash
826eb77e86b02ab7724fe3d0141ff87c
79cd3587d565afe290076a8d36c31c305a573d18
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

HTTP Headers

GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 35532
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 993
Date: Sun, 11 May 2025 03:18:51 GMT
Server: Apache
Vary: Accept-Encoding
Last-Modified: Wed, 08 Nov 2023 17:04:29 GMT
ETag: "15601-609a714923a6f-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2419200
Expires: Sun, 08 Jun 2025 03:18:51 GMT
Content-Encoding: gzip

www.budenberg.de/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

217.160.0.143

200 OK

14 kB

URL GET
www.budenberg.de/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
JavaScript source, ASCII text, with very long lines (13479)
Size
14 kB (13577 bytes)
Hash
9ffeb32e2d9efbf8f70caabded242267
3ad0c10e501ac2a9bfa18f9cd7e700219b378738
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

HTTP Headers

GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 5348
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 997
Date: Sun, 11 May 2025 03:18:51 GMT
Server: Apache
Vary: Accept-Encoding
Last-Modified: Fri, 13 Oct 2023 07:34:50 GMT
ETag: "3509-60794176f7a80-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2419200
Expires: Sun, 08 Jun 2025 03:18:51 GMT
Content-Encoding: gzip

www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

217.160.0.143

404 Not Found

30 kB

URL User Request GET
www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
IP
217.160.0.143:80
ASN
#8560 IONOS SE

File type
HTML document, Unicode text, UTF-8 text, with very long lines (9043)
Size
30 kB (30317 bytes)
Hash
9956e3fdacc854eaa9ac63539ef903b5
6a81b6886542f9b5b42d8373ae80d4713be79c73
501ad6c40bb92ed52c85038ad15a7bcf8787a96150a739fe7b5039eb350c066e

Detections

NIDS	Severity	Alert
suricata	high	ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

HTTP Headers

GET /wp-content/uploads/2023/10/bb24demo.exe HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 998
Date: Sun, 11 May 2025 03:18:51 GMT
Server: Apache
X-Powered-By: PHP/8.1.32
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
Link: <https://www.budenberg.de/wp-json/>; rel="https://api.w.org/"
Content-Encoding: gzip

www.budenberg.de/wp-includes/css/dist/block-library/style.min.css?ver=6.8.1

217.160.0.143

200 OK

116 kB

URL GET
www.budenberg.de/wp-includes/css/dist/block-library/style.min.css?ver=6.8.1
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
ASCII text, with very long lines (55654)
Size
116 kB (116363 bytes)
Hash
dfe67cbbac3da53fdbbaed71c91db428
8c82643ef63a8389c1b800b7c5d0af9d684b8b24
597ddfdee7171750c16ec5aafd392cf992e9c53386d6bb6061d48e30334f09e9

HTTP Headers

GET /wp-includes/css/dist/block-library/style.min.css?ver=6.8.1 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 19698
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 999
Date: Sun, 11 May 2025 03:18:51 GMT
Server: Apache
Vary: Accept-Encoding
Last-Modified: Wed, 16 Apr 2025 11:14:56 GMT
ETag: "1c68b-632e36526e128-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2419200
Expires: Sun, 08 Jun 2025 03:18:51 GMT
Content-Encoding: gzip

www.budenberg.de/wp-content/themes/mcluhan/assets/css/font-awesome.css?ver=6.8.1

217.160.0.143

200 OK

471 B

URL GET
www.budenberg.de/wp-content/themes/mcluhan/assets/css/font-awesome.css?ver=6.8.1
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
ASCII text
Size
471 B (471 bytes)
Hash
943f7dd40f0d417bcc7163a9eac94b28
3795e7f2f18edf88bab48ce5146a18c312eaf755
d1ea8e2e81e8eaf21d61132b8ad2b35f2a352f1e01c9c0048bf8ec9676452a35

HTTP Headers

GET /wp-content/themes/mcluhan/assets/css/font-awesome.css?ver=6.8.1 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 178
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 992
Date: Sun, 11 May 2025 03:18:52 GMT
Server: Apache
Vary: Accept-Encoding
Last-Modified: Sat, 14 Oct 2023 15:17:32 GMT
ETag: "1d7-607aeac0cb628-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2419200
Expires: Sun, 08 Jun 2025 03:18:52 GMT
Content-Encoding: gzip

www.budenberg.de/wp-includes/js/masonry.min.js?ver=4.2.2

217.160.0.143

200 OK

24 kB

URL GET
www.budenberg.de/wp-includes/js/masonry.min.js?ver=4.2.2
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
JavaScript source, ASCII text, with very long lines (23966)
Size
24 kB (24138 bytes)
Hash
3b3fc826e58fc554108e4a651c9c7848
76778fd446e2ff2377588a7b4ac4d79f258427c9
e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb

HTTP Headers

GET /wp-includes/js/masonry.min.js?ver=4.2.2 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 8563
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 995
Date: Sun, 11 May 2025 03:18:51 GMT
Server: Apache
Vary: Accept-Encoding
Last-Modified: Fri, 13 Oct 2023 07:34:50 GMT
ETag: "5e4a-60794176f7a80-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2419200
Expires: Sun, 08 Jun 2025 03:18:51 GMT
Content-Encoding: gzip

www.budenberg.de/wp-content/themes/mcluhan/assets/js/global.js?ver=2.1.1

217.160.0.143

200 OK

7.3 kB

URL GET
www.budenberg.de/wp-content/themes/mcluhan/assets/js/global.js?ver=2.1.1
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
Unicode text, UTF-8 text
Size
7.3 kB (7287 bytes)
Hash
e73158de8ab4cd62a5bfe06874898402
5f0472822abcb791067a3780fb61af354d0283d8
869bc02d88d9d8e9ee041269bc6ad1b564ea551e50d675545b811e70c351cd30

HTTP Headers

GET /wp-content/themes/mcluhan/assets/js/global.js?ver=2.1.1 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 2316
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 994
Date: Sun, 11 May 2025 03:18:51 GMT
Server: Apache
Vary: Accept-Encoding
Last-Modified: Sat, 14 Oct 2023 15:17:32 GMT
ETag: "1c77-607aeac0cb628-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2419200
Expires: Sun, 08 Jun 2025 03:18:51 GMT
Content-Encoding: gzip

www.budenberg.de/wp-content/themes/mcluhan/assets/images/spyglass-black.svg

217.160.0.143

200 OK

494 B

URL GET
www.budenberg.de/wp-content/themes/mcluhan/assets/images/spyglass-black.svg
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
SVG Scalable Vector Graphics image
Size
494 B (494 bytes)
Hash
14bc1e63d7771a98436c9abbe1e272ee
63eee06405863a5032bdbcfe4e9af2c89723b98c
1e98a43eaaaedebe08f59c420e4c79a391dd156801e8b13a4237b2d5c8375641

HTTP Headers

GET /wp-content/themes/mcluhan/assets/images/spyglass-black.svg HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/themes/mcluhan/style.css?ver=2.1.1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/svg+xml
Content-Length: 306
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 990
Date: Sun, 11 May 2025 03:18:52 GMT
Server: Apache
Vary: Accept-Encoding
Last-Modified: Sat, 14 Oct 2023 15:17:32 GMT
ETag: "1ee-607aeac0cb628-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2419200
Expires: Sun, 08 Jun 2025 03:18:52 GMT
Content-Encoding: gzip

www.budenberg.de/wp-content/themes/mcluhan/assets/fonts/font-awesome/fa-solid-900.woff2

217.160.0.143

200 OK

72 kB

URL GET
www.budenberg.de/wp-content/themes/mcluhan/assets/fonts/font-awesome/fa-solid-900.woff2
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
Web Open Font Format (Version 2), TrueType, length 72000, version 1.0
Size
72 kB (72000 bytes)
Hash
1dc5b6dd4bf409a6f919be38603f76a0
388c52a87094578015fb41ebb9147821f0bb03a3
a5587a9dca3673b604a8a0e144d268f3dcb180aac337e2b2e163704bc1fc508a

HTTP Headers

GET /wp-content/themes/mcluhan/assets/fonts/font-awesome/fa-solid-900.woff2 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/themes/mcluhan/assets/css/font-awesome.css?ver=6.8.1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: font/woff2
Content-Length: 72000
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 989
Date: Sun, 11 May 2025 03:18:52 GMT
Server: Apache
Last-Modified: Sat, 14 Oct 2023 15:17:32 GMT
ETag: "11940-607aeac0cb628"
Accept-Ranges: bytes

www.budenberg.de/wp-content/uploads/2023/10/cropped-dunkelgruen-bube-kind-250-1-192x192.png

217.160.0.143

200 OK

26 kB

URL GET
www.budenberg.de/wp-content/uploads/2023/10/cropped-dunkelgruen-bube-kind-250-1-192x192.png
IP
217.160.0.143:443
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Certificate
IssuerSectigo Limited
Subject*.budenberg.de
FingerprintCF:E3:FF:65:B3:11:1C:86:88:77:75:66:4B:84:11:53:D2:64:67:9C
ValidityMon, 18 Nov 2024 00:00:00 GMT - Tue, 02 Dec 2025 23:59:59 GMT

File type
PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Size
26 kB (26006 bytes)
Hash
4af000a1401ab9d3ff7836eea8c79a8d
ad3ea8bca9bb3696fe07839f0d32550b167fb5d4
aea940cdb87a592cc89aff9e28e331c3fb4a25f56592f2589a6b8263977babae

HTTP Headers

GET /wp-content/uploads/2023/10/cropped-dunkelgruen-bube-kind-250-1-192x192.png HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/png
content-length: 26006
x-ws-ratelimit-limit: 1000
x-ws-ratelimit-remaining: 999
date: Sun, 11 May 2025 03:19:00 GMT
server: Apache
vary: Accept-Encoding
last-modified: Tue, 24 Oct 2023 13:27:19 GMT
etag: "6596-608764c52ef7d"
accept-ranges: bytes
cache-control: max-age=2419200
expires: Sun, 08 Jun 2025 03:19:00 GMT
X-Firefox-Spdy: h2

www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

217.160.0.143

404 Not Found

30 kB

URL User Request GET
www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
IP
217.160.0.143:443
ASN
#8560 IONOS SE

Certificate
IssuerSectigo Limited
Subject*.budenberg.de
FingerprintCF:E3:FF:65:B3:11:1C:86:88:77:75:66:4B:84:11:53:D2:64:67:9C
ValidityMon, 18 Nov 2024 00:00:00 GMT - Tue, 02 Dec 2025 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (9043)
Size
30 kB (30327 bytes)
Hash
db72681ddf3e4387b0c02da100c6b72a
ae8f2e480ef174fbcc45a390930368cc5218bec9
78091bb4c3faec8f7d793326a6a196fa802ad3bac1c35a5c8182d9dba259abea

Detections

NIDS	Severity	Alert
suricata	high	ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

HTTP Headers

GET /wp-content/uploads/2023/10/bb24demo.exe HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
content-type: text/html; charset=UTF-8
x-ws-ratelimit-limit: 1000
x-ws-ratelimit-remaining: 999
date: Sun, 11 May 2025 03:18:50 GMT
server: Apache
x-powered-by: PHP/8.1.32
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0, no-store, private
link: <https://www.budenberg.de/wp-json/>; rel="https://api.w.org/"
content-encoding: gzip
X-Firefox-Spdy: h2

www.budenberg.de/wp-content/themes/mcluhan/assets/css/fonts.css?ver=6.8.1

217.160.0.143

200 OK

1.1 kB

URL GET
www.budenberg.de/wp-content/themes/mcluhan/assets/css/fonts.css?ver=6.8.1
IP
217.160.0.143:80
ASN
#8560 IONOS SE

Requested by
http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe

File type
ASCII text
Size
1.1 kB (1091 bytes)
Hash
4ce920b2f41f9634e2e0fd085f833b5c
8ab41af3f2226d2f53b54e0bf9c40b081f6d2b3e
63ccfb9858e59c3591dc576985b0d227a06445be58c9b4ad896836cb029e1e12

HTTP Headers

GET /wp-content/themes/mcluhan/assets/css/fonts.css?ver=6.8.1 HTTP/1.1
Host: www.budenberg.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.budenberg.de/wp-content/uploads/2023/10/bb24demo.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 207
Connection: keep-alive
X-WS-RateLimit-Limit: 1000
X-WS-RateLimit-Remaining: 998
Date: Sun, 11 May 2025 03:18:51 GMT
Server: Apache
Vary: Accept-Encoding
Last-Modified: Sat, 14 Oct 2023 15:17:32 GMT
ETag: "443-607aeac0cb628-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2419200
Expires: Sun, 08 Jun 2025 03:18:51 GMT
Content-Encoding: gzip

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (9)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (19)

URL GET

IP

ASN

Requested by