Report - my.hpcl.co.in/portal_new/It%20page/HQO.exe

Report Overview

Visitedpublic

2024-03-17 22:43:41

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
my.hpcl.co.in	unknown	2004-02-28	2013-09-02 15:38:28	2024-01-02 12:48:58	496 B	452 kB	125.21.154.30

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-03-17	medium	my.hpcl.co.in/portal_new/It%20page/HQO.exe	files - file ~tmp01925d3f.exe

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

my.hpcl.co.in/portal_new/It%20page/HQO.exe

IP / ASN

125.21.154.30

#9498 BHARTI Airtel Ltd.

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

Size451 kB (451152 bytes)

MD5f41cb1a00ab7285cf9552332605e1071

SHA12fa2957d6f4a8c7d0827c4cee48d9f6a1c8e1843

SHA25632b895c1815939b332c34c4d825e373c669ba7f998dba761921a5c00c97fc333

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET my.hpcl.co.in/portal_new/It%20page/HQO.exe

125.21.154.30

200 OK

451 kB

URL

my.hpcl.co.in/portal_new/It%20page/HQO.exe

IP / ASN

125.21.154.30

#9498 BHARTI Airtel Ltd.

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

First Seen2024-08-20

Last Seen2024-08-20

Times Seen1

Size451 kB (451152 bytes)

MD5f41cb1a00ab7285cf9552332605e1071

SHA12fa2957d6f4a8c7d0827c4cee48d9f6a1c8e1843

SHA25632b895c1815939b332c34c4d825e373c669ba7f998dba761921a5c00c97fc333

Certificate Info

IssuerGlobalSign nv-sa

Subject*.hpcl.co.in

Fingerprint97:F0:4C:7D:B6:59:32:23:B2:2C:E5:F5:00:61:BC:7C:98:CE:C0:57

ValidityTue, 27 Jun 2023 09:46:35 GMT - Sun, 28 Jul 2024 09:46:34 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe

HTTP Headers

GET /portal_new/It%20page/HQO.exe HTTP/1.1
Host: my.hpcl.co.in
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
cache-control: no-cache
content-type: application/octet-stream
last-modified: Tue, 21 Mar 2023 09:47:28 GMT
accept-ranges: bytes
set-cookie: PortalAffinity=8be477388941c1fd0da2927a022a7eb6677a87ebddf5397ac6c1e5f13fd9dee4;Path=/;Domain=my.hpcl.co.in; secure
date: Sun, 17 Mar 2024 22:43:16 GMT
content-length: 451152