Report - cdn.ogulniega.ct8.pl/files/test/xd.exe

Report Overview

Visitedpublic

2024-01-24 10:15:36

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
cdn.ogulniega.ct8.pl	unknown	2011-10-13	2023-10-18 01:01:11	2024-01-23 17:48:30	492 B	170 kB	136.243.156.120
aus5.mozilla.org	2548	1998-01-24	2015-10-27 08:06:24	2024-01-23 18:19:33	511 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-01-24	medium	cdn.ogulniega.ct8.pl/files/test/xd.exe	files - file ~tmp01925d3f.exe

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

cdn.ogulniega.ct8.pl/files/test/xd.exe

IP / ASN

136.243.156.120

#24940 Hetzner Online GmbH

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

Size170 kB (169984 bytes)

MD5cca5c282e45251b68430238120fcd737

SHA1638e848b8389e04fb8be8ea47a46e28c78110e3f

SHA2567d28181e5877ee2a7cd6160e29c342571cd35e850a5ed36e0a0557e04ff7a1b3

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
VirusTotal	malicious	VirusTotal - Scan result 42/70

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET cdn.ogulniega.ct8.pl/files/test/xd.exe

136.243.156.120

200 OK

170 kB

URL

cdn.ogulniega.ct8.pl/files/test/xd.exe

IP / ASN

136.243.156.120

#24940 Hetzner Online GmbH

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

First Seen2024-01-05

Last Seen2025-05-28

Times Seen46

Size170 kB (169984 bytes)

MD5cca5c282e45251b68430238120fcd737

SHA1638e848b8389e04fb8be8ea47a46e28c78110e3f

SHA2567d28181e5877ee2a7cd6160e29c342571cd35e850a5ed36e0a0557e04ff7a1b3

Certificate Info

IssuerLet's Encrypt

Subjectcdn.ogulniega.ct8.pl

FingerprintAA:AB:E0:18:4A:25:D6:2D:0F:9E:8D:A5:C4:20:5B:25:39:03:7C:C4

ValidityFri, 22 Dec 2023 21:00:49 GMT - Thu, 21 Mar 2024 21:00:48 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
VirusTotal	malicious	VirusTotal - Scan result 42/70

HTTP Headers

GET /files/test/xd.exe HTTP/1.1
Host: cdn.ogulniega.ct8.pl
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 24 Jan 2024 10:15:11 GMT
content-type: application/x-msdownload
content-length: 169984
last-modified: Wed, 27 Dec 2023 20:17:13 GMT
etag: "658c8649-29800"
accept-ranges: bytes
X-Firefox-Spdy: h2

aus5.mozilla.org/update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL

aus5.mozilla.org/update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

IP / ASN

35.244.181.201

#15169 GOOGLE

Requested byN/A

Resource Info

File typeXML 1.0 document, ASCII text, with very long lines (332)

First Seen2023-10-13

Last Seen2025-06-20

Times Seen185315

Size444 B (444 bytes)

MD53b324dec137a87ef7e24a30a65b13dd0

SHA1c0faa95b2f1018e264b3a14aaf50d1003e6c27b3

SHA2566cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-02-29-06-55-23.chain; p384ecdsa=7Rekk-qQAhXviKuqAgLkskIBO1p3tUftBF_ISy4JTx1A1InAQ1GbSEGlbIFmqPfPKumI9jf8pRcO_ra31u6e5REvvjTDQrvissWv3pnpxSbJxciZIG4kZBhpiG9IlWRh
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
content-length: 444
date: Wed, 24 Jan 2024 10:13:31 GMT
age: 119
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2