IP 47.246.44.205:0
ASN#24429 Zhejiang Taobao Network Co.,Ltd
Hash283f80186ca6d1183dcb531bc95d9121 1da04ea8aeee9569f5711f222321fb4f99381172 1a82a69a4b501a97af336c242551c4039accadefefecc4e9ad04bb6f81f35a50
POST / HTTP/1.1
Host: ocsp.digicert.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: max-age=7200
Date: Tue, 26 Sep 2023 17:16:52 GMT
Ali-Swift-Global-Savetime: 1695748612
Via: cache7.l2de2[300,300,200-0,M], cache7.l2de2[301,0], cache5.se1[322,322,200-0,M], cache5.se1[323,0]
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Tue, 26 Sep 2023 17:16:52 GMT
X-Swift-CacheTime: 0
Timing-Allow-Origin: *
EagleId: 2ff62c9916957486120282654e
|
IP47.246.44.205:0 ASN#24429 Zhejiang Taobao Network Co.,Ltd
Hash283f80186ca6d1183dcb531bc95d9121 1da04ea8aeee9569f5711f222321fb4f99381172 1a82a69a4b501a97af336c242551c4039accadefefecc4e9ad04bb6f81f35a50
POST / HTTP/1.1
Host: ocsp.digicert.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: max-age=7200
Date: Tue, 26 Sep 2023 17:16:52 GMT
Ali-Swift-Global-Savetime: 1695748612
Via: cache12.l2de2[275,274,200-0,M], cache12.l2de2[276,0], cache3.se1[298,297,200-0,M], cache3.se1[300,0]
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Tue, 26 Sep 2023 17:16:52 GMT
X-Swift-CacheTime: 0
Timing-Allow-Origin: *
EagleId: 2ff62c9716957486121057397e
|
| dl.lmrjxz.com/downloads/special/znysrf/zny_znyzxt7654_17401.exe |  101.72.233.163 | 200 OK | 34 MB |
URL User Request GET HTTP/1.1dl.lmrjxz.com/downloads/special/znysrf/zny_znyzxt7654_17401.exe IP101.72.233.163:80 ASN#4837 CHINA UNICOM China169 Backbone
File typePE32 executable (GUI) Intel 80386, for MS Windows\012- data Size34 MB (33487672 bytes) Hash3cbf7d92b97f9495735fb5d0d1489151 8e7fa45e0637a746ee333f5f74f6451cc592e42e 956635a3ca5e616c3845a74888b27a82d0271fba16530b9f04081ba570f96e89
| Analyzer | Verdict | Alert |
|---|
| VirusTotal | malicious | |
| NIDS | Severity | Alert |
|---|
| suricata | high | ET POLICY PE EXE or DLL Windows file download HTTP | | suricata | low | ET INFO EXE - Served Attached HTTP |
GET /downloads/special/znysrf/zny_znyzxt7654_17401.exe HTTP/1.1
Host: dl.lmrjxz.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Last-Modified: Fri, 14 Sep 2018 11:09:48 GMT
Etag: 8e7fa45e0637a746ee333f5f74f6451cc592e42e
Content-Type: application/x-msdownload
Content-Length: 33487672
Accept-Ranges: bytes
X-NWS-LOG-UUID: 13737430520411671107
Connection: keep-alive
Server: Lego Server
Date: Tue, 26 Sep 2023 17:16:52 GMT
X-Cache-Lookup: Cache Hit
Content-Disposition: attachment; filename="zny_znyzxt7654_17401.exe"
|