Report - d1.udashi.com/soft/xzgj/3839/%E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7

Report Overview

Visitedpublic

2024-01-02 12:25:03

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
ocsp.trust-provider.cn	unknown	2015-04-09	2022-02-10 09:18:30	2024-01-02 07:12:16	346 B	1.4 kB	36.248.38.100
d1.udashi.com	unknown	2012-07-30	2016-03-30 20:11:50	2024-01-02 13:20:51	501 B	1.7 MB	113.207.69.190

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-01-02 12:24:37	high	113.207.69.190	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP
2024-01-02 12:24:37	low	113.207.69.190	Client IP	ET INFO EXE - Served Attached HTTP

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-01-02	medium	d1.udashi.com/soft/xzgj/3839/%E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe	meth_get_eip

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

d1.udashi.com/soft/xzgj/3839/%E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe

IP / ASN

113.207.69.190

#4837 CHINA UNICOM China169 Backbone

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows

Size1.7 MB (1724416 bytes)

MD531ad360b106bdc1e2e55073f1412fac4

SHA1a67c373f3f6a4c03e2e018c3ae5065e8f8a041d9

SHA25625914a593caf810eb419371a0510b45ada39a19f34c3a2e96cfc87e4df555375

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
VirusTotal	malicious	VirusTotal - Scan result 55/72

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

ocsp.trust-provider.cn/

36.248.38.100

599 B

URL

ocsp.trust-provider.cn/

IP / ASN

36.248.38.100

#4837 CHINA UNICOM China169 Backbone

Requested byN/A

Resource Info

File typedata

First Seen2023-12-31

Last Seen2024-08-20

Times Seen31

Size599 B (599 bytes)

MD59acc757dd8c635baa45bce5f105ae017

SHA1ab274c5116ee6803f461288a6470ec0be8e89857

SHA25613c991608eb03d695d7a08a42c24ccf43658e7a954e010b3161e2f4e578f9412

HTTP Headers

POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 599
Connection: keep-alive
Date: Tue, 02 Jan 2024 12:24:38 GMT
Accept-Ranges: bytes
Age: 1
CF-Cache-Status: EXPIRED
CF-RAY: 83dd8deedcd19828-SJC
ETag: "ab274c5116ee6803f461288a6470ec0be8e89857"
Expires: Sat, 06 Jan 2024 21:19:04 GMT
Last-Modified: Sat, 30 Dec 2023 21:19:05 GMT
WS-Cache-Status: 0
X-CCACDN-Proxy-ID: scdpinlb6
X-Frame-Options: SAMEORIGIN
X-Via: 1.1 nxian198:8 (Cdn Cache Server V2.0), 1.1 PS-JJN-01B7x62:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 65940086_PS-JJN-01pX761_28855-40299
via: n172-013-214.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 17041982782d8bf13018516090abc8cc7a2268c9cd
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=12, edge;dur=0

d1.udashi.com/soft/xzgj/3839/%E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe

113.207.69.190

1.7 MB

URL

d1.udashi.com/soft/xzgj/3839/%E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe

IP / ASN

113.207.69.190

#4837 CHINA UNICOM China169 Backbone

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows

First Seen2023-04-08

Last Seen2024-08-21

Times Seen141

Size1.7 MB (1724416 bytes)

MD531ad360b106bdc1e2e55073f1412fac4

SHA1a67c373f3f6a4c03e2e018c3ae5065e8f8a041d9

SHA25625914a593caf810eb419371a0510b45ada39a19f34c3a2e96cfc87e4df555375

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
VirusTotal	malicious	VirusTotal - Scan result 55/72
suricata	high	ET POLICY PE EXE or DLL Windows file download HTTP
suricata	low	ET INFO EXE - Served Attached HTTP

HTTP Headers

GET /soft/xzgj/3839/%E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe HTTP/1.1
Host: d1.udashi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Last-Modified: Wed, 30 Nov 2016 10:12:22 GMT
Etag: a67c373f3f6a4c03e2e018c3ae5065e8f8a041d9
Content-Type: application/x-msdownload
Content-Disposition: attachment; filename*="UTF-8''%E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe"
Content-Length: 1724416
Accept-Ranges: bytes
X-NWS-LOG-UUID: 5345058039477378990
Connection: keep-alive
Server: Lego Server
Date: Tue, 02 Jan 2024 12:24:39 GMT
X-Cache-Lookup: Cache Hit