IP 23.36.76.226:0
ASN#20940 Akamai International B.V.
Hash41036a4c62e61466443bce27a927e029 39a2a8a258c5feaf020246696135700b0c30740d e38b3080a1752122f5a174604bd307c54be31c02e0cdb8e2d9354e2a04e1b50f
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "E38B3080A1752122F5A174604BD307C54BE31C02E0CDB8E2D9354E2A04E1B50F"
Last-Modified: Sun, 07 Jul 2024 11:47:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14876
Expires: Tue, 09 Jul 2024 23:20:14 GMT
Date: Tue, 09 Jul 2024 19:12:18 GMT
Connection: keep-alive
|
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashd7b2c37e4b6c062d80ad32046f42d3d8 131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c 317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2"
Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8588
Expires: Tue, 09 Jul 2024 21:35:28 GMT
Date: Tue, 09 Jul 2024 19:12:20 GMT
Connection: keep-alive
|
| www.usvox.com/uploads/2/7/0/5/2705468/sip-alg-detector.exe |  199.34.228.77 | 200 OK | 2.9 MB |
URL User Request GET HTTP/2www.usvox.com/uploads/2/7/0/5/2705468/sip-alg-detector.exe IP199.34.228.77:443
CertificateIssuerLet's Encrypt Subjectwww.usvox.com Fingerprint84:89:E2:97:CF:63:A3:C7:09:B0:99:80:8B:A7:57:EE:BC:53:B3:FA ValidityWed, 01 May 2024 17:18:09 GMT - Tue, 30 Jul 2024 17:18:08 GMT
File typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, 9 sections Size2.9 MB (2925190 bytes) Hashce9992bfba046094928d31db81e78dc6 b7c07c2aa35fcc0a0b5eaa7022009e42ebcb67a2 42a7f58197e207e7f1163c3c3c68555a163531226522efb667732b1b38b87337
| Analyzer | Verdict | Alert |
|---|
| VirusTotal | suspicious | |
GET /uploads/2/7/0/5/2705468/sip-alg-detector.exe HTTP/1.1
Host: www.usvox.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 09 Jul 2024 19:12:18 GMT
content-type: application/x-dosexec
content-length: 2925190
cf-ray: 8a0a9ff4cc5ed937-HEL
cf-cache-status: BYPASS
accept-ranges: bytes
access-control-allow-origin: *
etag: "ce9992bfba046094928d31db81e78dc6"
last-modified: Sat, 06 Apr 2024 21:32:09 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, Authorization, Content-Type
access-control-allow-methods: GET, POST, DELETE, OPTIONS
x-amz-id-2: QsAERMDNeglh+6Fy3cp8vlSYhgo3eIR7Y9q87FbgBq29qQqCVfy1muH2kBZK2u3jGVfEG2ZV7R4=
x-amz-meta-btime: 2020-06-19T17:35:36.825Z
x-amz-meta-mtime: 1592588136.825
x-amz-replication-status: COMPLETED
x-amz-request-id: XDAF5THFM0HB88DG
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-version-id: NHMJTmR5E_NMitcXEZgMSVwWYcFYjTyP
x-storage-bucket: z42a7
x-storage-object: 42a7f58197e207e7f1163c3c3c68555a163531226522efb667732b1b38b87337
set-cookie: __cf_bm=c_jUwsmCzDgqAvoql2PH1oXynsoBs65o7VdDGETGVfA-1720552338-1.0.1.1-60ZvOKO.v4DsWcAJSvQV.6Z3Wu.aQFPmTtMYJ.7yimfV0Lx3qHEviMivXLrwscGLZf6NQHSV_1KC75gW0K2pnQ; path=/; expires=Tue, 09-Jul-24 19:42:18 GMT; domain=.www.usvox.com; HttpOnly; Secure; SameSite=None
server: cloudflare
X-Firefox-Spdy: h2
|