| zerossl.ocsp.sectigo.com/ |  104.18.15.101 | | 315 B |
URL zerossl.ocsp.sectigo.com/ IP104.18.15.101:0
Hash81d263dd9ad631dc3dee2e4e02cf3c51 9ecb740c87f68c55bd9034a9e963f57a2828941a a4317adb1ed43943f3bd43cb67dbc1a1303b808ee11815c89b1110baf6f46abf
POST / HTTP/1.1
Host: zerossl.ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 01 Sep 2023 07:59:52 GMT
Content-Type: application/ocsp-response
Content-Length: 315
Connection: keep-alive
Last-Modified: Thu, 31 Aug 2023 06:53:13 GMT
Expires: Thu, 07 Sep 2023 06:53:12 GMT
Etag: "9ecb740c87f68c55bd9034a9e963f57a2828941a"
Cache-Control: max-age=513799,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7ffbf9edcc121c16-OSL
|
| GET lacsuk.co.uk/installer.exe |  185.11.145.254 | 200 OK | 260 kB |
URL User Request GET HTTP/1.1lacsuk.co.uk/installer.exe IP185.11.145.254:443 ASN#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA
CertificateIssuerZeroSSL Subjectlacsuk.co.uk Fingerprint15:AE:44:24:1E:D3:6D:B3:9A:B8:B9:5A:C3:1D:BA:72:24:81:D7:D2 ValidityWed, 16 Aug 2023 00:00:00 GMT - Tue, 14 Nov 2023 23:59:59 GMT
File typePE32 executable (console) Intel 80386, for MS Windows\012- data Size260 kB (260192 bytes) Hash0f10e8ddb4e52367c7574e3c4c61e54b 0d69d3d4bece48aea83e38047427f54f3ad4a54e 1e5bafb31b9caa2e4f304f626ab68d843bae4afac7f1b40560a1703ab255042b
| Analyzer | Verdict | Alert |
|---|
| YARAhub by abuse.ch | malware | meth_stackstrings | | VirusTotal | malicious | |
GET /installer.exe HTTP/1.1
Host: lacsuk.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: BlazingFastWeb
Date: Fri, 01 Sep 2023 08:00:44 GMT
Content-Type: application/x-msdownload
Content-Length: 260192
Connection: keep-alive
Last-Modified: Sat, 06 May 2023 19:53:19 GMT
Access-Control-Allow-Origin: *
Expires: Fri, 08 Sep 2023 08:00:44 GMT
Cache-Control: max-age=604800, public, must-revalidate
Accept-Ranges: bytes
|