Report - ininternet.org/download/mirc/sri025.zip%7C%3Eprogs/automatic/oob.exe

Report Overview

Visited public
2023-11-17 09:46:55
Tags
URL
ininternet.org/download/mirc/sri025.zip%7C%3Eprogs/automatic/oob.exe
Finishing URL
www.ininternet.org/download/mirc/sri025.zip|%3Eprogs/automatic/oob.exe
IP / ASN
31.11.33.24
#31034 Aruba S.p.A.
Title
IIS 8.5 Detailed Error - 404.0 - Not Found

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ininternet.org	unknown	2005-07-01	2015-03-14 15:00:00	2023-09-03 07:45:51	440 B	507 B	31.11.33.24
www.ininternet.org	unknown	2005-07-01	2012-12-08 20:33:09	2023-09-03 07:45:33	842 B	10 kB	31.11.33.24

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-17 09:46:39	medium	Client IP	31.11.33.24	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
2023-11-17 09:46:41	medium	Client IP	31.11.33.24	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (3)

URL IP Response Size

ininternet.org/download/mirc/sri025.zip%7C%3Eprogs/automatic/oob.exe

31.11.33.24

301 Moved Permanently

201 B

URL User Request GET HTTP/1.1
ininternet.org/download/mirc/sri025.zip%7C%3Eprogs/automatic/oob.exe
IP
31.11.33.24:80
ASN
#31034 Aruba S.p.A.

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text
Size
201 B (201 bytes)
Hash
7fbd1c70002f7cab7902e39e96784e9f
a298cc87ccdde038b8e350c42fb9e81689cae11f
d81a5e39644683754e14c43742d09e0cc8364e07cbd0e8e091f6fdacef6f5337

Detections

NIDS	Severity	Alert
suricata	medium	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

HTTP Headers

GET /download/mirc/sri025.zip%7C%3Eprogs/automatic/oob.exe HTTP/1.1
Host: ininternet.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: http://www.ininternet.org/download/mirc/sri025.zip|>progs/automatic/oob.exe
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
X-Aruba2-Cache: NA
X-Aruba-Cache: NA
Date: Fri, 17 Nov 2023 09:46:38 GMT
Content-Length: 201

www.ininternet.org/download/mirc/sri025.zip|%3Eprogs/automatic/oob.exe

31.11.33.24

404 Not Found

5.1 kB

URL User Request GET HTTP/1.1
www.ininternet.org/download/mirc/sri025.zip|%3Eprogs/automatic/oob.exe
IP
31.11.33.24:80
ASN
#31034 Aruba S.p.A.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (365)
Size
5.1 kB (5052 bytes)
Hash
d70986ab3640987548933638c330e861
89f04efd6e65d42d43eca935dc6dabc7f866b9b3
6ecb1ec22f98ac80884a48e517c0654dabfd2030a58b8057075219a9514249e9

Detections

NIDS	Severity	Alert
suricata	medium	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

HTTP Headers

GET /download/mirc/sri025.zip|%3Eprogs/automatic/oob.exe HTTP/1.1
Host: www.ininternet.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
X-Aruba2-Cache: NA
X-Aruba-Cache: NA
Date: Fri, 17 Nov 2023 09:46:40 GMT
Content-Length: 5052

www.ininternet.org/favicon.ico

31.11.33.24

404 Not Found

5.0 kB

URL GET HTTP/1.1
www.ininternet.org/favicon.ico
IP
31.11.33.24:80
ASN
#31034 Aruba S.p.A.

Requested by
http://www.ininternet.org/download/mirc/sri025.zip|%3Eprogs/automatic/oob.exe

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (365)
Size
5.0 kB (4970 bytes)
Hash
fb7918cf546e694d5e8f521a0b28d239
36e02a81c698e4b1366eb4201987ef3b9f73093b
f34c29ee9c826b88d9c9ea3d226f5c33f5fba9fc49b1b24cea41291beb018784

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.ininternet.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.ininternet.org/download/mirc/sri025.zip|%3Eprogs/automatic/oob.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
X-Aruba2-Cache: NA
X-Aruba-Cache: NA
Date: Fri, 17 Nov 2023 09:46:40 GMT
Content-Length: 4970

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (3)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers