Overview

URLhttp://dlm.mail.ru/lite4/setup/flash-update_28726944_1.exe
IP217.69.134.205
ASNAS47764 Limited liability company Mail.Ru
Location Russian Federation
Report completed2012-10-30 04:40:30 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro No alerts detected
Snort /w Sourcefire VRT
Timestamp Source IP Destination IP Severity Alert
2012-10-30 04:39:54 217.69.134.205 urlQuery Client3FILE-IDENTIFY Portable Executable binary file magic detected
2012-10-30 04:39:54 217.69.134.205 urlQuery Client1FILE-IDENTIFY download of executable content
2012-10-30 04:39:55 217.69.134.205 urlQuery Client3FILE-IDENTIFY Ultimate Packer for Executables/UPX v0.62-v1.22 packed file magic detected


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 217.69.134.205

Date Alerts / IDS URL IP
2013-02-09 13:25:060 / 8http://dlt.mail.ru/output/classic/00/a4/a8/61/anti-afk_v2.exe217.69.134.205
2013-02-02 08:51:410 / 4http://dlt3.mail.ru/output/setup/00/10/5c/9a/firefoxsetup.exe217.69.134.205
2013-02-02 08:21:220 / 2http://dlt.mail.ru/output/classic/00/ba/37/be/mirtankov_su_res_mods.exe217.69.134.205
2013-01-30 11:03:300 / 1http://dlt.mail.ru/output/classic/00/9b/e3/a8/ostorojno_shkololo.exe217.69.134.205
2013-01-29 05:38:440 / 3http://dlt.mail.ru/output/torrent/00/b6/1a/1c/529594.exe217.69.134.205
2013-01-29 05:37:440 / 3http://dlt3.mail.ru/output/archive/00/00/00/a9/tbelok.exe217.69.134.205

Last 6 reports on ASN: AS47764 Limited liability company Mail.Ru

Date Alerts / IDS URL IP
2013-02-13 23:34:320 / 0http://my.mail.ru/mail/lenchikti94.100.184.40
2013-02-12 21:17:280 / 1http://178.237.25.135/178.237.25.135
2013-02-12 09:26:110 / 0http://my.mail.ru/mail/lenchikti94.100.184.41
2013-02-11 18:39:040 / 3http://dlp1.mail.ru/output/t6urrxw8kuw8rowvrvxrarwulqrgkeysc5tro6gla74g/00/f1/dd/df/torrent/sum (...)217.69.135.240
2013-02-10 20:43:230 / 0http://d3.c2.b2.a1.top.mail.ru/counter?id=1188751;t=230;js=13;r=;j=true;s=1152*864;d=32;rand=0. (...)217.69.134.122
2013-02-10 16:06:240 / 1http://www.icq.com/icqchat/popup.php?Uin=170884960178.237.23.237

Last 6 reports on domain: dlm.mail.ru

Date Alerts / IDS URL IP
2013-01-24 03:00:330 / 3http://dlm.mail.ru/lite4/archive/u-7imate_35530583_1.exe217.69.134.205
2013-01-24 02:45:520 / 4http://dlm.mail.ru/lite4/classic/minecraft_30522981_1.exe217.69.134.205
2013-01-15 10:41:250 / 4http://dlm.mail.ru/lite4/archive/qp0ivw26n_34751659_1.exe217.69.134.205
2013-01-15 08:02:490 / 4http://dlm.mail.ru/lite4/setup/utorrent_34655270_1.exe217.69.134.205
2013-01-12 12:21:520 / 7http://dlm.mail.ru/lite4/archive/beeline_iptv_player_24592073_1.exe217.69.134.205
2012-12-21 11:04:030 / 4http://dlm.mail.ru/lite4/torrent/fear_20745_20by_20_28_smile_29_33103809_1.exe=217.69.134.205



JavaScript

Executed Scripts (1)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (1)


Request Response 
GET /lite4/setup/flash-update_28726944_1.exe HTTP/1.1

Host: dlm.mail.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: application/octet-stream

Server: nginx
Date: Tue, 30 Oct 2012 03:39:54 GMT
Content-Length: 73808
Last-Modified: Wed, 26 Sep 2012 07:50:34 GMT
Connection: keep-alive
Accept-Ranges: bytes