Overview

URLhttp://dlm.mail.ru/lite/setup/adguard_19367140_1.exe
IP217.69.134.205
ASNAS47764 Limited liability company Mail.Ru
Location Russian Federation
Report completed2012-10-30 07:51:45 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro No alerts detected
Snort /w Sourcefire VRT
Timestamp Source IP Destination IP Severity Alert
2012-10-30 07:51:10 217.69.134.205 urlQuery Client1FILE-IDENTIFY download of executable content
2012-10-30 07:51:10 217.69.134.205 urlQuery Client3FILE-IDENTIFY Portable Executable binary file magic detected
2012-10-30 07:51:11 217.69.134.205 urlQuery Client3FILE-IDENTIFY Ultimate Packer for Executables/UPX v0.62-v1.22 packed file magic detected


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 217.69.134.205

Date Alerts / IDS URL IP
2013-02-17 19:15:400 / 0http://dlm.mail.ru/about/217.69.134.205
2013-02-09 13:25:060 / 8http://dlt.mail.ru/output/classic/00/a4/a8/61/anti-afk_v2.exe217.69.134.205
2013-02-02 08:51:410 / 4http://dlt3.mail.ru/output/setup/00/10/5c/9a/firefoxsetup.exe217.69.134.205
2013-02-02 08:21:220 / 2http://dlt.mail.ru/output/classic/00/ba/37/be/mirtankov_su_res_mods.exe217.69.134.205
2013-01-30 11:03:300 / 1http://dlt.mail.ru/output/classic/00/9b/e3/a8/ostorojno_shkololo.exe217.69.134.205
2013-01-29 05:38:440 / 3http://dlt.mail.ru/output/torrent/00/b6/1a/1c/529594.exe217.69.134.205

Last 6 reports on ASN: AS47764 Limited liability company Mail.Ru

Date Alerts / IDS URL IP
2013-02-17 19:15:400 / 0http://dlm.mail.ru/about/217.69.134.205
2013-02-17 18:57:320 / 1http://binupdate.mail.ru/dwnld/url?u=http://tochnye-inzhenernye-nauki.knigi-i-zhurnaly.org/data (...)217.69.133.27
2013-02-17 13:44:210 / 1http://video.mail.ru/mail/selcuk3700/_myvideo/119.html?autoplay=194.100.187.64
2013-02-15 23:49:120 / 1http://178.237.25.135/178.237.25.135
2013-02-13 23:34:320 / 0http://my.mail.ru/mail/lenchikti94.100.184.40
2013-02-12 21:17:280 / 1http://178.237.25.135/178.237.25.135

Last 6 reports on domain: dlm.mail.ru

Date Alerts / IDS URL IP
2013-02-17 19:15:400 / 0http://dlm.mail.ru/about/217.69.134.205
2013-01-24 03:00:330 / 3http://dlm.mail.ru/lite4/archive/u-7imate_35530583_1.exe217.69.134.205
2013-01-24 02:45:520 / 4http://dlm.mail.ru/lite4/classic/minecraft_30522981_1.exe217.69.134.205
2013-01-15 10:41:250 / 4http://dlm.mail.ru/lite4/archive/qp0ivw26n_34751659_1.exe217.69.134.205
2013-01-15 08:02:490 / 4http://dlm.mail.ru/lite4/setup/utorrent_34655270_1.exe217.69.134.205
2013-01-12 12:21:520 / 7http://dlm.mail.ru/lite4/archive/beeline_iptv_player_24592073_1.exe217.69.134.205



JavaScript

Executed Scripts (1)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (1)


Request Response 
GET /lite/setup/adguard_19367140_1.exe HTTP/1.1

Host: dlm.mail.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: application/octet-stream

Server: nginx
Date: Tue, 30 Oct 2012 06:51:10 GMT
Content-Length: 71760
Last-Modified: Wed, 15 Aug 2012 13:10:06 GMT
Connection: keep-alive
Accept-Ranges: bytes