Report - cdn-celts.hz.vhk83.com/g73_cdn/20240430

Report Overview

Submitted URL
cdn-celts.hz.vhk83.com/g73_cdn/20240430_3/android/armeabi-v7a/hu.bin
IP
218.12.76.172
ASN
#4837 CHINA UNICOM China169 Backbone
Submitted
2024-05-08 16:58:25
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
status.rapidssl.com	6946	2002-04-05	2018-06-15	2024-05-07	331 B	642 B	192.229.221.95
cdn-celts.hz.vhk83.com	unknown	2020-07-23	2023-04-09	2023-10-04	960 B	20 MB	120.52.95.237

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
cdn-celts.hz.vhk83.com/g73_cdn/20240430_3/android/armeabi-v7a/hu.bin
IP
120.52.95.237
ASN
#133119 China Unicom IP network

File type
7-zip archive data, version 0.4
Size
20 MB (19943515 bytes)
Hash
78381dba201b2e4b8504ca2b448c8289
e0053969f2e6c84970767fa5a4ff5bf240b0c638
acf9fc0a5ed21d37625d03806f77bd75353ae6f52deeef6fcdbd61c37face3cd

Archive (2)

Filename

Md5

File type

Managed__Metadata__global-metadata.dat.bin

b1c64cf04c1685c7caf6423b0baa06c4

Zip archive data, at least v2.0 to extract, compression method=deflate

libil2cpp.so

30a667bcc901037a3341483073e6032b

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (3)

	URL	IP	Response	Size
	status.rapidssl.com/	192.229.221.95		471 B
URL status.rapidssl.com/ IP 192.229.221.95:0 ASN #15133 EDGECAST File type data Size 471 B (471 bytes) Hash dde522916b59e7152e5274951eb7a36d 37da81abe53e0172584a74c628a6f37a3e4f353a b358ee4f7c75de4302728462c0aa46939a5ba415fd782847be4cd60372d57f5a HTTP Headers `POST / HTTP/1.1 Host: status.rapidssl.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed, 08 May 2024 16:57:34 GMT Server: ECAcc (amb/6B53) Content-Length: 471`

	cdn-celts.hz.vhk83.com/g73_cdn/20240430_3/android/armeabi-v7a/hu.bin	120.52.95.237	200 OK	142 B
URL User Request GET HTTP/1.1 cdn-celts.hz.vhk83.com/g73_cdn/20240430_3/android/armeabi-v7a/hu.bin IP 120.52.95.237:80 ASN #133119 China Unicom IP network File type HTML document, ASCII text, with CRLF line terminators Size 142 B (142 bytes) Hash 82c98e8e012b79c922655461171cc2fa 0828d79135573276005b04be42d79a8a3291292b 745173bcc5c57ce9751dd019606e877e0aae13b60372fdb090f3db0470c3a43c HTTP Headers GET /g73_cdn/20240430_3/android/armeabi-v7a/hu.bin HTTP/1.1 Host: cdn-celts.hz.vhk83.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 08 May 2024 16:57:35 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: http://cdn-celts.hz.vhk83.com/g73_cdn/20240430_3/android/armeabi-v7a/hu.bin via: CHN-HElangfang-AREACUCC1-CACHE31[1]`

	cdn-celts.hz.vhk83.com/g73_cdn/20240430_3/android/armeabi-v7a/hu.bin	120.52.95.237	200 OK	20 MB
URL User Request GET HTTP/1.1 cdn-celts.hz.vhk83.com/g73_cdn/20240430_3/android/armeabi-v7a/hu.bin IP 120.52.95.237:80 ASN #133119 China Unicom IP network File type 7-zip archive data, version 0.4 Size 20 MB (19943515 bytes) Hash 78381dba201b2e4b8504ca2b448c8289 e0053969f2e6c84970767fa5a4ff5bf240b0c638 acf9fc0a5ed21d37625d03806f77bd75353ae6f52deeef6fcdbd61c37face3cd HTTP Headers `GET /g73_cdn/20240430_3/android/armeabi-v7a/hu.bin HTTP/1.1 Host: cdn-celts.hz.vhk83.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Wed, 08 May 2024 16:57:35 GMT Content-Type: application/octet-stream Content-Length: 19943515 Connection: keep-alive Server: openresty Last-Modified: Tue, 30 Apr 2024 11:24:15 GMT ETag: "8099cbeef09ada1:0" X-Powered-By: ASP.NET via: CHN-HElangfang-AREACUCC1-CACHE6[4],CHN-HElangfang-AREACUCC1-CACHE14[0,TCP_HIT,0],CHN-TJ-GLOBAL1-CACHE79[14],CHN-TJ-GLOBAL1-CACHE112[0,TCP_HIT,11] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 nginx-hit: 1 Age: 671884 Accept-Ranges: bytes`

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (2)

Detections

JavaScript (0)

HTTP Transactions (3)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers