Report - products.pfannenbergchina.com/media/f6/e7/cb/1700215482/Drawing_DWG_DTS_8031E.zip

Report Overview

Submitted URL
products.pfannenbergchina.com/media/f6/e7/cb/1700215482/Drawing_DWG_DTS_8031E.zip
IP
163.228.226.193
ASN
#58593 Shanghai Blue Cloud Technology Co.,Ltd
Submitted
2024-05-07 10:27:45
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
products.pfannenbergchina.com	unknown	2017-08-30	2023-12-27	2023-12-27	535 B	331 kB	163.228.226.193
ocsp.trust-provider.cn	unknown	2015-04-09	2022-02-10	2024-05-06	668 B	2.9 kB	112.50.95.96

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
products.pfannenbergchina.com/media/f6/e7/cb/1700215482/Drawing_DWG_DTS_8031E.zip
IP
163.228.226.193
ASN
#58593 Shanghai Blue Cloud Technology Co.,Ltd

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
331 kB (330727 bytes)
Hash
755d9d6ab4cfa677f9cd7810b422d61d
56552f6688faa90acd3313e2f289c7dadb9c53ff
3bdcfabea4dc1a89dcb1884b2a8ebe1d6a37c58dc699064100f1f3d1678a4269

Archive (1)

Filename

Md5

File type

Drawing_DWG_DTS8031E.DWG

650f6d203714f06e9ce0a1f331694b0e

DWG AutoDesk AutoCAD 2013-2017

Detections

Analyzer	Verdict	Alert
Public InfoSec YARA rules	malware	Identifies OLE files embedded in AutoCAD and related Autodesk files, quite uncommon and potentially malicious.

JavaScript (0)

HTTP Transactions (3)

	URL	IP	Response	Size
	ocsp.trust-provider.cn/	112.50.95.96		599 B
URL ocsp.trust-provider.cn/ IP 112.50.95.96:0 ASN #9808 China Mobile Communications Group Co., Ltd. File type data Size 599 B (599 bytes) Hash 5b5af04616a476e04a2c8a8153def4a4 ffc3ea44f994238a7f1401fb8b409fdffd9cb399 aa6b11bf2cc9f9ba4f0e721ed45f98632d2043bc4c31d063284c012801b783db HTTP Headers `POST / HTTP/1.1 Host: ocsp.trust-provider.cn User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 200 OK Server: volc-dcdn Content-Type: application/ocsp-response Content-Length: 599 Connection: keep-alive vary: Accept-Encoding request-id: 663a02097b6f0a842b7c0b9cda11eca4 last-modified: Sun, 05 May 2024 16:56:17 GMT age: 1 etag: "ffc3ea44f994238a7f1401fb8b409fdffd9cb399" date: Tue, 07 May 2024 10:27:22 GMT ctl-cache-status: HIT from hk-xianggang4-ca01, HIT from fj-quanzhou7-ca31, HIT from he-baoding2-ca04 cache-control: max-age=3600 accept-ranges: bytes x-frame-options: SAMEORIGIN expires: Sun, 12 May 2024 16:56:16 GMT cf-cache-status: EXPIRED x-ccacdn-proxy-id: scdpinlb4 cf-ray: 87f529591f3584ee-HKG via: n172-013-213.fzmp.ToB x-request-ip: 91.90.42.154 x-tt-trace-tag: id=5 x-dsa-trace-id: 17150776416028e91c10f5e0ccf396748d7b4facc3 X-Dsa-Origin-Status: 200 server-timing: cdn-cache;desc=MISS, origin;dur=610, edge;dur=0

	ocsp.trust-provider.cn/	112.50.95.96		599 B
URL ocsp.trust-provider.cn/ IP 112.50.95.96:0 ASN #9808 China Mobile Communications Group Co., Ltd. File type data Size 599 B (599 bytes) Hash 5b5af04616a476e04a2c8a8153def4a4 ffc3ea44f994238a7f1401fb8b409fdffd9cb399 aa6b11bf2cc9f9ba4f0e721ed45f98632d2043bc4c31d063284c012801b783db HTTP Headers `POST / HTTP/1.1 Host: ocsp.trust-provider.cn User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 200 OK Server: volc-dcdn Content-Type: application/ocsp-response Content-Length: 599 Connection: keep-alive last-modified: Sun, 05 May 2024 16:56:17 GMT accept-ranges: bytes ctl-cache-status: HIT from hk-xianggang4-ca01, HIT from fj-quanzhou7-ca31, HIT from he-baoding2-ca04 etag: "ffc3ea44f994238a7f1401fb8b409fdffd9cb399" expires: Sun, 12 May 2024 16:56:16 GMT cache-control: max-age=3600 request-id: 663a02096cc0102cac7bde5c5e69756b date: Tue, 07 May 2024 10:27:22 GMT cf-ray: 87f529591f3584ee-HKG x-ccacdn-proxy-id: scdpinlb4 age: 0 x-frame-options: SAMEORIGIN vary: Accept-Encoding cf-cache-status: EXPIRED via: n172-013-214.fzmp.ToB x-request-ip: 91.90.42.154 x-tt-trace-tag: id=5 x-dsa-trace-id: 171507764151a82948090745954f7b21b7b929b43a X-Dsa-Origin-Status: 200 server-timing: cdn-cache;desc=MISS, origin;dur=637, edge;dur=0

	products.pfannenbergchina.com/media/f6/e7/cb/1700215482/Drawing_DWG_DTS_8031E.zip	163.228.226.193	200 OK	331 kB
URL User Request GET HTTP/1.1 products.pfannenbergchina.com/media/f6/e7/cb/1700215482/Drawing_DWG_DTS_8031E.zip IP 163.228.226.193:443 ASN #58593 Shanghai Blue Cloud Technology Co.,Ltd Certificate IssuerTrustAsia Technologies, Inc. Subject.pfannenbergchina.com Fingerprint37:CC:86:CD:46:45:DE:83:D8:7E:64:E9:66:BA:6D:EF:ED:31:7B:47 ValidityTue, 09 May 2023 00:00:00 GMT - Wed, 08 May 2024 23:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 331 kB (330727 bytes) Hash 755d9d6ab4cfa677f9cd7810b422d61d 56552f6688faa90acd3313e2f289c7dadb9c53ff 3bdcfabea4dc1a89dcb1884b2a8ebe1d6a37c58dc699064100f1f3d1678a4269 HTTP Headers GET /media/f6/e7/cb/1700215482/Drawing_DWG_DTS_8031E.zip HTTP/1.1 Host: products.pfannenbergchina.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Date: Tue, 07 May 2024 10:27:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Fri, 17 Nov 2023 10:04:42 GMT ETag: "50be7-60a5643e60c8e" Accept-Ranges: bytes Content-Length: 330727 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/zip`