Overview

URL 25907.xc.05cg.com/xiaz/apimswincrtconiol110.dll%E5%85%8D%E8%B4%B9%E7%89%88@316_75042.exe
IP114.55.188.114
ASN
Location China
Report completed2018-12-16 14:39:19 CET
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2018-12-16 2 25907.xc.05cg.com/xiaz/apimswincrtconiol110.dll%E5%85%8D%E8%B4%B9%E7%89%88@ (...) Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 114.55.188.114

Date UQ / IDS / BL URL IP
2019-01-18 15:42:34 +0100
0 - 0 - 1 xc.05cg.com/xiaz/%E9%87%91%E5%BA%B8%E7%BE%A4% (...) 114.55.188.114
2019-01-18 15:27:52 +0100
0 - 4 - 1 url.tudown.com/down/%EF%BF%BD%EF%BF%BD%EF%BF% (...) 114.55.188.114
2019-01-18 15:27:46 +0100
0 - 4 - 1 url.tudown.com/down/QQ%20at%2034_63191.exe 114.55.188.114
2019-01-18 15:10:32 +0100
0 - 0 - 1 xc.05cg.com/xiaz/%E8%85%90%E7%83%82%E5%9B%BD% (...) 114.55.188.114
2019-01-18 15:03:06 +0100
0 - 0 - 1 26657.xc.wenpie.com26567.xc.gongnou.com26567. (...) 114.55.188.114
2019-01-18 15:02:54 +0100
0 - 0 - 1 26567.xc.gongnou.com26567.xc.gongnou.com26567 (...) 114.55.188.114
2019-01-18 14:51:53 +0100
0 - 0 - 1 15031.url.xaskm.com/down/@581_2.exe 114.55.188.114
2019-01-18 00:03:12 +0100
0 - 0 - 1 26677.xc.mieseng.com/ 114.55.188.114
2019-01-16 19:35:27 +0100
0 - 0 - 1 24996.xc.wenpie.com/index.php 114.55.188.114
2019-01-16 12:59:40 +0100
0 - 0 - 1 22979.xc.05cg.com/xiaz/%EF%BF%BD%D2%B5%EF%BF% (...) 114.55.188.114

Last 10 reports on ASN:

Date UQ / IDS / BL URL IP
2019-01-18 15:54:34 +0100
0 - 0 - 2 kientrucdep.club/Amazon/En/Clients_informatio (...) 45.117.160.21
2019-01-18 15:52:04 +0100
0 - 0 - 1 down.263209.com/cx/180806/2/HD3000@54_310-300 (...) 163.171.133.123
2019-01-18 15:52:03 +0100
0 - 0 - 1 stepsaweb.com/system/logs/uy78hn654e.exe 104.248.217.194
2019-01-18 15:51:59 +0100
0 - 2 - 1 down.263209.com/cx/180806/2/Microsoft@60_79402.exe 163.171.133.123
2019-01-18 15:51:57 +0100
0 - 0 - 2 azyx10.yxhcqy.com/wmscq_v1.0.apk 47.90.72.4
2019-01-18 15:51:45 +0100
0 - 0 - 1 down.263209.com/cx/180806/2/QQ3.7@75_21121.exe 163.171.133.123
2019-01-18 15:51:36 +0100
0 - 0 - 1 xzc.197746.com/Kalimba.apk 101.37.183.142
2019-01-18 15:51:26 +0100
0 - 0 - 0 www.evebot.cc 47.89.216.239
2019-01-18 15:51:21 +0100
0 - 0 - 2 yunlietou.com/my_list/uploadfile/2013/10/17/2 (...) 39.105.19.232
2019-01-18 15:51:00 +0100
0 - 0 - 1 down.263209.com/cx/180806/2/setup@60_48116.exe 163.171.133.123

No other reports on domain: 05cg.com



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (1)


Request Response
                                        
                                            GET /xiaz/apimswincrtconiol110.dll%E5%85%8D%E8%B4%B9%E7%89%88@316_75042.exe HTTP/1.1 
Host: 25907.xc.05cg.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         101.201.62.45
HTTP/1.1 200 OK
Content-Type: application/octet-stream
                                        
Date: Sun, 16 Dec 2018 13:38:51 GMT
Content-Length: 1344048
Connection: keep-alive
Content-Disposition: attachment; filename*="utf8''apimswincrtconiol110.dll免费版@316_75042.exe"


--- Additional Info ---
Magic:  PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size:   1344048
Md5:    f2e93ef7bb048942a11b780bc4000d32
Sha1:   6488fa3242f3dad4223fe051a533f19bf1eb5097
Sha256: 14601dcf44a395ed32c1b4bc149f101337b44bf10ea82c6d45a11b51c46a6747

Alerts:
  Blacklists:
    - fortinet: Malware