Overview

URL khit.cn/xiazai/CPU-Z@36_1_160.exe
IP220.243.193.128
ASN
Location China
Report completed2017-08-19 22:18:42 CEST
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2017-08-19 22:18:08 CEST 3  220.243.193.128 Client IP ET INFO EXE - Served Attached HTTP
2017-08-19 22:18:09 CEST 3  220.243.193.128 Client IP ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
2017-08-19 22:18:08 CEST 1  220.243.193.128 Client IP ET POLICY PE EXE or DLL Windows file download HTTP


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2017-08-19 2 khit.cn/xiazai/CPU-Z@36_1_160.exe Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 220.243.193.128

Date UQ / IDS / BL URL IP
2017-09-25 05:45:47 +0200
0 - 0 - 1 khit.cn/down/adobe%20illustrator%20cs%C2%88:@ (...) 220.243.193.128
2017-09-25 05:45:44 +0200
0 - 0 - 1 khit.cn/xiazai/4v1.0pr@55_1_13254102.exe 220.243.193.128
2017-09-25 05:45:42 +0200
0 - 2 - 0 khit.cn/xiazai/flashfxp@89_1_129.exe 220.243.193.128
2017-09-25 05:45:42 +0200
0 - 0 - 1 khit.cn/xiazai/jingv2.8@55_1_13135795.exe 220.243.193.128
2017-09-24 09:37:54 +0200
0 - 0 - 1 xz.khit.cn/ 220.243.193.128
2017-09-24 08:18:29 +0200
0 - 0 - 1 soft.114lk.com/down/qqliveslm@2345_3449.exe 220.243.193.128
2017-09-23 07:03:23 +0200
0 - 0 - 1 khit.cn/xiazai/@74_1_80720.exe 220.243.193.128
2017-09-22 09:50:22 +0200
0 - 0 - 1 xz.job391.com/ 220.243.193.128
2017-09-21 05:53:18 +0200
0 - 0 - 1 khit.cn/xiazai/69c2017p2p17@89_1_3121.exe 220.243.193.128
2017-09-21 03:19:02 +0200
0 - 3 - 0 xzq.1230578.com/xiazai/MicrosoftOffice2010SP1 (...) 220.243.193.128

Last 10 reports on ASN:

Date UQ / IDS / BL URL IP
2017-09-25 10:05:25 +0200
0 - 0 - 0 https://www.facebook.com/events/2037451203154 (...) 157.240.17.35
2017-09-25 10:04:46 +0200
0 - 0 - 5 gamzones.com/au/136/Bgirls_au_wifi/?referrer=3363 147.135.143.32
2017-09-25 10:04:45 +0200
0 - 0 - 5 gamzones.com/au/156/UltimateDance_au_wifi/?re (...) 147.135.143.32
2017-09-25 10:04:21 +0200
0 - 0 - 1 www.teamtimes.xyz/ 185.125.217.18
2017-09-25 10:04:15 +0200
0 - 0 - 1 www.teamsynergy.xyz/ 185.125.217.18
2017-09-25 10:03:43 +0200
0 - 0 - 2 g5u.pw/a/30554/ahr0cdovl3d3dy5zzmrlz3lwdc5vcm (...) 91.134.157.122
2017-09-25 10:03:37 +0200
0 - 0 - 5 mtrackqwe.com/mt/v2a423b484y2u20354r2v234t2/? 34.194.81.221
2017-09-25 10:03:11 +0200
0 - 0 - 1 www.artmusicsongs.xyz/ 185.125.217.18
2017-09-25 10:02:55 +0200
0 - 0 - 0 https://zirluat1.ext.saas4.innoveo-skye.net/s (...) 52.48.24.175
2017-09-25 10:02:32 +0200
0 - 0 - 0 zagent1577.hola.org 147.135.220.237

Last 10 reports on domain: .

Date UQ / IDS / BL URL IP
2017-09-25 05:45:47 +0200
0 - 0 - 1 khit.cn/down/adobe%20illustrator%20cs%C2%88:@ (...) 220.243.193.128
2017-09-25 05:45:44 +0200
0 - 0 - 1 khit.cn/xiazai/4v1.0pr@55_1_13254102.exe 220.243.193.128
2017-09-25 05:45:42 +0200
0 - 2 - 0 khit.cn/xiazai/flashfxp@89_1_129.exe 220.243.193.128
2017-09-25 05:45:42 +0200
0 - 0 - 1 khit.cn/xiazai/jingv2.8@55_1_13135795.exe 220.243.193.128
2017-09-24 09:37:54 +0200
0 - 0 - 1 xz.khit.cn/ 220.243.193.128
2017-09-23 07:03:23 +0200
0 - 0 - 1 khit.cn/xiazai/@74_1_80720.exe 220.243.193.128
2017-09-21 05:53:18 +0200
0 - 0 - 1 khit.cn/xiazai/69c2017p2p17@89_1_3121.exe 220.243.193.128
2017-09-20 12:04:34 +0200
0 - 0 - 1 khit.cn/soft/rlfz.ini 220.243.193.128
2017-09-20 09:41:59 +0200
0 - 0 - 1 xz.khit.cn/ 220.243.193.128
2017-09-20 08:01:56 +0200
0 - 0 - 1 khit.cn/xiazai/samsungmagician@89_1_25140.exe 220.243.193.128


JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (1)


Request Response
                                        
                                            GET /xiazai/CPU-Z@36_1_160.exe HTTP/1.1 
Host: khit.cn
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         220.243.193.128
HTTP/1.1 200 OK
Content-Type: application/octet-stream; name=CPU-Z@36_1_160.exe
                                        
Date: Mon, 07 Aug 2017 22:30:02 GMT
Transfer-Encoding: chunked
X-Powered-By: PHP/5.3.3
Accept-Ranges: bytes
Accept-Length: 959768
Content-Transfer-Encoding: binary
Content-Disposition: attachment; filename=CPU-Z@36_1_160.exe
Age: 1028886
Via: 1.1 zhj23:4 (Cdn Cache Server V2.0)[118 200 2], 1.1 changzhoudianxin62:3 (Cdn Cache Server V2.0)[0 200 0], 1.1 lundun34:8 (Cdn Cache Server V2.0)[21 200 0]
Connection: keep-alive


--- Additional Info ---
Magic:  PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size:   959768
Md5:    2c9b4880a02bb5860c8578d77ddd5ce7
Sha1:   6febe51711a788d8599abb1fb80ca03795522bc7
Sha256: 2aeb8f42645ed5f0096777edaaeb75706df7f5238ebd51c16e6fb943287dda06

Alerts:
  Blacklists:
    - fortinet: Malware
  IDS:
    - ET INFO EXE - Served Attached HTTP
    - ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
    - ET POLICY PE EXE or DLL Windows file download HTTP