Overview

URL khit.cn/xiazai/CPU-Z@36_1_160.exe
IP220.243.193.128
ASN
Location China
Report completed2017-08-19 22:18:42 CEST
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2017-08-19 22:18:08 CEST 3  220.243.193.128 Client IP ET INFO EXE - Served Attached HTTP
2017-08-19 22:18:09 CEST 3  220.243.193.128 Client IP ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
2017-08-19 22:18:08 CEST 1  220.243.193.128 Client IP ET POLICY PE EXE or DLL Windows file download HTTP


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2017-08-19 2 khit.cn/xiazai/CPU-Z@36_1_160.exe Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 220.243.193.128

Date UQ / IDS / BL URL IP
2017-11-21 07:28:57 +0100
0 - 1 - 0 ime.files2.sogou.com/sogou_pinyin_6.5.0.9181a.exe 220.243.193.128
2017-11-21 04:23:23 +0100
0 - 3 - 1 khit.cn/xiazai/adobe%20flash%20player@74_1_18.exe 220.243.193.128
2017-11-19 18:27:12 +0100
0 - 2 - 0 saas.lenovo.net/sf/LenovoPCManager.exe 220.243.193.128
2017-11-19 18:17:12 +0100
0 - 2 - 0 saas.lenovo.net/sf/LenovoPCManager.exe 220.243.193.128
2017-11-19 18:04:40 +0100
0 - 0 - 1 d.info525.com/download/apks/V11/dengshanbiaoc (...) 220.243.193.128
2017-11-19 17:11:07 +0100
0 - 3 - 0 xzq.1230578.com/xiazai/GreenBrowser%E6%B5%8F% (...) 220.243.193.128
2017-11-19 15:01:55 +0100
0 - 1 - 0 wcdn.servyou.com.cn/update2/zxm/appCenter/ins (...) 220.243.193.128
2017-11-19 11:38:43 +0100
0 - 3 - 1 khit.cn/xiazai/v4.3.3.%20%E5%85%8D%E8%B4%B80% (...) 220.243.193.128
2017-11-19 05:06:52 +0100
0 - 3 - 0 xzq.1230578.com/xiazai/%E6%89%B9%E9%87%8F%E5% (...) 220.243.193.128
2017-11-19 04:11:12 +0100
0 - 3 - 1 khit.cn/xiazai/v4.3.3.%20%E5%85%8D%E8%B4%B80% (...) 220.243.193.128

Last 10 reports on ASN:

Date UQ / IDS / BL URL IP
2017-11-21 15:01:52 +0100
0 - 0 - 0 newsletter.knowbe4.com/a/1022/click/585/22811 (...) 146.20.94.106
2017-11-21 15:01:39 +0100
0 - 0 - 0 https://live-watchus.com/marquette-golden-eag (...) 198.54.115.181
2017-11-21 15:00:59 +0100
0 - 0 - 0 www.wellsf-username.cf/ 195.22.126.159
2017-11-21 14:59:53 +0100
0 - 0 - 0 https://fireflyfestival.com/message-board/?to (...) 52.206.45.150
2017-11-21 14:59:19 +0100
0 - 0 - 1 www.sharpsburg.com/community/rest-and-relaxat (...) 37.60.255.213
2017-11-21 14:56:49 +0100
0 - 0 - 1 empty.townbeef.bid/h_redir.php?offer_id=4 13.32.66.152
2017-11-21 14:56:35 +0100
0 - 0 - 1 yjelm.instagirlsonline.com/c/679efeecdc3b4d07? 52.211.95.198
2017-11-21 14:56:31 +0100
0 - 0 - 1 yjelm.instagirlsonline.com/c/679efeecdc3b4d07? 52.211.95.198
2017-11-21 14:54:34 +0100
0 - 0 - 0 https://mailtrack.io/trace/mail/03fa7fd=%2050 (...) 52.48.210.134
2017-11-21 14:53:01 +0100
0 - 0 - 0 52.203.79.102 52.203.79.102

Last 10 reports on domain: .

Date UQ / IDS / BL URL IP
2017-11-21 04:23:23 +0100
0 - 3 - 1 khit.cn/xiazai/adobe%20flash%20player@74_1_18.exe 220.243.193.128
2017-11-19 11:38:43 +0100
0 - 3 - 1 khit.cn/xiazai/v4.3.3.%20%E5%85%8D%E8%B4%B80% (...) 220.243.193.128
2017-11-19 04:11:12 +0100
0 - 3 - 1 khit.cn/xiazai/v4.3.3.%20%E5%85%8D%E8%B4%B80% (...) 220.243.193.128
2017-11-19 01:33:12 +0100
0 - 0 - 2 xz.khit.cn/332 220.243.193.128
2017-11-15 19:07:02 +0100
0 - 3 - 0 xz.khit.cn/354/setup_20010.exe 220.243.193.128
2017-11-12 21:46:00 +0100
0 - 0 - 2 xz.khit.cn/335 220.243.193.128
2017-11-11 20:32:48 +0100
0 - 0 - 1 xz.khit.cn/170/Setup_120.exe 220.243.193.128
2017-11-10 21:05:44 +0100
0 - 0 - 1 khit.cn/ikuaiping.exe 220.243.193.128
2017-11-05 18:59:29 +0100
0 - 0 - 1 xz.khit.cn/215/Setup_20010.exe 220.243.193.128
2017-11-04 06:02:20 +0100
0 - 4 - 1 xz.khit.cn/120/SETUP_20010.EXE 220.243.193.128


JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (1)


Request Response
                                        
                                            GET /xiazai/CPU-Z@36_1_160.exe HTTP/1.1 
Host: khit.cn
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         220.243.193.128
HTTP/1.1 200 OK
Content-Type: application/octet-stream; name=CPU-Z@36_1_160.exe
                                        
Date: Mon, 07 Aug 2017 22:30:02 GMT
Transfer-Encoding: chunked
X-Powered-By: PHP/5.3.3
Accept-Ranges: bytes
Accept-Length: 959768
Content-Transfer-Encoding: binary
Content-Disposition: attachment; filename=CPU-Z@36_1_160.exe
Age: 1028886
Via: 1.1 zhj23:4 (Cdn Cache Server V2.0)[118 200 2], 1.1 changzhoudianxin62:3 (Cdn Cache Server V2.0)[0 200 0], 1.1 lundun34:8 (Cdn Cache Server V2.0)[21 200 0]
Connection: keep-alive


--- Additional Info ---
Magic:  PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size:   959768
Md5:    2c9b4880a02bb5860c8578d77ddd5ce7
Sha1:   6febe51711a788d8599abb1fb80ca03795522bc7
Sha256: 2aeb8f42645ed5f0096777edaaeb75706df7f5238ebd51c16e6fb943287dda06

Alerts:
  Blacklists:
    - fortinet: Malware
  IDS:
    - ET INFO EXE - Served Attached HTTP
    - ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
    - ET POLICY PE EXE or DLL Windows file download HTTP