Overview

URL khit.cn/xiazai/CPU-Z@36_1_160.exe
IP220.243.193.128
ASN
Location China
Report completed2017-08-19 22:18:42 CEST
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2017-08-19 22:18:08 CEST 3  220.243.193.128 Client IP ET INFO EXE - Served Attached HTTP
2017-08-19 22:18:09 CEST 3  220.243.193.128 Client IP ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
2017-08-19 22:18:08 CEST 1  220.243.193.128 Client IP ET POLICY PE EXE or DLL Windows file download HTTP


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2017-08-19 2 khit.cn/xiazai/CPU-Z@36_1_160.exe Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 220.243.193.128

Date UQ / IDS / BL URL IP
2018-02-23 07:06:50 +0100
0 - 0 - 2 client.dl.126.net/androidmail/dashi/4/mail.apk 220.243.193.128
2018-02-20 20:23:32 +0100
0 - 0 - 1 xz.job391.com/down/adobephotoshopcc2015@89_1_ (...) 220.243.193.128
2018-02-20 16:03:18 +0100
0 - 0 - 1 xz.job391.com/ 220.243.193.128
2018-02-20 15:51:47 +0100
0 - 0 - 1 xzq.1230578.com/ 220.243.193.128
2018-02-20 15:51:33 +0100
0 - 0 - 1 xz.khit.cn/ 220.243.193.128
2018-02-16 15:39:59 +0100
0 - 0 - 1 xz.job391.com/down/adobephotoshopcc2015@89_1_ (...) 220.243.193.128
2018-02-16 02:48:22 +0100
0 - 0 - 0 codown.youdao.com/cidian/YoudaoDict_webdict_d (...) 220.243.193.128
2018-02-14 20:06:36 +0100
0 - 0 - 1 down3.pipaw.net/hy/jesyjh_1_2018.apk?time=151 (...) 220.243.193.128
2018-02-12 12:55:37 +0100
0 - 0 - 1 client.dl.126.net/androidmail/dashi/4/mail.apk 220.243.193.128
2018-02-11 00:54:13 +0100
0 - 0 - 1 down3.pipaw.net/hy/jesyjh_1_2018.apk?time=151 (...) 220.243.193.128

Last 10 reports on ASN:

Date UQ / IDS / BL URL IP
2018-02-23 09:07:25 +0100
2 - 0 - 0 gamzones.com/th/108/WallpaperAIS_th_wifi/?ref (...) 147.135.254.158
2018-02-23 09:04:56 +0100
0 - 0 - 0 ssmetal.com.br/ 179.127.80.5
2018-02-23 09:03:31 +0100
0 - 0 - 0 huawei.com 45.249.212.124
2018-02-23 08:55:48 +0100
0 - 0 - 0 185.220.35.20 185.220.35.20
2018-02-23 08:55:24 +0100
0 - 0 - 0 www.oasgames.com/gamebox/time.php 52.84.213.182
2018-02-23 08:50:54 +0100
0 - 0 - 0 https://larafilling.tumblr.com/kitaixfzqw 66.6.32.21
2018-02-23 08:48:39 +0100
0 - 0 - 1 www.driverupdate.net/update.php?rpcvi=5.3.0|2 (...) 34.236.31.105
2018-02-23 08:47:24 +0100
0 - 0 - 0 https://www.field-logic.com/AuditSystem/Accou (...) 149.97.133.9
2018-02-23 08:40:15 +0100
0 - 0 - 0 https://pis.ee/5AJ3N 34.236.193.170
2018-02-23 08:38:13 +0100
1 - 0 - 0 kmsf98alk2mci0ql1.servepics.com/FKEkcGg8/QvgH (...) 0.0.0.0

Last 10 reports on domain: .

Date UQ / IDS / BL URL IP
2018-02-20 15:51:33 +0100
0 - 0 - 1 xz.khit.cn/ 220.243.193.128
2018-01-24 20:15:47 +0100
0 - 0 - 1 khit.cn/xiazai/%E9%85%B7%E7%8B%97%E9%9F%B3khi (...) 220.243.193.128
2018-01-23 21:03:48 +0100
0 - 0 - 1 xz.khit.cn/250/Setup_113.exe 220.243.193.128
2018-01-22 20:51:18 +0100
0 - 0 - 2 xz.khit.cn/306 220.243.193.128
2018-01-22 20:32:46 +0100
0 - 0 - 2 xz.khit.cn/211 220.243.193.128
2018-01-21 20:46:51 +0100
0 - 0 - 1 xz.khit.cn/142 220.243.193.128
2018-01-19 20:53:00 +0100
0 - 0 - 2 xz.khit.cn/156 220.243.193.128
2018-01-19 20:52:06 +0100
0 - 0 - 1 xz.khit.cn/282/Setup_118.exe 220.243.193.128
2018-01-19 05:50:47 +0100
0 - 0 - 1 khit.cn/down/mozillafirefox@89_1_82234.exe 220.243.193.128
2018-01-18 20:16:55 +0100
0 - 0 - 2 xz.khit.cn/214 220.243.193.128


JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (1)


Request Response
                                        
                                            GET /xiazai/CPU-Z@36_1_160.exe HTTP/1.1 
Host: khit.cn
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         220.243.193.128
HTTP/1.1 200 OK
Content-Type: application/octet-stream; name=CPU-Z@36_1_160.exe
                                        
Date: Mon, 07 Aug 2017 22:30:02 GMT
Transfer-Encoding: chunked
X-Powered-By: PHP/5.3.3
Accept-Ranges: bytes
Accept-Length: 959768
Content-Transfer-Encoding: binary
Content-Disposition: attachment; filename=CPU-Z@36_1_160.exe
Age: 1028886
Via: 1.1 zhj23:4 (Cdn Cache Server V2.0)[118 200 2], 1.1 changzhoudianxin62:3 (Cdn Cache Server V2.0)[0 200 0], 1.1 lundun34:8 (Cdn Cache Server V2.0)[21 200 0]
Connection: keep-alive


--- Additional Info ---
Magic:  PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size:   959768
Md5:    2c9b4880a02bb5860c8578d77ddd5ce7
Sha1:   6febe51711a788d8599abb1fb80ca03795522bc7
Sha256: 2aeb8f42645ed5f0096777edaaeb75706df7f5238ebd51c16e6fb943287dda06

Alerts:
  Blacklists:
    - fortinet: Malware
  IDS:
    - ET INFO EXE - Served Attached HTTP
    - ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
    - ET POLICY PE EXE or DLL Windows file download HTTP