Report - suakhoaketsattphcm.com/filial/AgenziaEntrate.zip

Report Overview

Submitted URL
suakhoaketsattphcm.com/filial/AgenziaEntrate.zip
IP
125.212.243.254
ASN
#38731 CHT Compamy Ltd
Submitted
2024-04-23 01:59:48
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
suakhoaketsattphcm.com	unknown	2020-07-02	2016-04-10	2024-04-17	775 B	7.5 kB	125.212.243.254

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

Files detected

URL
suakhoaketsattphcm.com/filial/AgenziaEntrate.zip
IP
125.212.243.254
ASN
#38731 CHT Compamy Ltd

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
517 B (517 bytes)
Hash
c0c960f69af072dca7a899767dee677c
3fd626a0c8f59dbd78b9f138da9a6d495850ab83
ff6c917c572fe95cf773aed882aa424dbee87946d6e1d5a55b429427a3b8d3e1

Archive (1)

Filename

Md5

File type

AgenziaEntrate.txt.url

fa22e9b39df76becbf397612d26353d3

MS Windows 95 Internet shortcut text (URL=<file://109.248.11.163/Agenzia/server.exe>), ASCII text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects remote SMB path for .URL persistence
VirusTotal	malicious	VirusTotal - Scan result 26/60

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

suakhoaketsattphcm.com/filial/AgenziaEntrate.zip

125.212.243.254

200 OK

517 B

URL User Request GET HTTP/2
suakhoaketsattphcm.com/filial/AgenziaEntrate.zip
IP
125.212.243.254:443
ASN
#38731 CHT Compamy Ltd

Certificate
IssuerLet's Encrypt
Subjectsuakhoaketsattphcm.com
FingerprintF3:48:2D:AB:B3:47:D8:E5:6A:BF:3F:DB:42:EF:69:62:33:03:9D:94
ValidityMon, 11 Mar 2024 16:11:50 GMT - Sun, 09 Jun 2024 16:11:49 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
517 B (517 bytes)
Hash
c0c960f69af072dca7a899767dee677c
3fd626a0c8f59dbd78b9f138da9a6d495850ab83
ff6c917c572fe95cf773aed882aa424dbee87946d6e1d5a55b429427a3b8d3e1

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 26/60

HTTP Headers

GET /filial/AgenziaEntrate.zip HTTP/1.1
Host: suakhoaketsattphcm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-type: application/zip
date: Wed, 10 Apr 2024 21:34:23 GMT
etag: "205-5f6f0b229d070"
last-modified: Wed, 15 Mar 2023 13:55:25 GMT
server: Apache/2
content-length: 517
X-Firefox-Spdy: h2

suakhoaketsattphcm.com/

125.212.243.254

6.4 kB

URL
suakhoaketsattphcm.com/
IP
125.212.243.254:0
ASN
#38731 CHT Compamy Ltd

Certificate
IssuerLet's Encrypt
Subjectsuakhoaketsattphcm.com
FingerprintF3:48:2D:AB:B3:47:D8:E5:6A:BF:3F:DB:42:EF:69:62:33:03:9D:94
ValidityMon, 11 Mar 2024 16:11:50 GMT - Sun, 09 Jun 2024 16:11:49 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (9381)
Size
6.4 kB (6445 bytes)
Hash
73d6db6605f14483d13b4e6daf5abefc
efe357b230d201a85e983574ef1f73d9c015b18a
568ca8e4084845ce7a1975d6fc3f1f44d5ff9b723b807c6d613141e8181e0fc2

HTTP Headers

GET / HTTP/1.1
Host: suakhoaketsattphcm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Length: 6445
Content-Type: text/html; charset=UTF-8
Date: Wed, 10 Apr 2024 21:34:22 GMT
Link: <http://suakhoaketsattphcm.com/wp-json/>; rel="https://api.w.org/"
Server: Apache/2
Vary: Accept-Encoding,User-Agent
X-Powered-By: PHP/7.4.33

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (1)

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers