Report - pool.cn.com/tunnel/xna.zip

Report Overview

Submitted URL
pool.cn.com/tunnel/xna.zip
IP
47.129.4.240
ASN
#16509 AMAZON-02
Submitted
2024-04-17 17:02:40
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.trust-provider.cn	unknown	2015-04-09	2022-02-10	2024-04-17	334 B	1.4 kB	36.248.38.100
pool.cn.com	unknown	2022-08-24	2021-05-13	2023-11-19	480 B	3.6 MB	47.129.4.240

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
pool.cn.com/tunnel/xna.zip
IP
47.129.4.240
ASN
#16509 AMAZON-02

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
3.6 MB (3649072 bytes)
Hash
51384990e1b478350d32464ff4f1796f
6572e9df67529938eb3e5e171c0d8b703237349f
91da1e19d3f879f3940455f9dcf52a29ea795f6266a35e676c51884fd6f083f5

Archive (2)

Filename

Md5

File type

xna.exe

0764f12ef9d04a75c5980397a6675ba8

PE32+ executable (console) x86-64, for MS Windows, 3 sections

��ڿ�˵��.txt

9c5aacc716c8277d348bb31fb44d3b80

Unicode text, UTF-8 text

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects mining pool protocol string in Executable

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	ocsp.trust-provider.cn/	36.248.38.100		600 B
URL ocsp.trust-provider.cn/ IP 36.248.38.100:0 ASN #4837 CHINA UNICOM China169 Backbone File type data Size 600 B (600 bytes) Hash 4f0557c571252c18709e9439323f34b1 cd840629fc289a873884a91f080ce1b84a753f03 07cb526ea16a2c256a53a3ab453f9dfddc5c6cde9cb1d571c35cf737a2a90bb1 HTTP Headers `POST / HTTP/1.1 Host: ocsp.trust-provider.cn User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 84 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 200 OK Server: volc-dcdn Content-Type: application/ocsp-response Content-Length: 600 Connection: keep-alive date: Wed, 17 Apr 2024 17:02:15 GMT expires: Wed, 24 Apr 2024 00:48:22 GMT cache-control: max-age=3600 x-ccacdn-proxy-id: scdpinlb6 cf-cache-status: EXPIRED accept-ranges: bytes cf-ray: 87588dd22ced9e26-SIN etag: "cd840629fc289a873884a91f080ce1b84a753f03" ctl-cache-status: HIT from sg-singapore2-ca13, HIT from fj-quanzhou7-ca59, MISS from js-nanjing1-ca24 x-frame-options: SAMEORIGIN request-id: 662000967fe684d489dd53eb652abed4 age: 2 last-modified: Wed, 17 Apr 2024 00:48:23 GMT via: n172-013-213.fzmp.ToB x-request-ip: 91.90.42.154 x-tt-trace-tag: id=5 x-dsa-trace-id: 17133733349fd8ec1ce80dbc549e6103dc3a43efbf X-Dsa-Origin-Status: 200 server-timing: cdn-cache;desc=MISS, origin;dur=488, edge;dur=0

	pool.cn.com/tunnel/xna.zip	47.129.4.240	200 OK	3.6 MB
URL User Request GET HTTP/2 pool.cn.com/tunnel/xna.zip IP 47.129.4.240:443 ASN #16509 AMAZON-02 Certificate IssuerTrustAsia Technologies, Inc. Subjectpool.cn.com Fingerprint15:3C:E0:1B:D8:37:BF:7D:64:07:E8:51:09:5C:F8:11:9A:E3:1C:65 ValidityFri, 22 Dec 2023 00:00:00 GMT - Sat, 21 Dec 2024 23:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 3.6 MB (3649072 bytes) Hash 51384990e1b478350d32464ff4f1796f 6572e9df67529938eb3e5e171c0d8b703237349f 91da1e19d3f879f3940455f9dcf52a29ea795f6266a35e676c51884fd6f083f5 HTTP Headers `GET /tunnel/xna.zip HTTP/1.1 Host: pool.cn.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK server: nginx date: Wed, 17 Apr 2024 17:02:15 GMT content-type: application/zip content-length: 3649072 last-modified: Tue, 02 Jan 2024 13:34:47 GMT etag: "659410f7-37ae30" strict-transport-security: max-age=31536000 cache-control: no-cache accept-ranges: bytes X-Firefox-Spdy: h2`

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (2)

Detections

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers