Report - download.swjoy.com/sgzz3/sgzz3.exe

Report Overview

Submitted URL
download.swjoy.com/sgzz3/sgzz3.exe
IP
218.92.216.53
ASN
#4134 Chinanet
Submitted
2024-04-23 10:55:31
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
download.swjoy.com	unknown	2006-12-21	2016-02-03	2024-04-11	488 B	4.5 MB	218.92.216.53

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-04-23	medium	download.swjoy.com/sgzz3/sgzz3.exe	Find driver signed by suspicious company (see references)
2024-04-23	medium	download.swjoy.com/sgzz3/sgzz3.exe	Detect files is `SliverFox` malware

Files detected

URL
download.swjoy.com/sgzz3/sgzz3.exe
IP
218.92.216.53
ASN
#4134 Chinanet

File type
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
Size
4.5 MB (4546272 bytes)
Hash
028c406965341704f1dcdde650bb3cff
3c57330e71701dec88bd0051ef069cc2cab2dec6
c19d8e3b0ffb7c0b20aff509c9968d8f6f4ca182aa098cd71986153b0bfa0c71

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Find driver signed by suspicious company (see references)
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

download.swjoy.com/sgzz3/sgzz3.exe

218.92.216.53

200 OK

4.5 MB

URL User Request GET HTTP/2
download.swjoy.com/sgzz3/sgzz3.exe
IP
218.92.216.53:443
ASN
#4134 Chinanet

Certificate
IssuerGlobalSign nv-sa
Subject*.swjoy.com
FingerprintBC:0F:7B:0E:4F:8D:2E:D7:0F:7A:7F:9C:29:33:21:97:32:45:EC:FA
ValidityTue, 27 Feb 2024 09:50:46 GMT - Sun, 30 Mar 2025 09:50:45 GMT

File type
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
Size
4.5 MB (4546272 bytes)
Hash
028c406965341704f1dcdde650bb3cff
3c57330e71701dec88bd0051ef069cc2cab2dec6
c19d8e3b0ffb7c0b20aff509c9968d8f6f4ca182aa098cd71986153b0bfa0c71

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Find driver signed by suspicious company (see references)
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware

HTTP Headers

GET /sgzz3/sgzz3.exe HTTP/1.1
Host: download.swjoy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: marco/2.20
date: Tue, 23 Apr 2024 10:55:06 GMT
content-type: application/octet-stream
content-length: 4546272
x-source: C/200
x-slice-etag: 63f85455-455ee0
etag: "63f85455-455ee0"
x-slice-complete-length: 4546272
accept-ranges: bytes
last-modified: Fri, 24 Feb 2023 06:08:21 GMT
x-slice-size: 1048576
expires: Wed, 01 May 2024 10:54:43 GMT
cache-control: max-age=691200
x-request-id: 0f13c0ada5af035b0b5031c8103758a8; 0194bbebb805f4132fe95776377c23a3
age: 23
via: T.219.M, V.mix-js-taz1-223, T.7.H, M.ctn-js-ynz-011
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers