| redirect.wggames.cn/WGC/360_Wargaming_Game_Center_Install_WOWS_CN.exe?website=1&pub_id=wows_baidu_key_1819&xid=baidu/baidu-sem///1819&sid=SIDkNAShN_Q3rTrReMPiDswvPh_jOtCI8InD8VzGVQ0CWM4IVYEFvzncAlfXIKnJW22iIXWDeyoRWIpWH-8L5V-3RQCqLv58_crVoIgU3iY0XnVfirtfrpXjtbp1QpkDpMA1AanvmRxqAvvxA&enctid=cci2woq5a5f2&lpsn=+wows-wggames-cn-ddy12-html-website-1&foris=1&teclient=1625170630304888162&utm_source=sem_brand&utm_medium=sem&utm_campaign=ij2r99x4&utm_content=wows_baidu_key_1819 |  8.133.125.31 | 302 Moved Temporarily | 138 B |
URL User Request GET HTTP/1.1redirect.wggames.cn/WGC/360_Wargaming_Game_Center_Install_WOWS_CN.exe?website=1&pub_id=wows_baidu_key_1819&xid=baidu/baidu-sem///1819&sid=SIDkNAShN_Q3rTrReMPiDswvPh_jOtCI8InD8VzGVQ0CWM4IVYEFvzncAlfXIKnJW22iIXWDeyoRWIpWH-8L5V-3RQCqLv58_crVoIgU3iY0XnVfirtfrpXjtbp1QpkDpMA1AanvmRxqAvvxA&enctid=cci2woq5a5f2&lpsn=+wows-wggames-cn-ddy12-html-website-1&foris=1&teclient=1625170630304888162&utm_source=sem_brand&utm_medium=sem&utm_campaign=ij2r99x4&utm_content=wows_baidu_key_1819 IP8.133.125.31:443 ASN#37963 Hangzhou Alibaba Advertising Co.,Ltd.
CertificateIssuerWoTrus CA Limited Subject*.wggames.cn Fingerprint79:41:CA:52:63:55:DA:8C:8A:CB:9E:F4:7E:1D:D0:9D:CB:8B:86:35 ValidityMon, 18 Mar 2024 00:00:00 GMT - Fri, 18 Apr 2025 23:59:59 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hashaff950cab4c0265e21d401db15f1026d f03e18461817f7a6546c8bf8fa8d686d7e30aca0 753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0
GET /WGC/360_Wargaming_Game_Center_Install_WOWS_CN.exe?website=1&pub_id=wows_baidu_key_1819&xid=baidu/baidu-sem///1819&sid=SIDkNAShN_Q3rTrReMPiDswvPh_jOtCI8InD8VzGVQ0CWM4IVYEFvzncAlfXIKnJW22iIXWDeyoRWIpWH-8L5V-3RQCqLv58_crVoIgU3iY0XnVfirtfrpXjtbp1QpkDpMA1AanvmRxqAvvxA&enctid=cci2woq5a5f2&lpsn=+wows-wggames-cn-ddy12-html-website-1&foris=1&teclient=1625170630304888162&utm_source=sem_brand&utm_medium=sem&utm_campaign=ij2r99x4&utm_content=wows_baidu_key_1819 HTTP/1.1
Host: redirect.wggames.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Fri, 29 Mar 2024 00:56:40 GMT
Content-Type: text/html
Content-Length: 138
Connection: keep-alive
Location: https://qgcdl.qihucdn.com/wg/qgc360/prod/wgc_24.00.01.5070_cn/world_of_warships_install_cn.exe?website=1&pub_id=wows_baidu_key_1819&xid=baidu/baidu-sem///1819&sid=SIDkNAShN_Q3rTrReMPiDswvPh_jOtCI8InD8VzGVQ0CWM4IVYEFvzncAlfXIKnJW22iIXWDeyoRWIpWH-8L5V-3RQCqLv58_crVoIgU3iY0XnVfirtfrpXjtbp1QpkDpMA1AanvmRxqAvvxA&enctid=cci2woq5a5f2&lpsn=+wows-wggames-cn-ddy12-html-website-1&foris=1&teclient=1625170630304888162&utm_source=sem_brand&utm_medium=sem&utm_campaign=ij2r99x4&utm_content=wows_baidu_key_1819
|
|
| redirect.wggames.cn/ | 8.133.125.31 | | 612 B |
IP8.133.125.31:0 ASN#37963 Hangzhou Alibaba Advertising Co.,Ltd.
CertificateIssuerWoTrus CA Limited Subject*.wggames.cn Fingerprint79:41:CA:52:63:55:DA:8C:8A:CB:9E:F4:7E:1D:D0:9D:CB:8B:86:35 ValidityMon, 18 Mar 2024 00:00:00 GMT - Fri, 18 Apr 2025 23:59:59 GMT
File typeHTML document, ASCII text Hashe3eb0a1df437f3f97a64aca5952c8ea0 7dd71afcfb14e105e80b0c0d7fce370a28a41f0a 38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
GET / HTTP/1.1
Host: redirect.wggames.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 29 Mar 2024 00:56:43 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Mon, 08 Jun 2020 13:25:31 GMT
Connection: keep-alive
ETag: "5ede3c4b-264"
Accept-Ranges: bytes
|
|
| ocsp.crlocsp.cn/ | 101.198.193.5 | | 471 B |
IP101.198.193.5:0 ASN#55992 Beijing Qihu Technology Company Limited
Hash51877540cf4a7401f6b01b4d00b2dbf7 de1acdd927b3a403967e993743f4c0d1c175277c 21bbd5ffbd0b4129c0800cc011c388a4d1939a857aa1e2f11405f996f7f863ee
POST / HTTP/1.1
Host: ocsp.crlocsp.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.9.14
Date: Fri, 29 Mar 2024 00:56:19 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Content-Transfer-Encoding: Binary
Last-modified: Mon, 25 Mar 2024 11:34:27 GMT
Expires: Mon, 01 Apr 2024 11:34:26 GMT
ETag: "DE1ACDD927B3A403967E993743F4C0D1C175277C"
cache-control: max-age=172800,public,no-transform,must-revalidate
|
|
| ocsp.crlocsp.cn/ | 101.198.193.5 | | 472 B |
IP101.198.193.5:0 ASN#55992 Beijing Qihu Technology Company Limited
Hash1d42d6bd0ddf324e7e3e8bf8c29ce3b5 377ea61d61445b587d2df55dd9d0684b694ffd13 f38804651e6bd9781d1a2f4c77f19c3ad72c1cd55571c08069d1ea5164fb1a08
POST / HTTP/1.1
Host: ocsp.crlocsp.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.9.14
Date: Fri, 29 Mar 2024 00:48:07 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Content-Transfer-Encoding: Binary
Last-modified: Wed, 27 Mar 2024 13:08:57 GMT
Expires: Wed, 03 Apr 2024 13:08:56 GMT
ETag: "377EA61D61445B587D2DF55DD9D0684B694FFD13"
cache-control: max-age=172800,public,no-transform,must-revalidate
|
|
| ocsp.crlocsp.cn/ | 101.198.193.5 | | 472 B |
IP101.198.193.5:0 ASN#55992 Beijing Qihu Technology Company Limited
Hash1d42d6bd0ddf324e7e3e8bf8c29ce3b5 377ea61d61445b587d2df55dd9d0684b694ffd13 f38804651e6bd9781d1a2f4c77f19c3ad72c1cd55571c08069d1ea5164fb1a08
POST / HTTP/1.1
Host: ocsp.crlocsp.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.9.14
Date: Fri, 29 Mar 2024 00:53:23 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Content-Transfer-Encoding: Binary
Last-modified: Wed, 27 Mar 2024 13:08:57 GMT
Expires: Wed, 03 Apr 2024 13:08:56 GMT
ETag: "377EA61D61445B587D2DF55DD9D0684B694FFD13"
cache-control: max-age=172800,public,no-transform,must-revalidate
|
|
| ocsp.crlocsp.cn/ | 101.198.193.5 | | 471 B |
IP101.198.193.5:0 ASN#55992 Beijing Qihu Technology Company Limited
Hash51877540cf4a7401f6b01b4d00b2dbf7 de1acdd927b3a403967e993743f4c0d1c175277c 21bbd5ffbd0b4129c0800cc011c388a4d1939a857aa1e2f11405f996f7f863ee
POST / HTTP/1.1
Host: ocsp.crlocsp.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.9.14
Date: Fri, 29 Mar 2024 00:52:48 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Content-Transfer-Encoding: Binary
Last-modified: Mon, 25 Mar 2024 11:34:27 GMT
Expires: Mon, 01 Apr 2024 11:34:26 GMT
ETag: "DE1ACDD927B3A403967E993743F4C0D1C175277C"
cache-control: max-age=172800,public,no-transform,must-revalidate
|
|
| qgcdl.qihucdn.com/wg/qgc360/prod/wgc_24.00.01.5070_cn/world_of_warships_install_cn.exe?website=1&pub_id=wows_baidu_key_1819&xid=baidu/baidu-sem///1819&sid=SIDkNAShN_Q3rTrReMPiDswvPh_jOtCI8InD8VzGVQ0CWM4IVYEFvzncAlfXIKnJW22iIXWDeyoRWIpWH-8L5V-3RQCqLv58_crVoIgU3iY0XnVfirtfrpXjtbp1QpkDpMA1AanvmRxqAvvxA&enctid=cci2woq5a5f2&lpsn=+wows-wggames-cn-ddy12-html-website-1&foris=1&teclient=1625170630304888162&utm_source=sem_brand&utm_medium=sem&utm_campaign=ij2r99x4&utm_content=wows_baidu_key_1819 | 61.170.80.233 | 200 OK | 8.9 kB |
URL User Request GET HTTP/2qgcdl.qihucdn.com/wg/qgc360/prod/wgc_24.00.01.5070_cn/world_of_warships_install_cn.exe?website=1&pub_id=wows_baidu_key_1819&xid=baidu/baidu-sem///1819&sid=SIDkNAShN_Q3rTrReMPiDswvPh_jOtCI8InD8VzGVQ0CWM4IVYEFvzncAlfXIKnJW22iIXWDeyoRWIpWH-8L5V-3RQCqLv58_crVoIgU3iY0XnVfirtfrpXjtbp1QpkDpMA1AanvmRxqAvvxA&enctid=cci2woq5a5f2&lpsn=+wows-wggames-cn-ddy12-html-website-1&foris=1&teclient=1625170630304888162&utm_source=sem_brand&utm_medium=sem&utm_campaign=ij2r99x4&utm_content=wows_baidu_key_1819 IP61.170.80.233:443 ASN#4812 China Telecom Group
CertificateIssuerWoTrus CA Limited Subject*.qihucdn.com Fingerprint8D:69:20:D3:30:F1:F8:B0:76:B5:AE:F5:AD:37:69:DF:02:C9:3A:3E ValidityTue, 05 Mar 2024 00:00:00 GMT - Sat, 05 Apr 2025 23:59:59 GMT
File typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections Hash94288177143c93cb8602d93b37987445 26bb89d3dbf740f6f217860bf4afac46f8aa3675 8e756b6a48e2d738c8df660337138e69dff313788fdb70b37e8500b187e6fd2c
| Analyzer | Verdict | Alert |
|---|
| YARAhub by abuse.ch | malware | Detect pe file that no import table |
GET /wg/qgc360/prod/wgc_24.00.01.5070_cn/world_of_warships_install_cn.exe?website=1&pub_id=wows_baidu_key_1819&xid=baidu/baidu-sem///1819&sid=SIDkNAShN_Q3rTrReMPiDswvPh_jOtCI8InD8VzGVQ0CWM4IVYEFvzncAlfXIKnJW22iIXWDeyoRWIpWH-8L5V-3RQCqLv58_crVoIgU3iY0XnVfirtfrpXjtbp1QpkDpMA1AanvmRxqAvvxA&enctid=cci2woq5a5f2&lpsn=+wows-wggames-cn-ddy12-html-website-1&foris=1&teclient=1625170630304888162&utm_source=sem_brand&utm_medium=sem&utm_campaign=ij2r99x4&utm_content=wows_baidu_key_1819 HTTP/1.1
Host: qgcdl.qihucdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: Tengine
content-type: application/octet-stream
content-length: 23514480
date: Fri, 29 Mar 2024 00:56:19 GMT
last-modified: Wed, 06 Mar 2024 13:02:44 GMT
expires: Sun, 28 Apr 2024 00:56:19 GMT
cache-control: max-age=2592000
content-disposition: attachment;filename=world_of_warships_install_cn_cci2woq5a5f2.exe
accept-ranges: bytes
ali-swift-global-savetime: 1711673779
via: cache51.l2cn3022[0,0,200-0,H], cache24.l2cn3022[0,0], vcache9.cn6012[0,0,200-0,H], vcache4.cn6012[1,0]
age: 24
x-cache: HIT TCP_MEM_HIT dirn:10:153114883
x-swift-savetime: Fri, 29 Mar 2024 00:56:24 GMT
x-swift-cachetime: 2591995
timing-allow-origin: *
eagleid: 3daa501817116738030668225e
X-Firefox-Spdy: h2
|
|