| dv.g4.ocsp.pubcert.jprs.jp/ |  113.52.156.18 | | 1.5 kB |
URL dv.g4.ocsp.pubcert.jprs.jp/ IP113.52.156.18:0 ASN#10006 SECOM Trust Systems Co.,Ltd.
Hash728803cefe852b650685274ee6c1a0e7 487ecc5347bdf079255367ac53530fbe99f97aa9 b9d01c8ba24786e07fe201647c9a6d5e40e5a0f5eae6a7d88fd321c0c9032fbe
POST / HTTP/1.1
Host: dv.g4.ocsp.pubcert.jprs.jp
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 09 May 2024 01:21:06 GMT
Server: Microsoft-IIS/8.5
Cache-Control: max-age=86400
Content-Type: application/ocsp-response
Expires: Sun, 12 May 2024 23:34:09 GMT
Last-Modified: Wed, 08 May 2024 23:34:09 GMT
ETag: "728803cefe852b650685274ee6c1a0e7"
X-Powered-By: ASP.NET
Content-Length: 1478
Connection: close
|
| dv.g4.ocsp.pubcert.jprs.jp/ | 113.52.156.18 | | 1.5 kB |
URL dv.g4.ocsp.pubcert.jprs.jp/ IP113.52.156.18:0 ASN#10006 SECOM Trust Systems Co.,Ltd.
Hash1dea47385c295836afcdb492b34bde26 20ff42b62b8c17e9c00390195c2875f49a5a46fe 4fd61aaa506708dcff9e6c12ba4d019ed426d40cccc812cfa8879fdc4097e663
POST / HTTP/1.1
Host: dv.g4.ocsp.pubcert.jprs.jp
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 09 May 2024 01:21:09 GMT
Server: Microsoft-IIS/8.5
Cache-Control: max-age=86400
Content-Type: application/ocsp-response
Expires: Sun, 12 May 2024 23:34:09 GMT
Last-Modified: Wed, 08 May 2024 23:34:09 GMT
ETag: "1dea47385c295836afcdb492b34bde26"
X-Powered-By: ASP.NET
Content-Length: 1478
Connection: close
|
| ssl.ajnet.ne.jp/irigo/source/IRIGoSysUp.exe | 219.165.120.244 | 200 OK | 14 MB |
URL User Request GET HTTP/1.1ssl.ajnet.ne.jp/irigo/source/IRIGoSysUp.exe IP219.165.120.244:443 ASN#4713 NTT Communications Corporation
CertificateIssuerJapan Registry Services Co., Ltd. Subjectssl.ajnet.ne.jp FingerprintE9:6F:11:56:CC:51:6D:62:EC:98:2F:66:19:5B:A7:D9:72:06:23:9E ValidityThu, 01 Jun 2023 00:29:20 GMT - Sun, 30 Jun 2024 14:59:59 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows, 12 sections Size14 MB (14491376 bytes) Hash2b91010f76c87a495ff052283d44045d 12f67c4f478f7100f3dfc64d4f031150f4a093dc 85dabd383025bf455f55527fbda4163acf43d95357bd600d8f64929bffef0f81
| Analyzer | Verdict | Alert |
|---|
| YARAhub by abuse.ch | malware | meth_get_eip |
GET /irigo/source/IRIGoSysUp.exe HTTP/1.1
Host: ssl.ajnet.ne.jp
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 09 May 2024 01:21:09 GMT
Server: Apache/2.4.18 (Unix) OpenSSL/1.0.1p-freebsd PHP/5.6.17
Last-Modified: Wed, 07 Nov 2018 02:04:13 GMT
ETag: "dd1ef0-57a0988e002a8"
Accept-Ranges: bytes
Content-Length: 14491376
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-msdownload
|