Report - dl.foreks.com/destek/TeamViewerQS_tr-idcag5kvr9.exe?__hstc=148463784.538b51a532162da19d26e5d81592c02f.1704326400218.1704326400219.1704326400220.1&__hssc=148463784.1.1704326400221&__hsfp=659407567

Report Overview

Submitted URL
dl.foreks.com/destek/TeamViewerQS_tr-idcag5kvr9.exe?__hstc=148463784.538b51a532162da19d26e5d81592c02f.1704326400218.1704326400219.1704326400220.1&__hssc=148463784.1.1704326400221&__hsfp=659407567
IP
95.0.13.180
ASN
#9121 Turk Telekom
Submitted
2024-05-10 01:02:13
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
2
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
dl.foreks.com	unknown	1996-11-13	2012-11-30	2020-03-24	649 B	6.9 MB	95.0.13.180
aus5.mozilla.org	2548	1998-01-24	2015-10-27	2024-05-09	512 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-05-10 01:01:49	medium	Client IP	61.110.197.11	ET INFO Executable Download from dotted-quad Host
2024-05-10 01:02:05	medium	Client IP	61.110.197.11	ET INFO Executable Download from dotted-quad Host

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
dl.foreks.com/destek/TeamViewerQS_tr-idcag5kvr9.exe?__hstc=148463784.538b51a532162da19d26e5d81592c02f.1704326400218.1704326400219.1704326400220.1&__hssc=148463784.1.1704326400221&__hsfp=659407567
IP
95.0.13.180
ASN
#9121 Turk Telekom

File type
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
Size
6.9 MB (6944728 bytes)
Hash
00c375be36eef315866dec1a4a654487
cfdb5b075e2e4453c96d07c6aef8090bc0a2618f
336ba1d7e411559d16c2e57c1d99018213eaee0ae30837d58a79baf4215b81e3

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	dl.foreks.com/destek/TeamViewerQS_tr-idcag5kvr9.exe?__hstc=148463784.538b51a532162da19d26e5d81592c02f.1704326400218.1704326400219.1704326400220.1&__hssc=148463784.1.1704326400221&__hsfp=659407567	95.0.13.180	200 OK	6.9 MB
URL User Request GET HTTP/1.1 dl.foreks.com/destek/TeamViewerQS_tr-idcag5kvr9.exe?__hstc=148463784.538b51a532162da19d26e5d81592c02f.1704326400218.1704326400219.1704326400220.1&__hssc=148463784.1.1704326400221&__hsfp=659407567 IP 95.0.13.180:443 ASN #9121 Turk Telekom Certificate IssuerSectigo Limited Subject.foreks.com FingerprintD8:C8:30:38:21:4D:B9:BF:BF:FF:21:B6:38:47:76:6B:23:DD:6E:D1 ValidityTue, 06 Jun 2023 00:00:00 GMT - Sat, 06 Jul 2024 23:59:59 GMT File type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections Size 6.9 MB (6944728 bytes) Hash 00c375be36eef315866dec1a4a654487 cfdb5b075e2e4453c96d07c6aef8090bc0a2618f 336ba1d7e411559d16c2e57c1d99018213eaee0ae30837d58a79baf4215b81e3 HTTP Headers GET /destek/TeamViewerQS_tr-idcag5kvr9.exe?__hstc=148463784.538b51a532162da19d26e5d81592c02f.1704326400218.1704326400219.1704326400220.1&__hssc=148463784.1.1704326400221&__hsfp=659407567 HTTP/1.1 Host: dl.foreks.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Server: nginx Date: Fri, 10 May 2024 01:01:27 GMT Content-Type: application/octet-stream Content-Length: 6944728 Last-Modified: Fri, 29 Jan 2016 11:01:19 GMT Connection: keep-alive ETag: "56ab467f-69f7d8" Accept-Ranges: bytes`

	aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml	35.244.181.201		444 B
URL aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml IP 35.244.181.201:0 ASN #396982 GOOGLE-CLOUD-PLATFORM File type XML 1.0 document, ASCII text, with very long lines (332) Size 444 B (444 bytes) Hash 3b324dec137a87ef7e24a30a65b13dd0 c0faa95b2f1018e264b3a14aaf50d1003e6c27b3 6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463 HTTP Headers `GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1 Host: aus5.mozilla.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Pragma: no-cache Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site` HTTP/2 200 OK server: nginx rule-id: unknown rule-data-version: unknown content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-06-09-11-51-10.chain; p384ecdsa=ewSsAuOmDlQG0kCDB4uOBAZ5vGEEUOgM16ITjge5F3Eike1DiMJoKP-QrQki8N8Fqg8IArHGRkhDOuqRdrDsCPt3oRtqdYXCdlDswJS6GQV3-L-ikkqn8MYaB75gvfm3 strict-transport-security: max-age=31536000; x-content-type-options: nosniff content-security-policy: default-src 'none'; frame-ancestors 'none' x-proxy-cache-status: EXPIRED content-encoding: gzip via: 1.1 google date: Fri, 10 May 2024 01:01:08 GMT content-type: text/xml; charset=utf-8 vary: Accept-Encoding content-length: 444 age: 58 cache-control: public,max-age=90 alt-svc: clear X-Firefox-Spdy: h2