IP 120.52.95.248:0
ASN#133119 China Unicom IP network
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hash8b181bb6767bc5795dcf17341a387e5b b5e2a9fb1f8a4aad3c7127c769af4c780b47bef4 32cbc376cd769a26d108ae31678f975b863b7066e110c59d9a212c7281bd8c81
GET / HTTP/1.1
Host: xmp.down.sandai.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: openresty
Date: Sat, 30 Sep 2023 00:53:55 GMT
Content-Type: text/html
Content-Length: 150
Connection: keep-alive
via: CHN-HElangfang-AREACUCC1-CACHE17[1]
|
| xmp.down.sandai.net/kankan/APlayerCodecs3.exe | 120.52.95.247 | 200 OK | 20 MB |
URL User Request GET HTTP/2xmp.down.sandai.net/kankan/APlayerCodecs3.exe IP120.52.95.247:443 ASN#133119 China Unicom IP network
CertificateIssuerDigiCert Inc Subject*.down.sandai.net FingerprintCF:16:F3:1F:82:18:77:D1:38:D3:D9:68:F1:AE:70:8C:CA:76:28:0A ValidityFri, 21 Jul 2023 00:00:00 GMT - Sun, 21 Jul 2024 23:59:59 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive\012- data Size20 MB (20431568 bytes) Hashbfe027d9877f9034f82403a0ea47790d 194d326ba0c6b0452975128dbd8718f49f556174 4acd4b602d2cf831e971b4efcd498e459b4bf323d9930f3794857a24f37fc1bf
| Analyzer | Verdict | Alert |
|---|
| VirusTotal | suspicious | |
GET /kankan/APlayerCodecs3.exe HTTP/1.1
Host: xmp.down.sandai.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 00:53:55 GMT
content-type: application/x-msdownload
content-length: 20431568
server: openresty
x-oss-request-id: 6507EBB1986E293239D58A98
x-oss-cdn-auth: success
etag: "BFE027D9877F9034F82403A0EA47790D"
last-modified: Fri, 09 Apr 2021 08:56:32 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 16957267759198547806
x-oss-storage-class: Standard
x-oss-meta-md5: bfe027d9877f9034f82403a0ea47790d
x-oss-server-time: 29
ali-swift-global-savetime: 1695017905
via: CHN-HElangfang-AREACUCC1-CACHE52[10],CHN-HElangfang-AREACUCC1-CACHE5[0,TCP_HIT,7],CHN-TJ-GLOBAL1-CACHE37[10],CHN-TJ-GLOBAL1-CACHE61[0,TCP_HIT,6],cache70.l2cn3071[149,148,206-0,M], cache10.l2cn3071[150,0], vcache8.cn4770[169,177,206-0,M], vcache5.cn4770[180,0]
x-cache: MISS TCP_MISS dirn:11:906707543 mlen:524288
x-swift-savetime: Mon, 18 Sep 2023 06:18:25 GMT
x-swift-cachetime: 2592000
timing-allow-origin: *
eagleid: b4d5fb9916950179049504868e
x-ccdn-expires: 1579381
x-hcs-proxy-type: 1
x-ccdn-cachettl: 2592000
nginx-hit: 1
age: 1016260
accept-ranges: bytes
X-Firefox-Spdy: h2
|