Report - www.icpdas.com/web/product/download/software/utility_driver/esearch/software/utility/Windows/eSearch_Utility_setup_Windows

Report Overview

Visitedpublic

2024-09-26 14:09:25

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r11.o.lencr.org	unknown	2020-06-29	2024-06-07 07:43:57	2024-09-26 01:59:48	981 B	2.7 kB	23.36.76.226
www.icpdas.com	unknown	1999-06-14	2012-07-20 21:45:34	2024-09-26 09:25:39	585 B	3.9 MB	50.87.226.148
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-09-26 01:59:56	1.3 kB	3.6 kB	23.36.77.32

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

www.icpdas.com/web/product/download/software/utility_driver/esearch/software/utility/Windows/eSearch_Utility_setup_Windows_v130.exe

IP / ASN

50.87.226.148

#46606 UNIFIEDLAYER-AS-1

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

Size3.9 MB (3931424 bytes)

MD58797aabf44f2cfcfe3241181661d3019

SHA188bd54cef1a95671391fd602b60aad113d09393d

SHA2562d524877f2311518b7b2bf85b6d5ee470e13f32ecc16c48f358a8c8f5582c621

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/67

JavaScript (0)

HTTP Transactions (8)

URL IP Response Size

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-25

Last Seen2024-10-04

Times Seen41560

Size504 B (504 bytes)

MD5b6ecb6018a51380d08a47460236a395c

SHA11ce7fe77c21188624302a660a289fe1ce6e7a9e4

SHA256ec876edd163ea26b47c9b862c795844f5dd01452095287ea5cd920e3b512672a

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "EC876EDD163EA26B47C9B862C795844F5DD01452095287EA5CD920E3B512672A"
Last-Modified: Wed, 25 Sep 2024 21:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11815
Expires: Thu, 26 Sep 2024 17:25:54 GMT
Date: Thu, 26 Sep 2024 14:08:59 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-26

Last Seen2024-09-28

Times Seen4867

Size504 B (504 bytes)

MD526b2b0acc9768970e6a2a5a01ad82734

SHA16b6e2e6f647ab6b61366fce8295bf91d720961b8

SHA256779805a4291d90d0100e6b257ae6e81646d272204f8f0d4da2aa48a2673f4b1e

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "779805A4291D90D0100E6B257AE6E81646D272204F8F0D4DA2AA48A2673F4B1E"
Last-Modified: Thu, 26 Sep 2024 13:24:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21470
Expires: Thu, 26 Sep 2024 20:06:49 GMT
Date: Thu, 26 Sep 2024 14:08:59 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-25

Last Seen2024-09-28

Times Seen19111

Size504 B (504 bytes)

MD5c43e2541e37815678381469c9e5da2d7

SHA18826a1dacc67c90e98c00b0b34736b52cc7724ad

SHA256e3a32ce3cf72d63e19b8798f97958504386b93f037f1b1c0ee9b1bacef7b7ab7

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "E3A32CE3CF72D63E19B8798F97958504386B93F037F1B1C0EE9B1BACEF7B7AB7"
Last-Modified: Wed, 25 Sep 2024 02:37:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6564
Expires: Thu, 26 Sep 2024 15:58:23 GMT
Date: Thu, 26 Sep 2024 14:08:59 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-25

Last Seen2024-09-28

Times Seen16176

Size504 B (504 bytes)

MD5c5df97c10e9a37c02e8e12b302465464

SHA1b0d9b31bb7dd48f11b58e6f1833798e45dc5a862

SHA256350fb41eb348dc3b30943b357e089a3cd9dcc9670285c29485ba02a38ebcbc15

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "350FB41EB348DC3B30943B357E089A3CD9DCC9670285C29485BA02A38EBCBC15"
Last-Modified: Wed, 25 Sep 2024 02:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12145
Expires: Thu, 26 Sep 2024 17:31:25 GMT
Date: Thu, 26 Sep 2024 14:09:00 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL

r11.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-28

Last Seen2024-09-28

Times Seen1

Size504 B (504 bytes)

MD57f081580f204ac0489b24ec4b631239b

SHA142d18403c5a1586f39ae9f4429d7a4730e638e80

SHA25633bf04e2392d3ed2974f5b0788b51d56cfa94b86af1b5d3a1274035feaf57f4b

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "33BF04E2392D3ED2974F5B0788B51D56CFA94B86AF1B5D3A1274035FEAF57F4B"
Last-Modified: Wed, 25 Sep 2024 07:04:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16329
Expires: Thu, 26 Sep 2024 18:41:09 GMT
Date: Thu, 26 Sep 2024 14:09:00 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL

r11.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-25

Last Seen2024-09-28

Times Seen21781

Size504 B (504 bytes)

MD5c16a3fe398c09ad4d309c60911d6a6b6

SHA1dc1148076d45d128cb6d0780ac0467aeba0902e9

SHA2565bd5f6cc031865b327cd4987c09f2266f9b994cc967eb6cf75bab5a58bcb7230

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5BD5F6CC031865B327CD4987C09F2266F9B994CC967EB6CF75BAB5A58BCB7230"
Last-Modified: Wed, 25 Sep 2024 02:39:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15287
Expires: Thu, 26 Sep 2024 18:23:48 GMT
Date: Thu, 26 Sep 2024 14:09:01 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL

r11.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-25

Last Seen2024-09-28

Times Seen21781

Size504 B (504 bytes)

MD5c16a3fe398c09ad4d309c60911d6a6b6

SHA1dc1148076d45d128cb6d0780ac0467aeba0902e9

SHA2565bd5f6cc031865b327cd4987c09f2266f9b994cc967eb6cf75bab5a58bcb7230

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5BD5F6CC031865B327CD4987C09F2266F9B994CC967EB6CF75BAB5A58BCB7230"
Last-Modified: Wed, 25 Sep 2024 02:39:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15287
Expires: Thu, 26 Sep 2024 18:23:48 GMT
Date: Thu, 26 Sep 2024 14:09:01 GMT
Connection: keep-alive

GET www.icpdas.com/web/product/download/software/utility_driver/esearch/software/utility/Windows/eSearch_Utility_setup_Windows_v130.exe

50.87.226.148

200 OK

3.9 MB

URL

www.icpdas.com/web/product/download/software/utility_driver/esearch/software/utility/Windows/eSearch_Utility_setup_Windows_v130.exe

IP / ASN

50.87.226.148

#46606 UNIFIEDLAYER-AS-1

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

First Seen2024-09-28

Last Seen2024-09-28

Times Seen1

Size3.9 MB (3931424 bytes)

MD58797aabf44f2cfcfe3241181661d3019

SHA188bd54cef1a95671391fd602b60aad113d09393d

SHA2562d524877f2311518b7b2bf85b6d5ee470e13f32ecc16c48f358a8c8f5582c621

Certificate Info

IssuerLet's Encrypt

Subjectwww.icpdas.com.tw

FingerprintD5:BE:7E:70:37:8C:F2:12:32:04:71:3C:75:BB:7B:98:E1:F9:20:53

ValidityThu, 22 Aug 2024 06:14:35 GMT - Wed, 20 Nov 2024 06:14:34 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/67

HTTP Headers

GET /web/product/download/software/utility_driver/esearch/software/utility/Windows/eSearch_Utility_setup_Windows_v130.exe HTTP/1.1
Host: www.icpdas.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Thu, 25 Aug 2022 01:50:20 GMT
accept-ranges: bytes
content-length: 3931424
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-type: application/x-msdownload
date: Thu, 26 Sep 2024 14:09:00 GMT
server: Apache
X-Firefox-Spdy: h2