Report - maheegroup.com/cg/xmay.txt

Report Overview

Submitted URL
maheegroup.com/cg/xmay.txt
IP
116.206.104.215
ASN
#394695 PUBLIC-DOMAIN-REGISTRY
Submitted
2024-05-07 08:18:18
Access
public
Website Title
maheegroup.com/cg/xmay.txt
Final URL
maheegroup.com/cg/xmay.txt
Tags
urlquery detections
Suspicious - Base64 encoded file

Detections

urlquery
2
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
maheegroup.com	unknown	2020-07-28	2020-09-17	2021-03-19	928 B	47 kB	116.206.104.215

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-05-07	medium	maheegroup.com/cg/xmay.txt	Detects an base64 encoded executable with reversed characters

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
maheegroup.com/cg/xmay.txt
IP
116.206.104.215
ASN
#394695 PUBLIC-DOMAIN-REGISTRY

File type
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
Size
34 kB (34304 bytes)
Hash
ba41ffb3d8d33fc940d337c90f3fa129
93c693aca2a53054d66df2f26e0c15cbecc62ceb
6dc37cfbcc9f41c8854ce46505f0ca6e09d15c3147510e5e15f95dcfdf941108

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

maheegroup.com/favicon.ico

116.206.104.215

404 Not Found

355 B

URL GET HTTP/2
maheegroup.com/favicon.ico
IP
116.206.104.215:443
ASN
#394695 PUBLIC-DOMAIN-REGISTRY

Requested by
https://maheegroup.com/cg/xmay.txt
Certificate
IssuerLet's Encrypt
Subject*.maheegroup.com
FingerprintE8:69:2F:06:D2:B8:82:56:90:51:2A:52:33:4D:BE:F7:EF:2B:E5:AB
ValidityFri, 22 Mar 2024 13:51:21 GMT - Thu, 20 Jun 2024 13:51:20 GMT

File type
HTML document, ASCII text
Size
355 B (355 bytes)
Hash
59f6ae7c7f154ec74d418d4ed6fc5b0e
674860108a41ab23ba5f73635749332bd8a46b7e
50e0767f2731da7ddb56d719dc85a7f830c4a860d8f09d0f25401d3dc7097d7d

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: maheegroup.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://maheegroup.com/cg/xmay.txt
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
last-modified: Tue, 21 Sep 2021 11:26:03 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 355
content-type: text/html
date: Tue, 07 May 2024 08:17:54 GMT
server: Apache
X-Firefox-Spdy: h2

maheegroup.com/cg/xmay.txt

116.206.104.215

200 OK

46 kB

URL User Request GET HTTP/2
maheegroup.com/cg/xmay.txt
IP
116.206.104.215:443
ASN
#394695 PUBLIC-DOMAIN-REGISTRY

Certificate
IssuerLet's Encrypt
Subject*.maheegroup.com
FingerprintE8:69:2F:06:D2:B8:82:56:90:51:2A:52:33:4D:BE:F7:EF:2B:E5:AB
ValidityFri, 22 Mar 2024 13:51:21 GMT - Thu, 20 Jun 2024 13:51:20 GMT

File type
ASCII text, with very long lines (45740), with no line terminators
Size
46 kB (45740 bytes)
Hash
48434e5c153c576353a3ff9ca36ec01d
37d3ad2626d77219407461fd52bd9eb63b900e80
43d0d4ce6c771e6c6c7e64ceb935c0ded947946ed906a36bcb7bb77c7c48d03e

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Base64 encoded file
Public Nextron YARA rules	malware	Detects an base64 encoded executable with reversed characters

HTTP Headers

GET /cg/xmay.txt HTTP/1.1
Host: maheegroup.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Sat, 04 May 2024 14:30:17 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/plain
date: Tue, 07 May 2024 08:17:53 GMT
server: Apache
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

JavaScript (0)

HTTP Transactions (2)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers