Report - mhsonsco.com/ab/dhltxt.txt

Report Overview

Submitted URL
mhsonsco.com/ab/dhltxt.txt
IP
103.83.81.68
ASN
#135822 Ovi Hosting Pvt Ltd
Submitted
2024-04-23 06:18:07
Access
public
Website Title
mhsonsco.com/ab/dhltxt.txt
Final URL
mhsonsco.com/ab/dhltxt.txt
Tags
urlquery detections
Suspicious - Base64 encoded file

Detections

urlquery
2
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
mhsonsco.com	unknown	2020-09-09	2020-09-09	2024-04-17	2.2 kB	325 kB	103.83.81.68

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-04-23	medium	mhsonsco.com/ab/dhltxt.txt	Detects an base64 encoded executable with reversed characters

Files detected

URL
mhsonsco.com/ab/dhltxt.txt
IP
103.83.81.68
ASN
#135822 Ovi Hosting Pvt Ltd

File type
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
Size
242 kB (241664 bytes)
Hash
935091d7c79381d402d30372962335d8
e9a380a4d44172684033bf9fd846c6bdf56ffe06
333092f6705f7e8dd3923aa886e1ea495257fa4b57a02fbead9bc5a2e9fe74b3

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 48/70

JavaScript (0)

HTTP Transactions (4)

URL IP Response Size

mhsonsco.com/ab/dhltxt.txt

103.83.81.68

200 OK

1.5 kB

URL User Request GET HTTP/2
mhsonsco.com/ab/dhltxt.txt
IP
103.83.81.68:443
ASN
#135822 Ovi Hosting Pvt Ltd

Certificate
IssuerLet's Encrypt
Subjectmhsonsco.com
Fingerprint7B:E2:27:21:36:02:D4:73:72:9C:4A:97:B7:56:74:5E:65:8F:45:24
ValidityWed, 20 Mar 2024 10:41:22 GMT - Tue, 18 Jun 2024 10:41:21 GMT

File type
JavaScript source, ASCII text
Size
1.5 kB (1535 bytes)
Hash
12e140029c7f2cbe9181765f791d56e4
c06c81be5ad672bd1d534ac9dbcb01b0b27f2067
46b8ecafa904a2497faa1ea7d1391c8034304b53934cd9b18be8ed78cd420ce4

HTTP Headers

GET /ab/dhltxt.txt HTTP/1.1
Host: mhsonsco.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 23 Apr 2024 06:21:18 GMT
content-length: 1535
cache-control: no-cache, no-store, must-revalidate, max-age=0, no-store, max-age=0
server: imunify360-webshield/1.21
X-Firefox-Spdy: h2

mhsonsco.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19412800

103.83.81.68

302 Found

0 B

URL User Request GET HTTP/2
mhsonsco.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19412800
IP
103.83.81.68:443
ASN
#135822 Ovi Hosting Pvt Ltd

Certificate
IssuerLet's Encrypt
Subjectmhsonsco.com
Fingerprint7B:E2:27:21:36:02:D4:73:72:9C:4A:97:B7:56:74:5E:65:8F:45:24
ValidityWed, 20 Mar 2024 10:41:22 GMT - Tue, 18 Jun 2024 10:41:21 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19412800 HTTP/1.1
Host: mhsonsco.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mhsonsco.com/ab/dhltxt.txt
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 302 Found
date: Tue, 23 Apr 2024 06:21:18 GMT
content-length: 0
x-forwarded-for: 91.90.42.154
x-real-ip: 91.90.42.154
x-remote-ip: 91.90.42.154
location: https://mhsonsco.com/ab/dhltxt.txt
set-cookie: wssplashuid=74b6b3777ee46390fde493ea961d9cbeebee8b5e.1713856878.1; Path=/; Domain=mhsonsco.com; Max-Age=2592000; HttpOnly; SameSite=Lax
server: imunify360-webshield/1.21
X-Firefox-Spdy: h2

mhsonsco.com/ab/dhltxt.txt

103.83.81.68

200 OK

322 kB

URL User Request GET HTTP/2
mhsonsco.com/ab/dhltxt.txt
IP
103.83.81.68:443
ASN
#135822 Ovi Hosting Pvt Ltd

Certificate
IssuerLet's Encrypt
Subjectmhsonsco.com
Fingerprint7B:E2:27:21:36:02:D4:73:72:9C:4A:97:B7:56:74:5E:65:8F:45:24
ValidityWed, 20 Mar 2024 10:41:22 GMT - Tue, 18 Jun 2024 10:41:21 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
322 kB (322220 bytes)
Hash
38a06415b9f21fb584c73f0b72a9741c
ad74e348cd2ce5b0c429e8c1dea83b9580be1c42
d0778b270721e7a662a1a17f7505d0149a8cc6f803a15e21ab507860d90a8e63

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Base64 encoded file
Public Nextron YARA rules	malware	Detects an base64 encoded executable with reversed characters

HTTP Headers

GET /ab/dhltxt.txt HTTP/1.1
Host: mhsonsco.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mhsonsco.com/ab/dhltxt.txt
DNT: 1
Connection: keep-alive
Cookie: wssplashuid=74b6b3777ee46390fde493ea961d9cbeebee8b5e.1713856878.1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 23 Apr 2024 06:21:18 GMT
content-type: text/plain
content-length: 322220
last-modified: Tue, 23 Apr 2024 03:08:56 GMT
accept-ranges: bytes
server: imunify360-webshield/1.21
X-Firefox-Spdy: h2

mhsonsco.com/favicon.ico

103.83.81.68

404 Not Found

315 B

URL GET HTTP/2
mhsonsco.com/favicon.ico
IP
103.83.81.68:443
ASN
#135822 Ovi Hosting Pvt Ltd

Requested by
https://mhsonsco.com/ab/dhltxt.txt
Certificate
IssuerLet's Encrypt
Subjectmhsonsco.com
Fingerprint7B:E2:27:21:36:02:D4:73:72:9C:4A:97:B7:56:74:5E:65:8F:45:24
ValidityWed, 20 Mar 2024 10:41:22 GMT - Tue, 18 Jun 2024 10:41:21 GMT

File type
HTML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: mhsonsco.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mhsonsco.com/ab/dhltxt.txt
Cookie: wssplashuid=74b6b3777ee46390fde493ea961d9cbeebee8b5e.1713856878.1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
date: Tue, 23 Apr 2024 06:21:19 GMT
content-type: text/html; charset=iso-8859-1
content-length: 315
server: imunify360-webshield/1.21
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (0)

HTTP Transactions (4)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers