Report - support.melco-service.com/as/wapi/TurboMeetingStarter.exe?role=attendee&name=&email=&meeting_id=&user_password=&meeting_password=&meeting_type=0&pass

Report Overview

Visited public
2023-11-26 12:37:03
Tags
URL
support.melco-service.com/as/wapi/TurboMeetingStarter.exe?role=attendee&name=&email=&meeting_id=&user_password=&meeting_password=&meeting_type=0&pass_through=&ram=1687864399&plst=
Finishing URL
about:privatebrowsing
IP / ASN
50.202.80.110
#7922 COMCAST-7922
Title
about:privatebrowsing
MSOffice_Macro_HTTP_Payload_Download

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.starfieldtech.com	6616	2003-03-06	2012-06-22 20:08:50	2023-11-26 05:12:17	346 B	2.7 kB	192.124.249.24
support.melco-service.com	unknown	1996-10-30	2017-03-13 04:31:53	2023-11-24 04:03:36	645 B	790 kB	50.202.80.110

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2023-11-26	medium	support.melco-service.com/as/wapi/TurboMeetingStarter.exe?role=attendee&name=&email=&meeting_id=&user_password=&meeting_password=&meeting_type=0&pass_through=&ram=1687864399&plst=	files - file ~tmp01925d3f.exe

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
support.melco-service.com/as/wapi/TurboMeetingStarter.exe?role=attendee&name=&email=&meeting_id=&user_password=&meeting_password=&meeting_type=0&pass_through=&ram=1687864399&plst=
IP
50.202.80.110
ASN
#7922 COMCAST-7922

File type
PE32 executable (GUI) Intel 80386, for MS Windows\012- data
Size
790 kB (790064 bytes)
Hash
c09700e1e2560b8f2ef01c33844fdaec
942d7eab51492f79c513c76593243972c3c01561
22dce80b2751d419f9735854cc82a9747d36f85e602aba5056c25adc18ed2098

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

ocsp.starfieldtech.com/

192.124.249.24

2.1 kB

URL
ocsp.starfieldtech.com/
IP
192.124.249.24:0
ASN
#30148 SUCURI-SEC

File type
data
Size
2.1 kB (2148 bytes)
Hash
adcae94b6563ed77642e68b16b8df77a
39b263f345acba0a111f6cceb4be2c9926652d37
5421c5f4930718d9d184861e6a1314f1d3dbb56bcf714a4146de86a9b1a1aedb

HTTP Headers

POST / HTTP/1.1
Host: ocsp.starfieldtech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sun, 26 Nov 2023 12:36:45 GMT
Content-Type: application/ocsp-response
Content-Length: 2148
Connection: keep-alive
X-Sucuri-ID: 19024
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sun, 26 Nov 2023 07:44:28 GMT
Expires: Mon, 27 Nov 2023 07:44:28 GMT
ETag: "39b263f345acba0a111f6cceb4be2c9926652d37"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"

support.melco-service.com/as/wapi/TurboMeetingStarter.exe?role=attendee&name=&email=&meeting_id=&user_password=&meeting_password=&meeting_type=0&pass_through=&ram=1687864399&plst=

50.202.80.110

200 OK

790 kB

URL User Request GET HTTP/1.0
support.melco-service.com/as/wapi/TurboMeetingStarter.exe?role=attendee&name=&email=&meeting_id=&user_password=&meeting_password=&meeting_type=0&pass_through=&ram=1687864399&plst=
IP
50.202.80.110:443
ASN
#7922 COMCAST-7922

Certificate
IssuerStarfield Technologies, Inc.
Subjectsupport.melco-service.com
FingerprintCE:7F:26:E0:B8:60:F4:BE:52:A7:8D:65:BA:1F:F9:1E:A1:DE:8D:C8
ValidityTue, 14 Nov 2023 23:15:16 GMT - Wed, 11 Dec 2024 17:00:35 GMT

File type
PE32 executable (GUI) Intel 80386, for MS Windows\012- data
Size
790 kB (790064 bytes)
Hash
c09700e1e2560b8f2ef01c33844fdaec
942d7eab51492f79c513c76593243972c3c01561
22dce80b2751d419f9735854cc82a9747d36f85e602aba5056c25adc18ed2098

Detections

Analyzer	Verdict	Alert
urlquery		MSOffice_Macro_HTTP_Payload_Download
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe

HTTP Headers

GET /as/wapi/TurboMeetingStarter.exe?role=attendee&name=&email=&meeting_id=&user_password=&meeting_password=&meeting_type=0&pass_through=&ram=1687864399&plst= HTTP/1.1
Host: support.melco-service.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.0 200 OK
Date: Sun, 26 Nov 2023 06:01:14 GMT
Cache-Control: no-store
CAccept-Ranges: bytes
Connection: close
Content-Type: application/octet-stream
Last-Modified: Sun, 26 Nov 2023 06:01:14 GMT
Content-Length: 790064
content-disposition: inline; filename=TurboMeetingStarter.exe
X-Frame-Options: SAMEORIGIN

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.0

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers