Report - download.nxzsoftware.cn/go/icarefone_5984.exe?track[utm_source]=seo&track[utm_medium]=seo&track[realMedium]=seo&track[cross_end_id]=-LyP4be7B42T9sbA&track[type]=2&track[page]=https://www.nxzsoftware.cn/download-center.html&track[sid]=118&track[source]=seo&source=seo/

Report Overview

Visitedpublic

2025-02-14 10:23:05

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
download.nxzsoftware.cn	unknown	2022-11-25	2022-12-15	2025-02-10	1.2 kB	1.9 MB	180.163.146.102
go.nxzsoftware.cn	unknown	2022-11-25	2023-01-10	2025-02-10	596 B	1.9 MB	104.18.15.116

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

download.nxzsoftware.cn/downloads/icarefone.exe

IP / ASN

180.163.146.102

#4812 China Telecom Group

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections

Size1.9 MB (1940568 bytes)

MD56fc04d31d49c29fcbac24f7e0421f62b

SHA175fdd0bec651b473faa9699a1db69f14e8908e8b

SHA256341395712ab2c9d3e8d70ff5d1c1b2b9032b54f7b5613d57f77cd4a3a8435901

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 6/70

JavaScript (0)

HTTP Transactions (3)

URL IP Response Size

GET download.nxzsoftware.cn/go/icarefone_5984.exe?track[utm_source]=seo&track[utm_medium]=seo&track[realMedium]=seo&track[cross_end_id]=-LyP4be7B42T9sbA&track[type]=2&track[page]=https://www.nxzsoftware.cn/download-center.html&track[sid]=118&track[source]=seo&source=seo/

180.163.146.102

302 Moved Temporarily

221 B

URL

IP / ASN

180.163.146.102

#4812 China Telecom Group

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2023-08-13

Last Seen2025-03-01

Times Seen2926

Size221 B (221 bytes)

MD5de892df7d0306b279823c1669e6fa7c0

SHA12e61db1776c9110a62a848159d94ef050c80bc07

SHA256ec4ffe25f0a8dad25083be5f2bdf1614f75f8fcb8141a44f1de202ec202e4e46

Certificate Info

IssuerLet's Encrypt

Subjectdownload.nxzsoftware.cn

Fingerprint9F:E1:51:E3:07:20:07:36:FF:FA:EE:7E:6D:3C:4C:13:E7:AA:C2:97

ValidityThu, 23 Jan 2025 09:27:23 GMT - Wed, 23 Apr 2025 09:27:22 GMT

HTTP Headers

GET /go/icarefone_5984.exe?track[utm_source]=seo&track[utm_medium]=seo&track[realMedium]=seo&track[cross_end_id]=-LyP4be7B42T9sbA&track[type]=2&track[page]=https://www.nxzsoftware.cn/download-center.html&track[sid]=118&track[source]=seo&source=seo/ HTTP/1.1
Host: download.nxzsoftware.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Server: Tengine
Content-Type: text/html
Content-Length: 221
Connection: keep-alive
Date: Wed, 12 Feb 2025 17:51:19 GMT
Location: https://go.nxzsoftware.cn/go?c=download&a=track&name=icarefone_5984.exe&back_url=https://download.nxzsoftware.cn/downloads/icarefone.exe
Via: cache33.l2cn3022[118,118,302-0,M], cache46.l2cn3022[120,0], kunlun5.cn7174[0,0,302-0,H], kunlun7.cn7174[2,0]
Age: 145876
Ali-Swift-Global-Savetime: 1739382679
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Wed, 12 Feb 2025 17:51:19 GMT
X-Swift-CacheTime: 172800
Accept-Ranges: bytes
Timing-Allow-Origin: *
EagleId: b4a3921b17395285558881453e

GET download.nxzsoftware.cn/downloads/icarefone.exe

180.163.146.102

200 OK

1.9 MB

URL

download.nxzsoftware.cn/downloads/icarefone.exe

IP / ASN

180.163.146.102

#4812 China Telecom Group

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections

First Seen2024-06-20

Last Seen2025-03-16

Times Seen352

Size1.9 MB (1940568 bytes)

MD56fc04d31d49c29fcbac24f7e0421f62b

SHA175fdd0bec651b473faa9699a1db69f14e8908e8b

SHA256341395712ab2c9d3e8d70ff5d1c1b2b9032b54f7b5613d57f77cd4a3a8435901

Certificate Info

IssuerLet's Encrypt

Subjectdownload.nxzsoftware.cn

Fingerprint9F:E1:51:E3:07:20:07:36:FF:FA:EE:7E:6D:3C:4C:13:E7:AA:C2:97

ValidityThu, 23 Jan 2025 09:27:23 GMT - Wed, 23 Apr 2025 09:27:22 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 6/70

HTTP Headers

GET /downloads/icarefone.exe HTTP/1.1
Host: download.nxzsoftware.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/octet-stream
Content-Length: 1940568
Connection: keep-alive
Date: Wed, 12 Feb 2025 22:48:19 GMT
Accept-Ranges: bytes
Via: cache36.l2cn3160[211,244,304-0,M], cache64.l2cn3160[245,0], kunlun8.cn7174[0,0,200-0,H], kunlun7.cn7174[2,0]
Last-Modified: Mon, 27 May 2024 09:26:59 GMT
ETag: "665451e3-1d9c58"
Age: 128054
Ali-Swift-Global-Savetime: 1739400500
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Wed, 12 Feb 2025 22:48:18 GMT
X-Swift-CacheTime: 172802
Timing-Allow-Origin: *
EagleId: b4a3921b17395285565053093e

GET go.nxzsoftware.cn/go?c=download&a=track&name=icarefone_5984.exe&back_url=https://download.nxzsoftware.cn/downloads/icarefone.exe

104.18.15.116

302 Found

1.9 MB

URL

go.nxzsoftware.cn/go?c=download&a=track&name=icarefone_5984.exe&back_url=https://download.nxzsoftware.cn/downloads/icarefone.exe

IP / ASN

104.18.15.116

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-03

Times Seen5616662

Size1.9 MB (1940568 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate Info

IssuerGoogle Trust Services

Subjectnxzsoftware.cn

Fingerprint82:41:3D:BD:FF:3E:F4:74:F9:E0:F8:B7:42:4E:4B:4E:BC:8C:DC:9D

ValiditySun, 05 Jan 2025 10:58:21 GMT - Sat, 05 Apr 2025 11:58:14 GMT

HTTP Headers

GET /go?c=download&a=track&name=icarefone_5984.exe&back_url=https://download.nxzsoftware.cn/downloads/icarefone.exe HTTP/1.1
Host: go.nxzsoftware.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Fri, 14 Feb 2025 10:22:36 GMT
content-type: text/html; charset=UTF-8
location: https://download.nxzsoftware.cn/downloads/icarefone.exe
x-powered-by: PHP/7.2.34
cache-control: no-cache, private
set-cookie: XSRF-TOKEN=eyJpdiI6ImhqSWRGN2JZekxvUzdidG9oS0k4ZWc9PSIsInZhbHVlIjoiQk03NEsrZFk3aUIxTG1LTkVCZlJvbGR1KzN6RlBzcFwvRnNZaWF2VFZmRkUyTVdJNWN4V1cwWFFEUSs1WE1nWXBQYXFyM0cycWFaYXVJeFo0bTBpMFZDQW5CTm9BWTBQS1hKK0ZaTk81a01DeXRCKzN0TlwvYkhmSFp0dm5TQjRTYyIsIm1hYyI6IjlmYmMwOTM3MTUwNTE3NTI2NWFmMjE3MmM5MjEwMzI4NjkxMDJlYmIzZGY0MzA1YTA5MGFkYzI1MWFkM2U5YWQifQ%3D%3D; expires=Fri, 14-Feb-2025 12:22:36 GMT; Max-Age=7200; path=/
laravel_session=eyJpdiI6IlRVK252YnVKd2VGVHpSdVwvRFJzN0FnPT0iLCJ2YWx1ZSI6IlVHZ1o2ZjRrVURcL2E2TmlqSSt2cXpFWG5Kdk1jSTBEa0YxRXFQdWN2NzQrQXNnWEZNRHN3M3NQTHVrZlhUUWEwUFcxK1wvb0JMTW1SeGN1eWR5M3ZERENDMlRXSnBEdUpxbWRTQ3YrZ204K0xtMm15WXIwVm0ySzFQbHpEN0RCTDYiLCJtYWMiOiIyMWZkMWE4ODhjOGE0ZWRhZDY4OTU1YjFkYzIwY2Y0OTZlMjNjM2ZhYjA4MDA3NmI0NjZkOTU0YTUyZjUyOTBkIn0%3D; expires=Fri, 14-Feb-2025 12:22:36 GMT; Max-Age=7200; path=/; httponly
x-envoy-upstream-service-time: 108
cf-cache-status: DYNAMIC
vary: Accept-Encoding
server: cloudflare
cf-ray: 911c56836c9456b7-OSL
X-Firefox-Spdy: h2