Report - hc119.com/PatchFile/nHcUser//full_compres/win8

Report Overview

Submitted URL
hc119.com/PatchFile/nHcUser//full_compres/win8_x64/full.zip
IP
211.47.66.172
ASN
#9318 SK Broadband Co Ltd
Submitted
2024-03-29 05:09:28
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
status.thawte.com	5123	1996-02-10	2017-11-27	2024-03-28	329 B	642 B	192.229.221.95
hc119.com	unknown	2003-08-14	2017-02-02	2024-01-31	513 B	732 kB	211.47.66.172

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
hc119.com/PatchFile/nHcUser//full_compres/win8_x64/full.zip
IP
211.47.66.172
ASN
#9318 SK Broadband Co Ltd

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
732 kB (732259 bytes)
Hash
1a533ce46b5066e447c9fe301bc01c52
4f34813ed6612dddb6ae4d44d46451b2d64365ce
e092b5b005921aa898925b2c6d7041ccc6eb80d01979e8337870ecab665b5a1f

Archive (7)

Filename

Md5

File type

CnePCInfo.exe

3f8956503d198c9b0751ff96ebfde28c

PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

HelpHooks.dll

81e3096009f7b4206c50e86a48b01031

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

nHcCAD.exe

5c23a4ad152e26761ee877f4512c247e

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

nHcService.exe

215c43d0627b99c63d3b83c33cf31fdd

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

nHcUser.exe

800bdfa6a2b287c1d67150d0936b8cb0

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

nHcUserIPC.exe

9799cc02452885417ae5f7faee33ec90

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

StringUser.ini

23bec826497b40dc48a2ae15492471f1

Unicode text, UTF-16, little-endian text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 13/66

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

status.thawte.com/

192.229.221.95

471 B

URL
status.thawte.com/
IP
192.229.221.95:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
3b8e9088dd634b087821fc3c3d6adc35
03de0520fe72a1bbe81ef8c025a94d1b6f61154b
12c5fce88268c68ec1398e65bd19fe63d06538410d09b499ff64b931d1877241

HTTP Headers

POST / HTTP/1.1
Host: status.thawte.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=7200
Content-Type: application/ocsp-response
Date: Fri, 29 Mar 2024 05:09:03 GMT
Server: ECAcc (amb/6B53)
Content-Length: 471

hc119.com/PatchFile/nHcUser//full_compres/win8_x64/full.zip

211.47.66.172

200

732 kB

URL User Request GET HTTP/1.1
hc119.com/PatchFile/nHcUser//full_compres/win8_x64/full.zip
IP
211.47.66.172:443
ASN
#9318 SK Broadband Co Ltd

Certificate
IssuerDigiCert Inc
Subjectwww.hc119.com
FingerprintD6:2F:63:91:DB:5C:40:C7:7E:89:D6:41:F4:C5:70:64:FC:DE:C4:D4
ValidityThu, 06 Jul 2023 00:00:00 GMT - Mon, 05 Aug 2024 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
732 kB (732259 bytes)
Hash
1a533ce46b5066e447c9fe301bc01c52
4f34813ed6612dddb6ae4d44d46451b2d64365ce
e092b5b005921aa898925b2c6d7041ccc6eb80d01979e8337870ecab665b5a1f

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 13/66

HTTP Headers

GET /PatchFile/nHcUser//full_compres/win8_x64/full.zip HTTP/1.1
Host: hc119.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Accept-Ranges: bytes
ETag: W/"732259-1680659840272"
Last-Modified: Wed, 05 Apr 2023 01:57:20 GMT
Content-Type: application/zip
Content-Length: 732259
Date: Fri, 29 Mar 2024 05:08:58 GMT

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (7)

Detections

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers