{"report_id":"72831122-6494-4cca-91aa-e8955b2f3760","version":6,"status":"done","tags":[],"date":"2025-02-04T14:29:53Z","url":{"schema":"http","addr":"xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3","fqdn":"xz.927game.com","domain":"927game.com","tld":"com"},"ip":{"addr":"61.164.242.163","port":0,"asn":136190,"as":"JINHUA, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"final":{"url":{"schema":"http","addr":"xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3","fqdn":"xz.927game.com","domain":"927game.com","tld":"com"},"title":"xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"","expires_at":"2027-04-15T14:29:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"xz.927game.com","ip":{"addr":"61.164.242.163","port":0,"asn":136190,"as":"JINHUA, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"domain_registered":"2014-05-10","domain_rank":0,"first_seen":"2024-05-04T00:29:17Z","last_seen":"2025-01-24T09:27:15.807606Z","alert_count":2,"request_count":5,"received_data":1574503,"sent_data":1922,"comment":"","tags":null,"fingerprints":null}],"files":[{"md5":"8fb6645e0f40fe123077175c4df42271","sha1":"cf1c3299669174b73c55453880ed7ed8761cf196","sha256":"bb7cde734b33081dfdedb143f9953e2303f8d4d7d69af87a4908f8e7c5d08be9","sha512":"eadb9e3032bf75c2eff7c6f5146de29e2d43b5a341cf1171c761d5659d5b5b3d1f7b31aeae361c420e529f6e540201811870b934003ba972e7dd9e09e9bcb468","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","size":1569992,"url":{"schema":"http","addr":"xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3\u0026acnexa=wsnhg2","fqdn":"xz.927game.com","domain":"927game.com","tld":"com"},"ip":{"addr":"61.164.242.163","port":80,"asn":136190,"as":"JINHUA, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-11-07","alert":"Scan result 2/72","trigger":"bb7cde734b33081dfdedb143f9953e2303f8d4d7d69af87a4908f8e7c5d08be9","verdict":"suspicious","severity":"","comment":"suspicious - 2/72","link":"https://www.virustotal.com/gui/file/bb7cde734b33081dfdedb143f9953e2303f8d4d7d69af87a4908f8e7c5d08be9","meta":null}]}}],"artifacts":{"windows_shortcuts":null,"files":[{"md5":"8fb6645e0f40fe123077175c4df42271","sha1":"cf1c3299669174b73c55453880ed7ed8761cf196","sha256":"bb7cde734b33081dfdedb143f9953e2303f8d4d7d69af87a4908f8e7c5d08be9","sha512":"eadb9e3032bf75c2eff7c6f5146de29e2d43b5a341cf1171c761d5659d5b5b3d1f7b31aeae361c420e529f6e540201811870b934003ba972e7dd9e09e9bcb468","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","size":1569992,"url":{"schema":"http","addr":"xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3\u0026acnexa=wsnhg2","fqdn":"xz.927game.com","domain":"927game.com","tld":"com"},"ip":{"addr":"61.164.242.163","port":80,"asn":136190,"as":"JINHUA, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-11-07","alert":"Scan result 2/72","trigger":"bb7cde734b33081dfdedb143f9953e2303f8d4d7d69af87a4908f8e7c5d08be9","verdict":"suspicious","severity":"","comment":"suspicious - 2/72","link":"https://www.virustotal.com/gui/file/bb7cde734b33081dfdedb143f9953e2303f8d4d7d69af87a4908f8e7c5d08be9","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"","description":"","date":"2025-02-04T14:29:31Z","timestamp":1738679371,"ip_dst":{"addr":"172.18.0.6","port":52076,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"61.164.242.163","port":80,"asn":4134,"as":"Chinanet","country":"China","country_code":"CN"},"severity":"high","alert":"ET POLICY PE EXE or DLL Windows file download HTTP","source":"{\"timestamp\":\"2025-02-04T14:29:31.952249+0000\",\"flow_id\":584749668617178,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"61.164.242.163\",\"src_port\":80,\"dest_ip\":\"172.18.0.6\",\"dest_port\":52076,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.http.binary\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018959,\"rev\":4,\"signature\":\"ET POLICY PE EXE or DLL Windows file download HTTP\",\"category\":\"Potential Corporate Privacy Violation\",\"severity\":1,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2014_08_19\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_04_12\"]}},\"http\":{\"hostname\":\"xz.927game.com\",\"url\":\"/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3\u0026acnexa=wsnhg2\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"application/octet-stream\",\"http_refer\":\"http://xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":43556},\"files\":[{\"filename\":\"/pc/hidatarecovery_4654B612.exe\",\"sid\":[],\"gaps\":false,\"state\":\"TRUNCATED\",\"stored\":false,\"size\":43556,\"tx_id\":1}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":23,\"pkts_toclient\":33,\"bytes_toserver\":2193,\"bytes_toclient\":48355,\"start\":\"2025-02-04T14:29:27.445402+0000\"}}"}]}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3","fqdn":"xz.927game.com","domain":"927game.com","tld":"com"},"ip":{"addr":"61.164.242.163","port":80,"asn":136190,"as":"JINHUA, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":true,"md5":"524dc844efbc9f44280df817131c3413","sha1":"c6540854348d5e6f8e9e9dfbfa08a0638c1f7393","sha256":"72d0f0aa58bcbe8bb1369e71c24d370b5da8631f4f9152b27f9451ab3045e314","sha512":"4554ac272c1367c10868a49a87fa91bb4b0bd3a1e44e2c3c92073f180a0ba690ff377141913f052b1457533f13620b6c01b80ba99a7faf69689e95e3148f8d6a","ssdeep":"","tlshash":"45019c25269470aca8c04711df63148998601b6399fcb1af868ccbcbc921a5d5272739","size":736,"data":"","first_seen":"2025-02-04T14:29:56.150052Z","last_seen":"2025-02-04T14:29:56.150052Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":[{"md5":"806f70c86ed74635ff18e8e2be1f9b47","sha1":"4d78b4c2a68ce768c176cef5489cca99051df41a","sha256":"fafa62e3586487438c50606daf06e1b9dce425a372716f75c9d5c9d968c966bc","sha512":"0424765bd6c198dca91215ece31f1ce5bc8509702605a7a7ebcadc8e48e0608fed27937b192cf39426569566ec8700f99f05973ef86a31c8d034256fadea7675","ssdeep":"","tlshash":"95400030000000000000000000000ccc0000000030c00000000000000000c0000c0000","size":7,"data":"","first_seen":"2023-11-01T00:14:02Z","last_seen":"2025-02-04T14:29:56.151555Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"2cd47794e66dcac6f86341e673e5f6d2","sha1":"8a64f0adc95c040f1f7aea0fa0f27d546ed229a1","sha256":"6712456b77fd64edee70fc810913e671edc264ed9fb96f587e06db1106774ce3","sha512":"baa77873fd611cad69162fc50d325916bbbce39b69b1e9037d4a010a1eb5d85804bc1a5f9b1bf5d0d277bce0453173262f86ed50ec868314320ef62361f0a8b2","ssdeep":"","tlshash":"68a002611064543a91d28de9de4662d504405727513cb927053ed3078d322ca9372536","size":64,"data":"","first_seen":"2025-02-04T14:29:56.153298Z","last_seen":"2025-02-04T14:29:56.153298Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"919647661c0569f38742aae4dc9fb797","sha1":"49e61ce13033a083f1aaa9eabfef0b0d3e0395de","sha256":"3336b10e75c50aa219c2a18e1a46c0c768e6eb9bdc080d8a3921259f8f0102d2","sha512":"4f724fe48a67e16088d1ec41b1cd05305d785384b1ec68c86212305beecd673a3bb7953f01f43731240e6a13bf4c39050828993a43be0b8aee821fe8191ae321","ssdeep":"","tlshash":"8090043475d4403451710530d5c33405040447074474fd5ff40d571f05311d5d377330","size":53,"data":"","first_seen":"2025-02-04T14:29:56.154997Z","last_seen":"2025-02-04T14:29:56.154997Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"ba9f53a1914dda1c69f91485023d2dc2","sha1":"5cdc1cee9fe35574237e53233d2ff0b25c51c1b9","sha256":"94f6e6309aac6250a8f3e474b1763242022e46ae754361a2384d8867a1da6231","sha512":"9d41241a4c6856b562415550968627644526b2aec182d61df49f491ecdd97766ab5bc45a390355b094889543a3a41912ccf377c6aafdff142027e3e844bae7a4","ssdeep":"","tlshash":"35b011e00a20082c00c0ac30cb82228a200023232a38f2330e2fca038802a8ea233a30","size":91,"data":"","first_seen":"2025-02-04T14:29:56.156677Z","last_seen":"2025-02-04T14:29:56.156677Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"873cf9d302d7c208713dff561c6088e6","sha1":"02ea94dcca1ab1da45072db32f0943236e3c1937","sha256":"b1c76b41ad953af4bf9f8f3755f218e0cc545196eb782a3c6e363dd1227c140b","sha512":"8017ea7b42856a47d979f0eeeb34703260782bcb8755bdcf60e08eb807eea57db517e92e2cc120ac927bc0d3ee7ad050b39a7aab623d6e277bf5c16af8d0dd38","ssdeep":"","tlshash":"2e90022085741d94011114449b79965069599964855e5a64115c4362551012a9a59541","size":49,"data":"","first_seen":"2025-02-04T14:29:56.158708Z","last_seen":"2025-02-04T14:29:56.158708Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"xz.927game.com/","fqdn":"xz.927game.com","domain":"927game.com","tld":"com"},"ip":{"addr":"61.164.242.163","port":0,"asn":136190,"as":"JINHUA, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2025-02-04T14:29:27.026268437Z","timestamp":1738679367026,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: xz.927game.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: 857\r\nPragma: no-cache\r\nCache-control: no-store\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":857,"size_decoded":857,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (857), with no line terminators","md5":"6643a32a424173a3867a1814de81d13d","sha1":"282e1420571afe9cf02b3b13c081d4f58d13c0c4","sha256":"f4f38160e2df7f0058a24b250394b00ace92a3d55364e63c379a2912add591ac","sha512":"2e0bde24b8101cb6080b5ca707db9a8723b59a1a2fdb4a05b2d90a51776e7ba64e3959bec2e1f40894e186527b243b2f42437b81e77fc98d6bb4a10bae7a568d","ssdeep":"","tlshash":"5b11ce952a84b2cf2c81e40117e713ddcc21a0888d80ff87bf51781cc2a4a99e8b7f34","first_seen":"2025-02-04T14:29:56.14057Z","last_seen":"2025-02-04T14:29:56.14057Z","times_seen":1,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3","fqdn":"xz.927game.com","domain":"927game.com","tld":"com"},"ip":{"addr":"61.164.242.163","port":80,"asn":136190,"as":"JINHUA, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-02-04T14:29:27.197Z","timestamp":1738679367197,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /pc/hidatarecovery_4654B612.exe?manufc=0cbgp3 HTTP/1.1\r\nHost: xz.927game.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: 941\r\nPragma: no-cache\r\nCache-control: no-store\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":941,"size_decoded":941,"mime_type":"text/html","magic":"data","md5":"5c3ea6ed81f74f14d1b890ec52eb0ff9","sha1":"22f44340a5c6e12ffedaf1c5bae157f576d3250f","sha256":"58f0ed791d2e24aa9b1d187387d4fb558743f30897ee472b7d39148ce7789e4e","sha512":"9e69b38c26b01ebc4aa6f72ef61a57458188ed141283bf8b55579e1b8e5fdd5076533b5d4c89767281fa66b767304e5a7b5fc39938fde1fc7fb9ff04d185c02c","ssdeep":"","tlshash":"911140b92984f0dc6c810824de9761884c1aab631874f9ef646c868f8111a9ee2a3b30","first_seen":"2025-02-04T14:29:56.143459Z","last_seen":"2025-02-04T14:29:56.143459Z","times_seen":1,"resource_available":false,"data":null}},"time_used":769,"timings":{"blocked":253,"dns":1,"connect":257,"send":0,"wait":257,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"xz.927game.com/favicon.ico","fqdn":"xz.927game.com","domain":"927game.com","tld":"com"},"ip":{"addr":"61.164.242.163","port":80,"asn":136190,"as":"JINHUA, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3","date":"2025-02-04T14:29:28.056Z","timestamp":1738679368056,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: xz.927game.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html\r\nServer: Microsoft-IIS/10.0\r\nDate: Tue, 04 Feb 2025 14:29:27 GMT\r\nContent-Length: 1163\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":1163,"size_decoded":1163,"mime_type":"text/html","magic":"HTML document, ISO-8859 text, with CRLF line terminators","md5":"8363acaeab9cbb099b59b78a44127ca6","sha1":"aef448ce5500e3734059ec285cf6ec0b547075f2","sha256":"9b342ae7f25d65bdb817d8c995f3211ac398e41575fc5d149d994c1dcb008f0a","sha512":"a431f7ee4cdc3c7c6edf43736e007e314a0f8c4d05706dbdf75b629b15bee335d173abc071568f447d78b4c43aba02017c1993d6da86a1acdde904eb287cb30c","ssdeep":"","tlshash":"2821412987d42804faa7c4e170f2b3e63e478646f59b4b9fb4127257d5c26a6c1d3388","first_seen":"2023-04-05T10:47:33Z","last_seen":"2026-08-16T02:58:45.799844Z","times_seen":14644,"resource_available":false,"data":null}},"time_used":248,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":247,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"xz.927game.com/","fqdn":"xz.927game.com","domain":"927game.com","tld":"com"},"ip":{"addr":"61.164.242.163","port":0,"asn":136190,"as":"JINHUA, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2025-02-04T14:29:31.199439824Z","timestamp":1738679371199,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: xz.927game.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: 854\r\nPragma: no-cache\r\nCache-control: no-store\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":854,"size_decoded":854,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (854), with no line terminators","md5":"9473c363f6e626a052f5302c97a67a4c","sha1":"48cb240771084b71086d5c42fd8ab46982a4081c","sha256":"db182cc71a56feec39cfcc1d302e67e8ac1cc2fb525942cd043a0222b57bf59f","sha512":"e5df7385b827f939322113f45f99013a7d1e5b6ecbbab7aded384b8c2c0b6298d8431cee4fecd5d96d8bca5c8276591e0ddd6e01861f176630be118d149e05d4","ssdeep":"","tlshash":"800112873840b0fc37d28c192dd740d8ca13bd41dca5f728236006dd8795de5e8abb2a","first_seen":"2025-02-04T14:29:56.146732Z","last_seen":"2025-02-04T14:29:56.146732Z","times_seen":1,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3\u0026acnexa=wsnhg2","fqdn":"xz.927game.com","domain":"927game.com","tld":"com"},"ip":{"addr":"61.164.242.163","port":80,"asn":136190,"as":"JINHUA, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-02-04T14:29:31.220Z","timestamp":1738679371220,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /pc/hidatarecovery_4654B612.exe?manufc=0cbgp3\u0026acnexa=wsnhg2 HTTP/1.1\r\nHost: xz.927game.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/octet-stream\r\nLast-Modified: Thu, 13 Jun 2024 05:48:35 GMT\r\nAccept-Ranges: bytes\r\nETag: \"98ad2a5555bdda1:0\"\r\nServer: Microsoft-IIS/10.0\r\nDate: Tue, 04 Feb 2025 14:29:30 GMT\r\nContent-Length: 1569992\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1569992,"size_decoded":1569992,"mime_type":"application/octet-stream","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","md5":"8fb6645e0f40fe123077175c4df42271","sha1":"cf1c3299669174b73c55453880ed7ed8761cf196","sha256":"bb7cde734b33081dfdedb143f9953e2303f8d4d7d69af87a4908f8e7c5d08be9","sha512":"eadb9e3032bf75c2eff7c6f5146de29e2d43b5a341cf1171c761d5659d5b5b3d1f7b31aeae361c420e529f6e540201811870b934003ba972e7dd9e09e9bcb468","ssdeep":"24576:Hz1K8woP4nBkZYoj6TY49bf1htidJNF3EMQgiRLy1FCXc7bddDy+DWBN:T2kR6TY4Z7G4giJ0FCXcHddOj","tlshash":"be750151fbb1d072c86b52f44569931a6436ea640b391bd3e3d41f399e203e1af3b12e","first_seen":"2025-02-04T14:29:56.14824Z","last_seen":"2025-02-17T11:14:11.544647Z","times_seen":3,"resource_available":false,"data":null}},"time_used":19436,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":19187,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-02-04T14:29:31Z","timestamp":1738679371,"ip_dst":{"addr":"172.18.0.6","port":52076,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"61.164.242.163","port":80,"asn":4134,"as":"Chinanet","country":"China","country_code":"CN"},"severity":"high","alert":"ET POLICY PE EXE or DLL Windows file download HTTP","source":"{\"timestamp\":\"2025-02-04T14:29:31.952249+0000\",\"flow_id\":584749668617178,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"61.164.242.163\",\"src_port\":80,\"dest_ip\":\"172.18.0.6\",\"dest_port\":52076,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.http.binary\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018959,\"rev\":4,\"signature\":\"ET POLICY PE EXE or DLL Windows file download HTTP\",\"category\":\"Potential Corporate Privacy Violation\",\"severity\":1,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2014_08_19\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_04_12\"]}},\"http\":{\"hostname\":\"xz.927game.com\",\"url\":\"/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3\u0026acnexa=wsnhg2\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"application/octet-stream\",\"http_refer\":\"http://xz.927game.com/pc/hidatarecovery_4654B612.exe?manufc=0cbgp3\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":43556},\"files\":[{\"filename\":\"/pc/hidatarecovery_4654B612.exe\",\"sid\":[],\"gaps\":false,\"state\":\"TRUNCATED\",\"stored\":false,\"size\":43556,\"tx_id\":1}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":23,\"pkts_toclient\":33,\"bytes_toserver\":2193,\"bytes_toclient\":48355,\"start\":\"2025-02-04T14:29:27.445402+0000\"}}"}],"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-11-07","alert":"Scan result 2/72","trigger":"bb7cde734b33081dfdedb143f9953e2303f8d4d7d69af87a4908f8e7c5d08be9","verdict":"suspicious","severity":"","comment":"suspicious - 2/72","link":"https://www.virustotal.com/gui/file/bb7cde734b33081dfdedb143f9953e2303f8d4d7d69af87a4908f8e7c5d08be9","meta":null}],"urlquery":null}}]}