IP47.246.44.205:0 ASN#24429 Zhejiang Taobao Network Co.,Ltd
Hash6b14d338fd674a5acca006ee57385186 65c25f03ef622cd927efba8797350a01ec6b25c1 fb7c3773130b2e2f027c7562c4db018e515fddc0c759967ea22adad5f4a34b5c
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
date: Fri, 02 Jun 2023 01:37:21 GMT
last-modified: Wed, 31 May 2023 20:07:07 GMT
expires: Wed, 07 Jun 2023 20:07:06 GMT
etag: "65c25f03ef622cd927efba8797350a01ec6b25c1"
cache-control: max-age=598422,s-maxage=1800,public,no-transform,must-revalidate
x-ccacdn-proxy-id: mcdpinlb6
x-frame-options: SAMEORIGIN
cf-cache-status: REVALIDATED
cf-ray: 7d0bf87dbb6c365d-FRA
accept-ranges: bytes
ali-swift-global-savetime: 1685669841
via: cache15.l2de2[0,0,304-0,H], cache2.l2de2[1,0], cache3.se1[0,0,200-0,H], cache1.se1[1,0], cache8.se1[3,0]
age: 47
x-cache: HIT TCP_MEM_HIT dirn:1:393712755
x-swift-savetime: Fri, 02 Jun 2023 01:37:58 GMT
x-swift-cachetime: 1763
timing-allow-origin: *, *
eagleid: 2ff62c9c16856698882273035e, 2ff62c9c16856698882273035e
|
| dow.andylab.cn/cs-daili.exe | 3.126.195.33 | 200 OK | 303 kB |
URL User Request GET HTTP/1.1dow.andylab.cn/cs-daili.exe IP3.126.195.33:80
File typePE32 executable (GUI) Intel 80386, for MS Windows\012- data Size303 kB (303104 bytes) Hash4adcb0f7a3d272d2897488bc269a102b 6eba2700f071030c82cfaa6165f2439f2865c02d a59992138030f8f040b0048d8e7e1faf429bdfd2d0ef1ea26fecb90f40a862ed
Analyzer | Verdict | Alert | VirusTotal | 13/70 | |
NIDS | Severity | Alert | suricata | high | ET POLICY PE EXE or DLL Windows file download HTTP |
GET /cs-daili.exe HTTP/1.1
Host: dow.andylab.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Accept-Ranges: bytes
ETag: "06666386c6d71:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 02 Jun 2023 01:38:00 GMT
Last-Modified: Thu, 21 Oct 2021 14:17:32 GMT
Content-Length: 303104
X-NWS-LOG-UUID: 3672409518209713352
Connection: keep-alive
X-Cache-Lookup: Cache Miss
Cache-Control: max-age=0
|