Report Overview
Submitted URL
wsj.pm/download.php
IP
103.113.70.37
ASN
#44477 Stark Industries Solutions Ltd
Submitted
2024-04-24 23:19:16
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected
Detections
urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
12
Domain Summary
Domain / FQDN | Rank | Registered | First Seen | Last Seen | Sent | Received | IP |
---|---|---|---|---|---|---|---|
wsj.pm | unknown | unknown | No data | No data | 473 B | 250 B | 103.113.70.37 |
cdn40.click | unknown | 2024-04-12 | 2024-04-12 | 2024-04-13 | 480 B | 1.1 MB | 23.133.88.190 |
Related reports
Network Intrusion Detection Systems
Suricata /w Emerging Threats Pro
Threat Detection Systems
Public InfoSec YARA rules
No alerts detected
OpenPhish
No alerts detected
PhishTank
No alerts detected
mnemonic secure dns
No alerts detected
Quad9 DNS
Scan Date | Severity | Indicator | Alert |
---|---|---|---|
2024-04-24 | medium | wsj.pm | Sinkholed |
2024-04-24 | medium | cdn40.click | Sinkholed |
ThreatFox
No alerts detected
Files detected
URL
cdn40.click/files/WSJ.msix
IP
23.133.88.190
ASN
#400509 ASIPFB
File type
Zip archive data, at least v4.5 to extract, compression method=deflate
Size
1.1 MB (1064965 bytes)
Hash
2bcb8f589ca7f5910883dad50b7e11df
9a29d41b5afec950f90daef45762455c47b7098d
Archive (19)
Filename | Md5 | File type | |||
---|---|---|---|---|---|
Registry.dat | d6d491ead08dd6e57365a6c6d88e798b | MS Windows registry file, NT/2000 or above | |||
User.dat | 8c2e3e2ba4eb2f2a40053c25cae3d151 | MS Windows registry file, NT/2000 or above | |||
logo.png | bd8eec2ceb75ea0dbc773ffa0d097b5b | PNG image data, 225 x 225, 8-bit colormap, non-interlaced | |||
config.json | a02bb2e4d00e3ba24a02da8efb2c2897 | JSON text data | |||
tOUKLPvSz.ps1 | 32994275839f2581ee6f3836d8e4dc04 | ASCII text | |||
PsfLauncher32.exe | e005414b82df848717581bd260725b02
| PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections | |||
PsfLauncher64.exe | bfcb4275530e99a5e3fca4614a645fb5
| PE32+ executable (GUI) x86-64, for MS Windows, 7 sections | |||
PsfRunDll32.exe | 96376177175a1b23a95c6498e9ffb2b5
| PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections | |||
PsfRunDll64.exe | 8466f69926a22670dcf6515a4fc3c054
| PE32+ executable (GUI) x86-64, for MS Windows, 7 sections | |||
PsfRuntime32.dll | a9f0eeb621dd5883258113cc4b490929
| PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 8 sections | |||
PsfRuntime64.dll | 61863b4c1aeefe10d69f54c03d373fd5
| PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 10 sections | |||
Resources.pri | ce102c4b1736bf61f34e14f0173fee89 | data | |||
StartingScriptWrapper.ps1 | da5bf3010154020db9db4cf8832b42ea | ASCII text, with CRLF line terminators | |||
PsfRunDll64.exe | 8466f69926a22670dcf6515a4fc3c054
| PE32+ executable (GUI) x86-64, for MS Windows, 7 sections | |||
AppxManifest.xml | 96f7351744d6634543522c06a3bac5b3 | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (454), with CRLF line terminators | |||
AppxBlockMap.xml | b3d4042b64606093790944886f6934e2 | XML 1.0 document, ASCII text, with very long lines (4464), with CRLF line terminators | |||
[Content_Types].xml | ba939dd49282f3a33257c97e9cc46dcf | XML 1.0 document, ASCII text, with very long lines (817), with CRLF line terminators | |||
CodeIntegrity.cat | 11bf9ac5bd7c0a23c4c8ab7d130d066d | DER Encoded PKCS#7 Signed Data | |||
AppxSignature.p7x | 7d82356ca0c82928cae8164ad50fe4fa | data |
Detections
Analyzer | Verdict | Alert |
---|---|---|
YARAhub by abuse.ch | malware | files - file ~tmp01925d3f.exe |
YARAhub by abuse.ch | malware | files - file ~tmp01925d3f.exe |
YARAhub by abuse.ch | malware | files - file ~tmp01925d3f.exe |
YARAhub by abuse.ch | malware | files - file ~tmp01925d3f.exe |
YARAhub by abuse.ch | malware | files - file ~tmp01925d3f.exe |
YARAhub by abuse.ch | malware | files - file ~tmp01925d3f.exe |
YARAhub by abuse.ch | malware | files - file ~tmp01925d3f.exe |
VirusTotal | malicious |
JavaScript (0)
HTTP Transactions (2)
URL | IP | Response | Size | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
wsj.pm/download.php | 103.113.70.37 | 0 B | |||||||||||
Detections
HTTP Headers
| |||||||||||||
cdn40.click/files/WSJ.msix | 23.133.88.190 | 200 OK | 1.1 MB | ||||||||||
Detections
HTTP Headers
| |||||||||||||