IP 36.248.38.100:0
ASN#4837 CHINA UNICOM China169 Backbone
Hashea3673356729492f1247bb269aa67b9c 54c5af10c4b7dd4a88701abe49d5daf2d4be7112 c9dd9a4e1280c225d044905f2b83e19826a3cb81ed8c1572b02b87f2cfdd0c1d
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 600
Connection: keep-alive
vary: Accept-Encoding
last-modified: Fri, 03 May 2024 02:27:45 GMT
etag: "54c5af10c4b7dd4a88701abe49d5daf2d4be7112"
accept-ranges: bytes
x-ccacdn-proxy-id: scdpinlb3
date: Sat, 04 May 2024 23:58:00 GMT
x-frame-options: SAMEORIGIN
age: 2455
cf-ray: 87dd1f4fce1f04fd-HKG
expires: Fri, 10 May 2024 02:27:44 GMT
cache-control: max-age=3600
request-id: 6636cb88b84d27de285e2b505f4f2562
cf-cache-status: EXPIRED
ctl-cache-status: HIT from hk-xianggang4-ca01, HIT from fj-quanzhou7-ca38, HIT from cq-yuzhong1-ca33
via: n172-013-216.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 17148670805a4affb9bd5f1888f24ab900d26715b4
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=48, edge;dur=0
|
IP36.248.38.100:0 ASN#4837 CHINA UNICOM China169 Backbone
Hashea3673356729492f1247bb269aa67b9c 54c5af10c4b7dd4a88701abe49d5daf2d4be7112 c9dd9a4e1280c225d044905f2b83e19826a3cb81ed8c1572b02b87f2cfdd0c1d
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 600
Connection: keep-alive
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cf-ray: 87dd1f4fce1f04fd-HKG
accept-ranges: bytes
request-id: 6636cb88a888b7de420ae59a29f5eb83
ctl-cache-status: HIT from hk-xianggang4-ca01, HIT from fj-quanzhou7-ca38, HIT from zj-shaoxing1-ca06
expires: Fri, 10 May 2024 02:27:44 GMT
etag: "54c5af10c4b7dd4a88701abe49d5daf2d4be7112"
cache-control: max-age=3600
cf-cache-status: EXPIRED
age: 954
date: Sat, 04 May 2024 23:58:00 GMT
last-modified: Fri, 03 May 2024 02:27:45 GMT
x-ccacdn-proxy-id: scdpinlb3
via: n172-013-216.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 1714867080e34eb9a7d251d2dc574f544865d9fe27
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=24, edge;dur=0
|
| dl.baofeng.com/baofeng5/bf5_new.exe | 61.134.72.107 | | 1.3 MB |
URL User Request GET dl.baofeng.com/baofeng5/bf5_new.exe IP61.134.72.107:0
File typePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections Size1.3 MB (1335543 bytes) Hash308da983e203723eb85fb8766904c1d9 b3a58f92a91c4ef9ce329ce5a3fb72088bf4bcd7 9e9975fcce2d2419eb27a2b98def3b7ed6800fcc8ee2b3d3e59f30be3a75c1d6
| Analyzer | Verdict | Alert |
|---|
| YARAhub by abuse.ch | malware | meth_get_eip |
GET /baofeng5/bf5_new.exe HTTP/1.1
Host: dl.baofeng.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 04 May 2024 23:58:01 GMT
Content-Type: application/octet-stream
Content-Length: 106583344
Connection: keep-alive
Age: 778
Last-Modified: Wed, 30 Aug 2023 04:56:13 GMT
ETag: "64eecbed-65a5530"
Via: pa-ct-shandong-63-89, ed-ct-gansu-72-82
Accept-Ranges: bytes
Server: openresty
|