Report - pkg-store.dl.mail.ru/packages/shop/0_2000239distrib2/Bin/NVServer.exe

Report Overview

Visitedpublic

2024-05-27 19:32:38

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
pkg-store.dl.mail.ru	unknown	1997-09-27	2020-05-26 22:50:12	2020-05-29 13:03:59	523 B	157 kB	188.93.63.73

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-05-27	medium	pkg-store.dl.mail.ru/packages/shop/0_2000239distrib2/Bin/NVServer.exe	meth_get_eip

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

pkg-store.dl.mail.ru/packages/shop/0_2000239distrib2/Bin/NVServer.exe

IP / ASN

188.93.63.73

#47764 LLC VK

File Overview

File TypePE32 executable (console) Intel 80386, for MS Windows, 7 sections

Size157 kB (156576 bytes)

MD5c839696878dc2f7e2c56f55eee547519

SHA174761621cf5839120c89fac26cfd6872568049ae

SHA25644b350126dec055f0adcfb11e365bdc6aed71148727324bdce636d83aa5630c1

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
VirusTotal	suspicious	VirusTotal - Scan result 2/74

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET pkg-store.dl.mail.ru/packages/shop/0_2000239distrib2/Bin/NVServer.exe

188.93.63.73

200 OK

157 kB

URL

pkg-store.dl.mail.ru/packages/shop/0_2000239distrib2/Bin/NVServer.exe

IP / ASN

188.93.63.73

#47764 LLC VK

Requested byN/A

Resource Info

File typePE32 executable (console) Intel 80386, for MS Windows, 7 sections

First Seen2023-04-07

Last Seen2025-03-12

Times Seen31

Size157 kB (156576 bytes)

MD5c839696878dc2f7e2c56f55eee547519

SHA174761621cf5839120c89fac26cfd6872568049ae

SHA25644b350126dec055f0adcfb11e365bdc6aed71148727324bdce636d83aa5630c1

Certificate Info

IssuerGlobalSign nv-sa

Subject*.dl.mail.ru

Fingerprint4B:CA:BA:E3:5F:84:FA:DB:F7:FB:4F:1A:3D:30:CD:A7:15:EC:17:CC

ValidityThu, 14 Sep 2023 11:20:00 GMT - Tue, 15 Oct 2024 11:19:59 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
VirusTotal	suspicious	VirusTotal - Scan result 2/74

HTTP Headers

GET /packages/shop/0_2000239distrib2/Bin/NVServer.exe HTTP/1.1
Host: pkg-store.dl.mail.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.18.0
date: Mon, 27 May 2024 19:32:13 GMT
content-type: application/octet-stream
content-length: 156576
last-modified: Tue, 16 Jan 2018 13:34:48 GMT
etag: "5a5dff78-263a0"
accept-ranges: bytes
X-Firefox-Spdy: h2