Report - 113.177.55.93/webplugin.exe

Report Overview

Visited public
2024-10-26 23:04:02
Tags
Submit Tags
URL
113.177.55.93/webplugin.exe
Finishing URL
about:privatebrowsing
IP / ASN
113.177.55.93
#45899 VNPT Corp
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
113.177.55.93	unknown	unknown	No data	No data	397 B	2.2 MB	113.177.55.93

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-10-26 23:03:38	medium	Client IP	113.177.55.93	ET INFO Executable Download from dotted-quad Host
2024-10-26 23:03:38	high	113.177.55.93	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP
2024-10-26 23:03:38	medium	113.177.55.93	Client IP	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-10-26	medium	113.177.55.93/webplugin.exe	Detect files is `SliverFox` malware

OpenPhish

No alerts detected

PhishTank

No alerts detected

Mnemonic Secure DNS

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-10-26	medium	113.177.55.93	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET 113.177.55.93/webplugin.exe

113.177.55.93

200 OK

2.2 MB

URL User Request GET HTTP/1.1
113.177.55.93/webplugin.exe
IP
113.177.55.93:80
ASN
#45899 VNPT Corp

File type
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
Size
2.2 MB (2191315 bytes)
Hash
06e39bee8bded95bce6e8e0a52c471b8
1ec24bc193cd5d42dd62e81295762d66300c8076
f62d832265390856180f791b57c380702eab18e48ab4e28a260381e3e95d7c80

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware
Quad9 DNS	malicious	Sinkholed
VirusTotal	malicious	VirusTotal - Scan result 13/72

NIDS	Severity	Alert
suricata	medium	ET INFO Executable Download from dotted-quad Host
suricata	high	ET POLICY PE EXE or DLL Windows file download HTTP
suricata	medium	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response

HTTP Headers

GET /webplugin.exe HTTP/1.1
Host: 113.177.55.93
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
CONNECTION: close
Date: Sun, 27 Oct 2024 06:03:38 GMT
Last-Modified: Fri, 01 Feb 2019 02:33:05 GMT
Etag: "1548988385:216fd3"
CONTENT-LENGTH: 2191315
P3P: CP=CAO PSA OUR
X-Frame-Options: SAMEORIGIN
CONTENT-TYPE: application/octet-stream

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Mnemonic Secure DNS

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers