Report - tj.shwswl.cn/3dm_ylcs.exe?auth_key=1681435188-0-0-1c9d8146027e48feb5bbe924e22ca9e4

Report Overview

Visitedpublic

2024-10-01 19:18:12

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-09-30 18:12:17	1.3 kB	3.5 kB	23.36.76.226
r11.o.lencr.org	unknown	2020-06-29	2024-06-07 07:43:57	2024-09-30 18:12:04	654 B	1.8 kB	23.36.76.226
tj.shwswl.cn	743847	2016-08-11	2020-07-28 12:39:46	2024-09-25 14:26:29	536 B	58 MB	14.29.101.160

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

tj.shwswl.cn/3dm_ylcs.exe?auth_key=1681435188-0-0-1c9d8146027e48feb5bbe924e22ca9e4

IP / ASN

14.29.101.160

#4134 Chinanet

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

Size58 MB (57546793 bytes)

MD5e45e027d46ea1bcaade9398ed0e5ae4e

SHA10bdf79ba12ee0381d056d07570726eee4047175c

SHA25682fc91414fb9999725d5685921a58479aa2703adc69c5b944fed48091612557b

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 35/69

JavaScript (0)

HTTP Transactions (7)

URL IP Response Size

r10.o.lencr.org/

23.36.76.226

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-30

Last Seen2024-10-04

Times Seen13305

Size504 B (504 bytes)

MD5a8901baef26e06d1c6a8d84e9cc7c99d

SHA145039e57582ddc5f8ca1332f81326182633c5e39

SHA256a7d111d2a198a732c3607681e4045192bcbcff213cee531c0a90d349605d5306

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A7D111D2A198A732C3607681E4045192BCBCFF213CEE531C0A90D349605D5306"
Last-Modified: Mon, 30 Sep 2024 16:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9673
Expires: Tue, 01 Oct 2024 21:58:58 GMT
Date: Tue, 01 Oct 2024 19:17:45 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-01

Last Seen2024-10-04

Times Seen13976

Size504 B (504 bytes)

MD59e96f1dff1bb5e6784958d21556e4a06

SHA1d4cb719b5fe9714d59866434ca13c389776a09f3

SHA25601b80c0b028333e119cbc3799424875028f0548b6e95d94e7738874c59883c00

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "01B80C0B028333E119CBC3799424875028F0548B6E95D94E7738874C59883C00"
Last-Modified: Mon, 30 Sep 2024 16:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9542
Expires: Tue, 01 Oct 2024 21:56:47 GMT
Date: Tue, 01 Oct 2024 19:17:45 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-01

Last Seen2024-10-04

Times Seen3259

Size504 B (504 bytes)

MD5280abd583680094ddddb480769f3f61b

SHA126caab6dbbf50ba7442d0e3bd1c4a81b5e6d9236

SHA2568fc210d2f8ca54ae085b92a142cce3621730daf7a76e83076630e20d18f789cd

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "8FC210D2F8CA54AE085B92A142CCE3621730DAF7A76E83076630E20D18F789CD"
Last-Modified: Tue, 01 Oct 2024 04:04:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5900
Expires: Tue, 01 Oct 2024 20:56:06 GMT
Date: Tue, 01 Oct 2024 19:17:46 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-01

Last Seen2024-10-04

Times Seen9948

Size504 B (504 bytes)

MD55e3f6fc68f86be07d377aea0e7496870

SHA19d1005d0782906dfdfe4217125b907b86a22b530

SHA256c6309b6effe12dabaacc99df66e13fba72de8198e5bccf67198400576e3158da

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "C6309B6EFFE12DABAACC99DF66E13FBA72DE8198E5BCCF67198400576E3158DA"
Last-Modified: Mon, 30 Sep 2024 16:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14972
Expires: Tue, 01 Oct 2024 23:27:18 GMT
Date: Tue, 01 Oct 2024 19:17:46 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL HTTP

r11.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-01

Last Seen2024-10-04

Times Seen5663

Size504 B (504 bytes)

MD58effaf713ecfaf968a658e5727aa9938

SHA12229078c48d23c1b17803a1e501bf6410c3522c9

SHA256672455d99075a4581ae850704b23720ba3b94691e1038b939a5165a3b274d7f9

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "672455D99075A4581AE850704B23720BA3B94691E1038B939A5165A3B274D7F9"
Last-Modified: Mon, 30 Sep 2024 15:53:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12086
Expires: Tue, 01 Oct 2024 22:39:14 GMT
Date: Tue, 01 Oct 2024 19:17:48 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL HTTP

r11.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-01

Last Seen2024-10-04

Times Seen5663

Size504 B (504 bytes)

MD58effaf713ecfaf968a658e5727aa9938

SHA12229078c48d23c1b17803a1e501bf6410c3522c9

SHA256672455d99075a4581ae850704b23720ba3b94691e1038b939a5165a3b274d7f9

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "672455D99075A4581AE850704B23720BA3B94691E1038B939A5165A3B274D7F9"
Last-Modified: Mon, 30 Sep 2024 15:53:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12086
Expires: Tue, 01 Oct 2024 22:39:14 GMT
Date: Tue, 01 Oct 2024 19:17:48 GMT
Connection: keep-alive

GET tj.shwswl.cn/3dm_ylcs.exe?auth_key=1681435188-0-0-1c9d8146027e48feb5bbe924e22ca9e4

14.29.101.160

200 OK

58 MB

URL User Request GET HTTPS

tj.shwswl.cn/3dm_ylcs.exe?auth_key=1681435188-0-0-1c9d8146027e48feb5bbe924e22ca9e4

IP / ASN

14.29.101.160

#4134 Chinanet

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

First Seen2023-07-13

Last Seen2024-12-01

Times Seen42

Size58 MB (57546793 bytes)

MD5e45e027d46ea1bcaade9398ed0e5ae4e

SHA10bdf79ba12ee0381d056d07570726eee4047175c

SHA25682fc91414fb9999725d5685921a58479aa2703adc69c5b944fed48091612557b

Certificate Info

IssuerDigiCert Inc

Subject*.shwswl.cn

Fingerprint2C:6F:95:8A:99:58:8F:80:73:77:2D:F0:84:90:10:91:36:EA:1E:4E

ValidityMon, 20 May 2024 00:00:00 GMT - Tue, 20 May 2025 23:59:59 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 35/69

HTTP Headers

GET /3dm_ylcs.exe?auth_key=1681435188-0-0-1c9d8146027e48feb5bbe924e22ca9e4 HTTP/1.1
Host: tj.shwswl.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty
date: Tue, 01 Oct 2024 19:17:47 GMT
content-type: application/octet-stream
content-length: 57546793
last-modified: Mon, 21 Nov 2022 03:52:57 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
accept-ranges: bytes
cache-control: max-age=604800
etag: "637af619-36e1829"
age: 508982
ctl-cache-status: HIT from hb-wuhan9-ca15, HIT from gd-guangzhou8-ca11
request-id: 65a066fc4adb0e1daa6b2c529f15d2c5
X-Firefox-Spdy: h2