Report - update.walliant.com/walliant/1.0.1.2/walliant-1.0.13.2.exe

Report Overview

Visitedpublic

2024-08-01 16:31:55

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-31 18:12:05	2.9 kB	8.0 kB	23.36.76.226
update.walliant.com	300245	2020-04-15	2020-11-19 01:21:41	2023-11-27 14:19:05	512 B	5.9 MB	104.21.57.77

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

update.walliant.com/walliant/1.0.1.2/walliant-1.0.13.2.exe

IP / ASN

104.21.57.77

#13335 CLOUDFLARENET

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 10 sections

Size5.9 MB (5922696 bytes)

MD58765fee1a879c775157b8efba5e31401

SHA1af2f349223a08896bfe415266b3dee4c2c04a6eb

SHA25644c661fc5e87462693202e46549b725b0914a20371e459e1717584aed15bb43f

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 20/74

JavaScript (0)

HTTP Transactions (10)

URL IP Response Size

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-01

Last Seen2024-08-19

Times Seen14629

Size504 B (504 bytes)

MD51fc39f9a6ccc25867cc2924e625282d0

SHA1f859354fa7202cd2f2cbd279ad12ab0358c638d1

SHA256037bd31a93556f0a88d519cc4629ca3f8fcc94ffc357a71d34a133e5943c3b96

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "037BD31A93556F0A88D519CC4629CA3F8FCC94FFC357A71D34A133E5943C3B96"
Last-Modified: Thu, 01 Aug 2024 06:28:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17319
Expires: Thu, 01 Aug 2024 21:20:07 GMT
Date: Thu, 01 Aug 2024 16:31:28 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-01

Last Seen2024-08-19

Times Seen21208

Size504 B (504 bytes)

MD544e4b90088be23610d96d270d377406d

SHA1ce7ab232af453bb960a97435173b3ab09a376054

SHA25631567666bda7db348cd6e2ad94576da2c7240872f45e969fd6a52cf14440e95b

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "31567666BDA7DB348CD6E2AD94576DA2C7240872F45E969FD6A52CF14440E95B"
Last-Modified: Thu, 01 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3436
Expires: Thu, 01 Aug 2024 17:28:45 GMT
Date: Thu, 01 Aug 2024 16:31:29 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-01

Last Seen2024-08-19

Times Seen18732

Size504 B (504 bytes)

MD5b84a2e6efef529bac3e0d5dd309babe7

SHA1b22b4d0e8f84859a83b85939ae4c77d16fde0c93

SHA2569ed1020ce84380273c514b5c14a8705879d8233acaae13b428063bc7b83a067b

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "9ED1020CE84380273C514B5C14A8705879D8233ACAAE13B428063BC7B83A067B"
Last-Modified: Thu, 01 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14339
Expires: Thu, 01 Aug 2024 20:30:28 GMT
Date: Thu, 01 Aug 2024 16:31:29 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-01

Last Seen2024-08-19

Times Seen23373

Size504 B (504 bytes)

MD506f86a556a3bc0d04f36267a3081f07f

SHA13ca01a6761c66a9434a2ee060e2cb4b685b0b9f8

SHA256e9d373f8bcb454c3fc0b4e4d3768e5104c7f4cad03145468f9d2c0ff89c08143

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "E9D373F8BCB454C3FC0B4E4D3768E5104C7F4CAD03145468F9D2C0FF89C08143"
Last-Modified: Thu, 01 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5204
Expires: Thu, 01 Aug 2024 17:58:13 GMT
Date: Thu, 01 Aug 2024 16:31:29 GMT
Connection: keep-alive

update.walliant.com/walliant/1.0.1.2/walliant-1.0.13.2.exe

104.21.57.77

5.9 MB

URL

update.walliant.com/walliant/1.0.1.2/walliant-1.0.13.2.exe

IP / ASN

104.21.57.77

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 10 sections

First Seen2024-08-19

Last Seen2024-08-19

Times Seen1

Size5.9 MB (5922696 bytes)

MD58765fee1a879c775157b8efba5e31401

SHA1af2f349223a08896bfe415266b3dee4c2c04a6eb

SHA25644c661fc5e87462693202e46549b725b0914a20371e459e1717584aed15bb43f

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 20/74

HTTP Headers

GET /walliant/1.0.1.2/walliant-1.0.13.2.exe HTTP/1.1
Host: update.walliant.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 01 Aug 2024 16:31:29 GMT
content-type: application/octet-stream
content-length: 5922696
last-modified: Thu, 01 Aug 2024 16:31:29 GMT
strict-transport-security: max-age=15724800; includeSubDomains
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vxRqJm0KJP78kX8EJbPkTQGrNcm0%2BN1m%2B9VwnKH%2B4X7uGc0f160W7eMorkvJ2fdhQFV6o1LkJT8SNXYjrmtvazsnTUhLXFRLaoMtaN%2B1jUhfzHd5E6rsloEWIad4CvemMphZ1DCI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8ac73800d86ab524-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-01

Last Seen2024-08-19

Times Seen30862

Size504 B (504 bytes)

MD5086417994a199f2bbee25bd5c76ce9d7

SHA16de33407c60c52a9ed18403c3d0edebefec7c48a

SHA2560998db04ec6e07ad3a0ac6fb2410cd5d1c9ab6ea0b036c89c79f51f024e3a1f8

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "0998DB04EC6E07AD3A0AC6FB2410CD5D1C9AB6EA0B036C89C79F51F024E3A1F8"
Last-Modified: Thu, 01 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7090
Expires: Thu, 01 Aug 2024 18:29:40 GMT
Date: Thu, 01 Aug 2024 16:31:30 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-01

Last Seen2024-08-19

Times Seen30862

Size504 B (504 bytes)

MD5086417994a199f2bbee25bd5c76ce9d7

SHA16de33407c60c52a9ed18403c3d0edebefec7c48a

SHA2560998db04ec6e07ad3a0ac6fb2410cd5d1c9ab6ea0b036c89c79f51f024e3a1f8

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "0998DB04EC6E07AD3A0AC6FB2410CD5D1C9AB6EA0B036C89C79F51F024E3A1F8"
Last-Modified: Thu, 01 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7090
Expires: Thu, 01 Aug 2024 18:29:40 GMT
Date: Thu, 01 Aug 2024 16:31:30 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-01

Last Seen2024-08-19

Times Seen30862

Size504 B (504 bytes)

MD5086417994a199f2bbee25bd5c76ce9d7

SHA16de33407c60c52a9ed18403c3d0edebefec7c48a

SHA2560998db04ec6e07ad3a0ac6fb2410cd5d1c9ab6ea0b036c89c79f51f024e3a1f8

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "0998DB04EC6E07AD3A0AC6FB2410CD5D1C9AB6EA0B036C89C79F51F024E3A1F8"
Last-Modified: Thu, 01 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7090
Expires: Thu, 01 Aug 2024 18:29:40 GMT
Date: Thu, 01 Aug 2024 16:31:30 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-01

Last Seen2024-08-19

Times Seen30862

Size504 B (504 bytes)

MD5086417994a199f2bbee25bd5c76ce9d7

SHA16de33407c60c52a9ed18403c3d0edebefec7c48a

SHA2560998db04ec6e07ad3a0ac6fb2410cd5d1c9ab6ea0b036c89c79f51f024e3a1f8

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "0998DB04EC6E07AD3A0AC6FB2410CD5D1C9AB6EA0B036C89C79F51F024E3A1F8"
Last-Modified: Thu, 01 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7090
Expires: Thu, 01 Aug 2024 18:29:40 GMT
Date: Thu, 01 Aug 2024 16:31:30 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-01

Last Seen2024-08-19

Times Seen30862

Size504 B (504 bytes)

MD5086417994a199f2bbee25bd5c76ce9d7

SHA16de33407c60c52a9ed18403c3d0edebefec7c48a

SHA2560998db04ec6e07ad3a0ac6fb2410cd5d1c9ab6ea0b036c89c79f51f024e3a1f8

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "0998DB04EC6E07AD3A0AC6FB2410CD5D1C9AB6EA0B036C89C79F51F024E3A1F8"
Last-Modified: Thu, 01 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7090
Expires: Thu, 01 Aug 2024 18:29:40 GMT
Date: Thu, 01 Aug 2024 16:31:30 GMT
Connection: keep-alive