Report - bankofamierca.com/E.exe

Report Overview

Submitted URL

bankofamierca.com/E.exe
IP

46.166.189.98

ASN

#43350 NForce Entertainment B.V.
Submitted

2023-09-26T17:46:38Z

Access

public
Website Title

noannualfeecreditcards.org/E.exe
Final URL

www.noannualfeecreditcards.org/E.exe
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

2
Threat Detection Systems

0

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
bankofamierca.com (1)	unknown	2017-05-11 04:25:40	2023-09-26 10:28:20	395	258	46.166.189.98
www.noannualfeecreditcards.org (3)	unknown	2015-07-02 22:35:32	2023-09-26 10:28:03	1284	510	103.224.182.246

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-09-26T17:46:21Z	high	Client IP	46.166.189.98	ET MALWARE Single char EXE direct download likely trojan (multiple families)
2023-09-26T17:46:23Z	high	Client IP	103.224.182.246	ET MALWARE Single char EXE direct download likely trojan (multiple families)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (4)

URL IP Response Size

bankofamierca.com/E.exe

46.166.189.98

302 Moved Temporarily

URL User Request GET HTTP/1.1

bankofamierca.com/E.exe
IP

46.166.189.98:80
ASN

#43350 NForce Entertainment B.V.

Magic

very short file (no magic)

Size

1
Hash

68b329da9893e34099c7d8ad5cb9c940

adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Detections

NIDS	Severity	Alert
suricata	high	ET MALWARE Single char EXE direct download likely trojan (multiple families)

HTTP Headers

                                        GET /E.exe HTTP/1.1
Host: bankofamierca.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Tue, 26 Sep 2023 18:56:21 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.6.33
location: http://www.noannualfeecreditcards.org/E.exe

www.noannualfeecreditcards.org/E.exe

103.224.182.246

403 Forbidden

URL User Request GET HTTP/1.0

www.noannualfeecreditcards.org/E.exe
IP

103.224.182.246:443
ASN

#133618 Trellian Pty. Limited

Certificate

IssuerLet's Encrypt

Subjectnot-alone.de

FingerprintB0:4A:FD:4E:B0:12:8C:4C:37:EA:33:FE:3F:95:11:9F:11:CD:F0:FE

ValidityMon, 07 Aug 2023 00:03:00 GMT - Sun, 05 Nov 2023 00:02:59 GMT

Magic

HTML document, ASCII text, with no line terminators

Size

94
Hash

586e5879c0666b49307b1206e45d3a4f

c17c169c84535495ae36f5e956f3a4802874e0b1

8eb0c96561f744076e699a97c54fc207b905997c65a31a5d73bb826df406f08d

Detections

NIDS	Severity	Alert
suricata	high	ET MALWARE Single char EXE direct download likely trojan (multiple families)

HTTP Headers

                                        GET /E.exe HTTP/1.1
Host: www.noannualfeecreditcards.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.0 403 Forbidden
cache-control: no-cache
content-type: text/html

www.noannualfeecreditcards.org/E.exe

103.224.182.246

403 Forbidden

URL User Request GET HTTP/1.0

www.noannualfeecreditcards.org/E.exe
IP

103.224.182.246:80
ASN

#133618 Trellian Pty. Limited

Magic

HTML document, ASCII text, with no line terminators

Size

94
Hash

586e5879c0666b49307b1206e45d3a4f

c17c169c84535495ae36f5e956f3a4802874e0b1

8eb0c96561f744076e699a97c54fc207b905997c65a31a5d73bb826df406f08d

Detections

NIDS	Severity	Alert
suricata	high	ET MALWARE Single char EXE direct download likely trojan (multiple families)

HTTP Headers

                                        GET /E.exe HTTP/1.1
Host: www.noannualfeecreditcards.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.0 403 Forbidden
cache-control: no-cache
content-type: text/html

www.noannualfeecreditcards.org/favicon.ico

103.224.182.246

403 Forbidden

URL GET HTTP/1.0

www.noannualfeecreditcards.org/favicon.ico
IP

103.224.182.246:80
ASN

#133618 Trellian Pty. Limited

Requested by

http://www.noannualfeecreditcards.org/E.exe

Magic

HTML document, ASCII text, with no line terminators

Size

94
Hash

586e5879c0666b49307b1206e45d3a4f

c17c169c84535495ae36f5e956f3a4802874e0b1

8eb0c96561f744076e699a97c54fc207b905997c65a31a5d73bb826df406f08d

HTTP Headers

                                        GET /favicon.ico HTTP/1.1
Host: www.noannualfeecreditcards.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.noannualfeecreditcards.org/E.exe
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.0 403 Forbidden
cache-control: no-cache
content-type: text/html

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (4)

URL User Request GET HTTP/1.1

IP

ASN

Magic

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.0

IP

ASN

Certificate

Magic

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.0

IP

ASN

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.0

IP

ASN

Requested by

Magic

Size

Hash

HTTP Headers