Report - unicorpbrunei.com/Products/pacific

Report Overview

Visited public
2023-10-21 12:09:45
Tags
Submit Tags
URL
unicorpbrunei.com/Products/pacific_polymers/images/images.exe
Finishing URL
about:privatebrowsing
IP / ASN
103.14.122.111
#132322 Good Domain Registry Private Limited
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
unicorpbrunei.com	unknown	2001-04-11	2012-08-03 07:05:56	2023-10-20 17:36:35	433 B	489 kB	103.14.122.111

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-10-21 12:09:29	high	Client IP	103.14.122.111	URLhaus Known malware download URL detected (201859)
2023-10-21 12:09:29	high	103.14.122.111	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2023-10-21	medium	unicorpbrunei.com/Products/pacific_polymers/images/images.exe	Identifies compiled AutoIT script (as EXE).

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

Scan Date	Severity	Indicator	Alert
2023-10-21	medium	unicorpbrunei.com	Sinkholed

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-10-21	medium	unicorpbrunei.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET unicorpbrunei.com/Products/pacific_polymers/images/images.exe

103.14.122.111

200 OK

489 kB

URL User Request GET HTTP/1.1
unicorpbrunei.com/Products/pacific_polymers/images/images.exe
IP
103.14.122.111:80
ASN
#132322 Good Domain Registry Private Limited

File type
PE32 executable (GUI) Intel 80386, for MS Windows\012- data
Size
489 kB (488960 bytes)
Hash
34e03669773d47d0d8f01be78ae484e4
4b0a7e2af2c28ae191737ba07632ed354d35c978
2919b157d8d2161bf56a17af0efc171d8e2c3c233284cf116e8c968dd9704572

Detections

Analyzer	Verdict	Alert
Public InfoSec YARA rules	malware	Identifies compiled AutoIT script (as EXE).
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed
VirusTotal	malicious	VirusTotal - Scan result 65/72

NIDS	Severity	Alert
suricata	high	URLhaus Known malware download URL detected (201859)
suricata	high	ET POLICY PE EXE or DLL Windows file download HTTP

HTTP Headers

GET /Products/pacific_polymers/images/images.exe HTTP/1.1
Host: unicorpbrunei.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 21 Oct 2023 11:52:30 GMT
Server: Apache/2
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Wed, 28 Mar 2018 16:51:45 GMT
ETag: "77600-5687bd2798a40"
Accept-Ranges: bytes
Content-Length: 488960
Keep-Alive: timeout=2, max=100
Content-Type: application/x-msdownload

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers