IP 117.27.246.96:0
Hash1f5abce75f373f50b8515f364e3beeea 132d98768d2664112147fad723629d5dfdd68355 8f4a6dd5057eab65af3e00987a77bb51011a9a4d694c8cbb658054536ef8942f
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 600
Connection: keep-alive
x-frame-options: SAMEORIGIN
age: 3513
accept-ranges: bytes
expires: Tue, 02 Apr 2024 03:53:56 GMT
last-modified: Tue, 26 Mar 2024 03:53:57 GMT
cache-control: max-age=3600
date: Fri, 29 Mar 2024 14:58:21 GMT
request-id: 6606d70d0ec723e0b2c63d74249e84e7
cf-ray: 86a438a38f3d8619-HKG
cf-cache-status: EXPIRED
etag: "132d98768d2664112147fad723629d5dfdd68355"
x-ccacdn-proxy-id: scdpinlb5
ctl-cache-status: HIT from hk-xianggang4-ca03, HIT from sh-pudongxin1-ca01
via: n157-088-154.njmp.ToB,n172-013-213.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 17117243019a3d397446c62e0a0f46cc862a8e5ab1
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=13, edge;dur=17
|
| download.2345.cn/background/filedown_242392.exe | 120.52.95.248 | 200 OK | 137 kB |
URL User Request GET HTTP/2download.2345.cn/background/filedown_242392.exe IP120.52.95.248:443 ASN#133119 China Unicom IP network
CertificateIssuerTrustAsia Technologies, Inc. Subject2345.com FingerprintEB:70:9C:5A:1C:08:A1:12:7C:0A:08:4C:09:D6:2C:4F:F8:3B:B9:C1 ValidityTue, 31 Oct 2023 00:00:00 GMT - Thu, 21 Nov 2024 23:59:59 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections Size137 kB (136680 bytes) Hashd9636339310fc72e3c7cdbf2e164a379 aecbb93eeb54f3379215ce27be6377458185f8c1 6abad63b1beaf538f1badd47910426d77e98f933d7334e618267cbf43f5fd126
| Analyzer | Verdict | Alert |
|---|
| VirusTotal | malicious | |
GET /background/filedown_242392.exe HTTP/1.1
Host: download.2345.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 29 Mar 2024 14:58:21 GMT
content-type: application/octet-stream
content-length: 136680
server: openresty
last-modified: Wed, 22 Jan 2014 06:16:57 GMT
etag: "52df6259-215e8"
via: CHN-HElangfang-AREACUCC1-CACHE52[68],CHN-HElangfang-AREACUCC1-CACHE32[0,TCP_HIT,10],CHN-TJ-GLOBAL1-CACHE112[127],CHN-TJ-GLOBAL1-CACHE102[84,TCP_MISS,117],CHN-SH-GLOBAL1-CACHE56[55],CHN-SH-GLOBAL1-CACHE101[23,TCP_MISS,44]
x-hcs-proxy-type: 1
x-ccdn-cachettl: 2592000
x-ccdn-req-id-46b1: 6367f6479a24a0c55afc5550794bc5dc
nginx-hit: 1
age: 7690155
accept-ranges: bytes
X-Firefox-Spdy: h2
|
IP117.27.246.96:0
Hash1f5abce75f373f50b8515f364e3beeea 132d98768d2664112147fad723629d5dfdd68355 8f4a6dd5057eab65af3e00987a77bb51011a9a4d694c8cbb658054536ef8942f
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 600
Connection: keep-alive
cf-ray: 86a438a38f3d8619-HKG
date: Fri, 29 Mar 2024 14:58:28 GMT
etag: "132d98768d2664112147fad723629d5dfdd68355"
expires: Tue, 02 Apr 2024 03:53:56 GMT
x-ccacdn-proxy-id: scdpinlb5
x-frame-options: SAMEORIGIN
cf-cache-status: EXPIRED
age: 3520
cache-control: max-age=3600
last-modified: Tue, 26 Mar 2024 03:53:57 GMT
request-id: 6606d714cbf9063ffca6ff9e90cf2471
ctl-cache-status: HIT from hk-xianggang4-ca03, HIT from sh-pudongxin1-ca01
accept-ranges: bytes
via: n157-088-157.njmp.ToB,n172-013-215.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 1711724308c076a1553a276dbcdd18e92df1b3e900
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=14, edge;dur=22
|