Report - pcversion.jf95.com/download/PC6AssSetup.exe

Report Overview

Submitted URL
pcversion.jf95.com/download/PC6AssSetup.exe
IP
111.225.213.35
ASN
#58539 Langfang,Hebei province, P.R.China
Submitted
2023-05-21 16:45:49
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
1
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
pcversion.jf95.com	unknown	2013-06-06	2015-03-29	2023-05-20	686 B	8.8 MB	125.74.110.35

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-05-21 16:45:35	high	125.64.104.35	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
pcversion.jf95.com/download/PC6AssSetup.exe
IP
125.64.104.35
ASN
#38283 CHINANET SiChuan Telecom Internet Data Center

File type
PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive\012- data
Size
8.8 MB (8760056 bytes)
Hash
d6b156b65c3dd4eedc1a50590fb950ad
350e2e4a425d33344a9a4e027bce73c7f52ac1ea
31d72f2cee9344cad7edc8349937f2aae8c3626651e198376be07df037578a70

Detections

Analyzer	Verdict	Alert
VirusTotal	5/68	VirusTotal -

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

pcversion.jf95.com/

125.74.110.35

146 B

URL
pcversion.jf95.com/
IP
125.74.110.35:0
ASN
#4134 Chinanet

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
9fe3cb2b7313dc79bb477bc8fde184a7
4d7b3cb41e90618358d0ee066c45c76227a13747
32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864

HTTP Headers

GET / HTTP/1.1
Host: pcversion.jf95.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Server: JSP3/2.0.14
Date: Sun, 21 May 2023 16:45:34 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
X-Error-Info: Origin
Timing-Allow-Origin: *
Ohc-Cache-HIT: lz6ct64 [1], xaix217 [1]
Ohc-File-Size: 146
X-Cache-Status: MISS

pcversion.jf95.com/download/PC6AssSetup.exe

125.64.104.35

200 OK

8.8 MB

URL User Request GET HTTP/1.1
pcversion.jf95.com/download/PC6AssSetup.exe
IP
125.64.104.35:80
ASN
#38283 CHINANET SiChuan Telecom Internet Data Center

File type
PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive\012- data
Size
8.8 MB (8760056 bytes)
Hash
d6b156b65c3dd4eedc1a50590fb950ad
350e2e4a425d33344a9a4e027bce73c7f52ac1ea
31d72f2cee9344cad7edc8349937f2aae8c3626651e198376be07df037578a70

Detections

Analyzer	Verdict	Alert
VirusTotal	5/68	VirusTotal -

NIDS	Severity	Alert
suricata	high	ET POLICY PE EXE or DLL Windows file download HTTP

HTTP Headers

GET /download/PC6AssSetup.exe HTTP/1.1
Host: pcversion.jf95.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sun, 21 May 2023 16:45:35 GMT
Content-Type: application/octet-stream
Content-Length: 8760056
Connection: keep-alive
Last-Modified: Mon, 30 Nov 2015 11:58:12 GMT
ETag: "565c39d4-85aaf8"
Age: 165004
Accept-Ranges: bytes
Timing-Allow-Origin: *
Ohc-Global-Saved-Time: Tue, 16 May 2023 05:28:36 GMT
Ohc-Cache-HIT: dy2ct99 [4], qdix145 [4]
Ohc-File-Size: 8760056
X-Cache-Status: HIT

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers