Overview

URL103.133.104.112/87/INET_COOKIES.exe
IP 103.133.104.112 (Vietnam)
ASN#135905 VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-05-26 05:46:04 UTC
StatusLoading report..
IDS alerts3
Blocklist alert2
urlquery alerts No alerts detected
Tags None

Domain Summary (1)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
103.133.104.112 (1) 0 No data No data 407 624456 103.133.104.112

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2023-05-26 05:45:48 UTC medium Client IP  103.133.104.112 ET INFO Executable Download from dotted-quad Host 
2023-05-26 05:45:49 UTC high  103.133.104.112 Client IP ET POLICY PE EXE or DLL Windows file download HTTP 
2023-05-26 05:45:49 UTC medium  103.133.104.112 Client IP ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response 

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-05-26 medium 103.133.104.112/87/INET_COOKIES.exe Malware

mnemonic secure dns
 No alerts detected

Quad9 DNS
Scan Date Severity Indicator Comment
2023-05-25 medium 103.133.104.112 Sinkholed

ThreatFox
 No alerts detected

Files

URL 103.133.104.112/87/INET_COOKIES.exe
IP  103.133.104.112
Magic PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\012- data
Size 624128
MD5 a38b0bbefe150ed8f8dd125c5b258fd2
SHA1 99891500c6c2d431965c4fcccd211f7a956639c1
SHA256 f3d8e6deded0993020001bee02ebd1814bc37e09fd174a033e99296780659c63
Analyzer Scan Date Verdict Comment
VirusTotal 2023-05-26 17/69  VirusTotal Report

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 103.133.104.112
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-04 23:01:02 UTC 0 - 4 - 2 103.133.104.112/732/hkcmd.exe 103.133.104.112
2023-06-04 23:00:47 UTC 0 - 1 - 2 103.133.104.112/ib/ibibibibibibibii%23%23%23% (...) 103.133.104.112


Last 5 reports on ASN: VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-05 16:42:56 UTC 0 - 1 - 1 14.225.254.203/ 14.225.254.203
2023-06-05 16:23:29 UTC 0 - 0 - 2 103.140.251.122/ 103.140.251.122


Last 5 reports on domain: 103.133.104.112
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-04 23:01:02 UTC 0 - 4 - 2 103.133.104.112/732/hkcmd.exe 103.133.104.112
2023-06-04 23:00:47 UTC 0 - 1 - 2 103.133.104.112/ib/ibibibibibibibii%23%23%23% (...) 103.133.104.112


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-06-06 05:58:43 UTC 0 - 2 - 0 www.checkmal.com/download/AppCheckProSetup.exe 52.78.76.217
2023-06-06 05:58:37 UTC 0 - 2 - 0 www.checkmal.com/download/AppCheckSetup.exe 52.78.76.217
2023-06-06 05:58:14 UTC 0 - 7 - 2 190.109.229.35:48232/mozi.a 190.109.229.35
2023-06-06 05:57:14 UTC 0 - 1 - 1 193.42.32.83/il/li/lilililililililililili%23% (...) 193.42.32.83
2023-06-06 05:56:45 UTC 0 - 4 - 0 filetransfer.io/data-package/mZS44G9n/download 172.67.200.96

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (1)


Request Response
 
                                        
                                            GET /87/INET_COOKIES.exe HTTP/1.1 

                                        
                                            
Host: 103.133.104.112 

                                        
                                    
                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
DNT: 1 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache 

                                        
                                            
 

                                        
                                    
                                        
                                             103.133.104.112

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/x-msdownload 

                                            
                                            
                                            

                                            
                                                
Date: Fri, 26 May 2023 05:45:54 GMT 

                                            
                                                
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28 

                                            
                                                
Last-Modified: Fri, 26 May 2023 04:10:17 GMT 

                                            
                                                
ETag: "98600-5fc90ea2699bd" 

                                            
                                                
Accept-Ranges: bytes 

                                            
                                                
Content-Length: 624128 

                                            
                                                
Keep-Alive: timeout=5, max=100 

                                            
                                                
Connection: Keep-Alive 

                                            
                                                
 

                                            
                                            

                                                

                                                --- Additional Info ---

                                                Magic:  PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\012- data

                                                Size:   624128

                                                Md5:    a38b0bbefe150ed8f8dd125c5b258fd2

                                                Sha1:   99891500c6c2d431965c4fcccd211f7a956639c1

                                                Sha256: f3d8e6deded0993020001bee02ebd1814bc37e09fd174a033e99296780659c63

                                        

                                        
                                            

                                            

                                            
                                                Blocklists:

                                                
                                                      - fortinet: Malware

                                                
                                                      - quad9: Sinkholed

                                                
                                                      - virustotal: 17/69

                                                
                                            
                                            
                                            
                                                IDS:

                                                
                                                          - ET INFO Executable Download from dotted-quad Host

                                                
                                                          - ET POLICY PE EXE or DLL Windows file download HTTP

                                                
                                                          - ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response