Report - farshekashan.com/Content/img/public/%D9%85%D9%82%D8%A7%D9%84%D8%A7%D8%AA-%D9%81%D8%B1%D8%B4-%DA%A9%D8%A7%D8%B4%D8%A7%D9%86/camera%20shotter/TornadoSCF.exe

Report Overview

Visitedpublic

2024-08-12 09:12:07

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
r10.o.lencr.org	unknown				2.0 kB	5.3 kB	23.36.77.32
farshekashan.com	561160				608 B	229 kB	45.138.135.12

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

farshekashan.com/Content/img/public/%D9%85%D9%82%D8%A7%D9%84%D8%A7%D8%AA-%D9%81%D8%B1%D8%B4-%DA%A9%D8%A7%D8%B4%D8%A7%D9%86/camera%20shotter/TornadoSCF.exe

IP / ASN

45.138.135.12

#59441 NOAVARAN SHABAKEH SABZ MEHREGAN (Ltd.)

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections

Size229 kB (228864 bytes)

MD51298cfd372d2c10e8be04a143797dced

SHA113f5d9ed15b180f3df7d6836ec33be4615bf8697

SHA256da7473a4bafdffe9a0dc9e283e28cd609652c9d40fcf95f09970219f9caa8863

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 20/74

JavaScript (0)

HTTP Transactions (7)

URL IP Response Size

r10.o.lencr.org/

23.36.77.32

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-11

Last Seen2024-08-19

Times Seen24454

Size504 B (504 bytes)

MD5c2c08f8e2c667f91e7ee939f41a7ca06

SHA1159557c63c8c8ef725ae9b3fec75d5f1810b40d8

SHA25668059941cc11a454898b59b485e702d97abe8025bd02657174e26ec24eb68c81

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "68059941CC11A454898B59B485E702D97ABE8025BD02657174E26EC24EB68C81"
Last-Modified: Sun, 11 Aug 2024 06:56:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18919
Expires: Mon, 12 Aug 2024 14:27:01 GMT
Date: Mon, 12 Aug 2024 09:11:42 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-11

Last Seen2024-08-19

Times Seen21241

Size504 B (504 bytes)

MD52a2d14e098204ee1d1e68f2616277092

SHA1f7ec021aa453d577c048bd3898995ddf825aeebb

SHA25620e8174590f8ae5789160b7beaa6a42bc90d4312052087181bbafed5f464d7d3

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "20E8174590F8AE5789160B7BEAA6A42BC90D4312052087181BBAFED5F464D7D3"
Last-Modified: Sun, 11 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2549
Expires: Mon, 12 Aug 2024 09:54:11 GMT
Date: Mon, 12 Aug 2024 09:11:42 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-11

Last Seen2024-08-19

Times Seen20957

Size504 B (504 bytes)

MD584e0e906aa0fcfa00ac2d2f5c375aa77

SHA1c851ff2470d706678f0b6bc7db9cd6aba94a8e62

SHA256f7d885f0c7a03e52eac7b61b9e15651b78127d69bc77a6012a7f753c7f47b477

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "F7D885F0C7A03E52EAC7B61B9E15651B78127D69BC77A6012A7F753C7F47B477"
Last-Modified: Sun, 11 Aug 2024 06:26:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10616
Expires: Mon, 12 Aug 2024 12:08:38 GMT
Date: Mon, 12 Aug 2024 09:11:42 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-12

Last Seen2024-08-19

Times Seen25561

Size504 B (504 bytes)

MD5fa9d9a7703999cfc274f02dcaadb4561

SHA1eb147c3d5cebb3001dfeb1e60aa7054d1f2ca51c

SHA2561f147459e31f4e1f2f37449a98c122615b2ad8051ac691d52f0fb1cf2892a35c

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "1F147459E31F4E1F2F37449A98C122615B2AD8051AC691D52F0FB1CF2892A35C"
Last-Modified: Sun, 11 Aug 2024 06:57:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3919
Expires: Mon, 12 Aug 2024 10:17:01 GMT
Date: Mon, 12 Aug 2024 09:11:42 GMT
Connection: keep-alive

GET farshekashan.com/Content/img/public/%D9%85%D9%82%D8%A7%D9%84%D8%A7%D8%AA-%D9%81%D8%B1%D8%B4-%DA%A9%D8%A7%D8%B4%D8%A7%D9%86/camera%20shotter/TornadoSCF.exe

45.138.135.12

200 OK

229 kB

URL User Request GET HTTPS

farshekashan.com/Content/img/public/%D9%85%D9%82%D8%A7%D9%84%D8%A7%D8%AA-%D9%81%D8%B1%D8%B4-%DA%A9%D8%A7%D8%B4%D8%A7%D9%86/camera%20shotter/TornadoSCF.exe

IP / ASN

45.138.135.12

#59441 NOAVARAN SHABAKEH SABZ MEHREGAN (Ltd.)

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections

First Seen2023-05-21

Last Seen2025-07-23

Times Seen82

Size229 kB (228864 bytes)

MD51298cfd372d2c10e8be04a143797dced

SHA113f5d9ed15b180f3df7d6836ec33be4615bf8697

SHA256da7473a4bafdffe9a0dc9e283e28cd609652c9d40fcf95f09970219f9caa8863

Certificate Info

IssuerLet's Encrypt

Subjectfarshekashan.com

FingerprintF9:A8:1C:C5:9E:6C:B5:28:77:5D:27:36:22:60:0B:FE:12:74:B6:0D

ValidityWed, 07 Aug 2024 23:29:11 GMT - Tue, 05 Nov 2024 23:29:10 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 20/74

HTTP Headers

GET /Content/img/public/%D9%85%D9%82%D8%A7%D9%84%D8%A7%D8%AA-%D9%81%D8%B1%D8%B4-%DA%A9%D8%A7%D8%B4%D8%A7%D9%86/camera%20shotter/TornadoSCF.exe HTTP/1.1
Host: farshekashan.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: max-age=31536000
content-type: application/octet-stream
last-modified: Sat, 13 Jul 2024 15:52:01 GMT
accept-ranges: bytes
etag: "cbcfbc993cd5da1:0"
server: Microsoft-IIS/10.0
date: Mon, 12 Aug 2024 09:11:45 GMT
content-length: 228864
X-Firefox-Spdy: h2

r10.o.lencr.org/

23.36.76.226

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-11

Last Seen2024-08-19

Times Seen13247

Size504 B (504 bytes)

MD5b3cb4fa78d48efd3475d6c2225a3a440

SHA1d25b7736221fe0073288e3ec4950389761ae2a06

SHA256799a896dc6357139a345e649d5cc7560ec07901f5a272e102018cb4dc18aebd7

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "799A896DC6357139A345E649D5CC7560EC07901F5A272E102018CB4DC18AEBD7"
Last-Modified: Sun, 11 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4558
Expires: Mon, 12 Aug 2024 10:27:42 GMT
Date: Mon, 12 Aug 2024 09:11:44 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-11

Last Seen2024-08-19

Times Seen13247

Size504 B (504 bytes)

MD5b3cb4fa78d48efd3475d6c2225a3a440

SHA1d25b7736221fe0073288e3ec4950389761ae2a06

SHA256799a896dc6357139a345e649d5cc7560ec07901f5a272e102018cb4dc18aebd7

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "799A896DC6357139A345E649D5CC7560EC07901F5A272E102018CB4DC18AEBD7"
Last-Modified: Sun, 11 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4558
Expires: Mon, 12 Aug 2024 10:27:42 GMT
Date: Mon, 12 Aug 2024 09:11:44 GMT
Connection: keep-alive