Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | April 9, 2021, 11:32 a.m. | April 9, 2021, 11:36 a.m. |
IP Address | Status | Action |
---|---|---|
103.53.43.77 | Active | Moloch |
153.127.214.150 | Active | Moloch |
154.86.211.231 | Active | Moloch |
164.124.101.2 | Active | Moloch |
172.217.25.14 | Active | Moloch |
198.49.23.144 | Active | Moloch |
203.76.236.103 | Active | Moloch |
212.32.237.101 | Active | Moloch |
23.225.41.106 | Active | Moloch |
34.102.136.180 | Active | Moloch |
45.142.156.44 | Active | Moloch |
50.87.195.61 | Active | Moloch |
52.0.217.44 | Active | Moloch |
91.195.240.94 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
section | .fipuh |
section | .wuta |
section | .new |
resource name | None |
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.likehowto.com/nnmd/?MvyX=vRs6n4JRqe7Dt1ePX7b+YJv/yKqWGc/3Y/UBZKRypASveBlD9HGJWm4G1cXUL/JYAaDcAVpU&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.blackmantech.fitness/nnmd/?MvyX=lO2MoVQRnuQliAFYE73xMyvXdf5GkN1z0aKfIeNynRlJRWydjj13mXpuZu0yLgH94KMPbX89&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.v6b9.com/nnmd/?MvyX=gV2AbXYKVwSAsb+8nC8axD7ttDEHMWE14ZwdTbh1N+cWOvek4i/5BjlkPX2fM7PyTyPhjKAM&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.syduit.com/nnmd/?MvyX=btHTA+j+pbtfXH5E0zmzPQOf49f/oMdnjHUIX6frz8d7so2A3ybxPAuEpf9zLJV/bTrkMS/E&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.suns-brothers.com/nnmd/?MvyX=63wAYXMAzZTyFdbPgeduTMtZQGbVrU0zhbRFEm9YjPWC1DQzp3NhpDeeRLu3xGp5GtFJL6GJ&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.samanthataylordesigns.com/nnmd/?MvyX=sVCsP3nYsNXlW4I2EqS3kB52HqjY7ZxXgFnkWYmWMO+p6LFBhhCa6Vg5Ah+KszLMV8i2Kccl&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.nevertraveled.com/nnmd/?MvyX=SYHpgW1+yTc6qOKF4v10dIdNZgCXdFrWPz9etZYqQDofpKwnSaEEWXbh+jQacXfWTKEwdu6J&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.scott-re.online/nnmd/?MvyX=YoDjfv9GFAPxmC/m/YrXEnPJINgN/ZGcUJt6czxWwkNRV1BAm2Kb0tXyCx+SX/c+MMPjJ8db&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.privateselights.com/nnmd/?MvyX=dawykA9rH5soyxzZFh5d+iBJ+hfpeYhwH/qPHzsHNYdF391QiUTLENSw3p0VO2IwMqD1IPNI&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.vegrebel.com/nnmd/?MvyX=iedGY0/jFY2caMs7ufAPjCijJp09b4Pnd9J45dLvz29YUuAPrQ24EB7QdiStDbxe7UevWaqL&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.israeldigitalblog.net/nnmd/?MvyX=RhKwvNZRq71Tr7FYOMJQyYr9uwiqQ6gfx1wpRXHKZy0OdMvbN5VELlZYmhSRX7q9d8bqmLsF&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.7985699.com/nnmd/?MvyX=5eMcWOIRhRBDg7AFbH6T6n9ePY1bhRzkU2oAA9D0h2F0eFvVxskwV2U654U3C4UMb8hOzpd5&VPXh=GfIH | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.gyanankuram.com/nnmd/?MvyX=j6F9pRy7tXXpoPJbhXH0u9bQB/JXHzG14SbRVROnOZPq6dP/rmVCAUmrxE7tDLQY1WcLF6On&VPXh=GfIH |
request | GET http://www.likehowto.com/nnmd/?MvyX=vRs6n4JRqe7Dt1ePX7b+YJv/yKqWGc/3Y/UBZKRypASveBlD9HGJWm4G1cXUL/JYAaDcAVpU&VPXh=GfIH |
request | POST http://www.blackmantech.fitness/nnmd/ |
request | GET http://www.blackmantech.fitness/nnmd/?MvyX=lO2MoVQRnuQliAFYE73xMyvXdf5GkN1z0aKfIeNynRlJRWydjj13mXpuZu0yLgH94KMPbX89&VPXh=GfIH |
request | POST http://www.v6b9.com/nnmd/ |
request | GET http://www.v6b9.com/nnmd/?MvyX=gV2AbXYKVwSAsb+8nC8axD7ttDEHMWE14ZwdTbh1N+cWOvek4i/5BjlkPX2fM7PyTyPhjKAM&VPXh=GfIH |
request | POST http://www.syduit.com/nnmd/ |
request | GET http://www.syduit.com/nnmd/?MvyX=btHTA+j+pbtfXH5E0zmzPQOf49f/oMdnjHUIX6frz8d7so2A3ybxPAuEpf9zLJV/bTrkMS/E&VPXh=GfIH |
request | POST http://www.suns-brothers.com/nnmd/ |
request | GET http://www.suns-brothers.com/nnmd/?MvyX=63wAYXMAzZTyFdbPgeduTMtZQGbVrU0zhbRFEm9YjPWC1DQzp3NhpDeeRLu3xGp5GtFJL6GJ&VPXh=GfIH |
request | POST http://www.samanthataylordesigns.com/nnmd/ |
request | GET http://www.samanthataylordesigns.com/nnmd/?MvyX=sVCsP3nYsNXlW4I2EqS3kB52HqjY7ZxXgFnkWYmWMO+p6LFBhhCa6Vg5Ah+KszLMV8i2Kccl&VPXh=GfIH |
request | POST http://www.nevertraveled.com/nnmd/ |
request | GET http://www.nevertraveled.com/nnmd/?MvyX=SYHpgW1+yTc6qOKF4v10dIdNZgCXdFrWPz9etZYqQDofpKwnSaEEWXbh+jQacXfWTKEwdu6J&VPXh=GfIH |
request | POST http://www.scott-re.online/nnmd/ |
request | GET http://www.scott-re.online/nnmd/?MvyX=YoDjfv9GFAPxmC/m/YrXEnPJINgN/ZGcUJt6czxWwkNRV1BAm2Kb0tXyCx+SX/c+MMPjJ8db&VPXh=GfIH |
request | POST http://www.privateselights.com/nnmd/ |
request | GET http://www.privateselights.com/nnmd/?MvyX=dawykA9rH5soyxzZFh5d+iBJ+hfpeYhwH/qPHzsHNYdF391QiUTLENSw3p0VO2IwMqD1IPNI&VPXh=GfIH |
request | POST http://www.vegrebel.com/nnmd/ |
request | GET http://www.vegrebel.com/nnmd/?MvyX=iedGY0/jFY2caMs7ufAPjCijJp09b4Pnd9J45dLvz29YUuAPrQ24EB7QdiStDbxe7UevWaqL&VPXh=GfIH |
request | POST http://www.israeldigitalblog.net/nnmd/ |
request | GET http://www.israeldigitalblog.net/nnmd/?MvyX=RhKwvNZRq71Tr7FYOMJQyYr9uwiqQ6gfx1wpRXHKZy0OdMvbN5VELlZYmhSRX7q9d8bqmLsF&VPXh=GfIH |
request | POST http://www.7985699.com/nnmd/ |
request | GET http://www.7985699.com/nnmd/?MvyX=5eMcWOIRhRBDg7AFbH6T6n9ePY1bhRzkU2oAA9D0h2F0eFvVxskwV2U654U3C4UMb8hOzpd5&VPXh=GfIH |
request | POST http://www.gyanankuram.com/nnmd/ |
request | GET http://www.gyanankuram.com/nnmd/?MvyX=j6F9pRy7tXXpoPJbhXH0u9bQB/JXHzG14SbRVROnOZPq6dP/rmVCAUmrxE7tDLQY1WcLF6On&VPXh=GfIH |
request | POST http://www.blackmantech.fitness/nnmd/ |
request | POST http://www.v6b9.com/nnmd/ |
request | POST http://www.syduit.com/nnmd/ |
request | POST http://www.suns-brothers.com/nnmd/ |
request | POST http://www.samanthataylordesigns.com/nnmd/ |
request | POST http://www.nevertraveled.com/nnmd/ |
request | POST http://www.scott-re.online/nnmd/ |
request | POST http://www.privateselights.com/nnmd/ |
request | POST http://www.vegrebel.com/nnmd/ |
request | POST http://www.israeldigitalblog.net/nnmd/ |
request | POST http://www.7985699.com/nnmd/ |
request | POST http://www.gyanankuram.com/nnmd/ |
section | {u'size_of_data': u'0x0004ae00', u'virtual_address': u'0x00001000', u'entropy': 7.494906807445011, u'name': u'.text', u'virtual_size': u'0x0004ac63'} | entropy | 7.49490680745 | description | A section with a high entropy has been found | |||||||||
entropy | 0.795484727756 | description | Overall entropy of this PE file is high |
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Bypass DEP | rule | disable_dep |
host | 172.217.25.14 |