ebd.zip| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | Oct. 11, 2023, 11:14 a.m. | Oct. 11, 2023, 11:17 a.m. |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| secure.globalsign.com | 104.18.21.226 | |
| vintagecarsforlife.com | 162.33.179.65 | |
| prestige-castom.com | 162.33.179.65 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49176 -> 162.33.179.65:2351 | 2013028 | ET POLICY curl User-Agent Outbound | Attempted Information Leak |
| TCP 192.168.56.102:49180 -> 162.33.179.65:2351 | 2013028 | ET POLICY curl User-Agent Outbound | Attempted Information Leak |
| TCP 192.168.56.102:49172 -> 162.33.179.65:2351 | 2013028 | ET POLICY curl User-Agent Outbound | Attempted Information Leak |
| TCP 162.33.179.65:2351 -> 192.168.56.102:49172 | 2018959 | ET POLICY PE EXE or DLL Windows file download HTTP | Potential Corporate Privacy Violation |
| TCP 162.33.179.65:2351 -> 192.168.56.102:49172 | 2014520 | ET INFO EXE - Served Attached HTTP | Misc activity |
| TCP 192.168.56.102:49183 -> 162.33.179.65:2351 | 2013028 | ET POLICY curl User-Agent Outbound | Attempted Information Leak |
| TCP 162.33.179.65:2351 -> 192.168.56.102:49180 | 2018959 | ET POLICY PE EXE or DLL Windows file download HTTP | Potential Corporate Privacy Violation |
| TCP 162.33.179.65:2351 -> 192.168.56.102:49180 | 2014520 | ET INFO EXE - Served Attached HTTP | Misc activity |
Suricata TLS
No Suricata TLS
| request | GET http://secure.globalsign.com/cacert/codesigningrootr45.crt |
| dead_host | 162.33.179.65:8080 |