ZeroCERT Team

Report

Result
Link
Whois
Reference

*Date : 2021.05.20 07:51
*Site : http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/
*Title : Index of /img
*Info : 103.232.54.201, VN(, Vietnam)
*Check url : 14 counts
*Loading time : 15.966856sec
*Reference
- VIRUSTOTAL : URL Hash 2021-05-19 12:34:23 7/88, FILE Hash not found
- Google SafeBrowsing(GSB) : hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu is not found
*Result
(1) EXE File Signatures - 13count
(2) Suspicious file (Virustotal detection ratio) - 10count
(3) Directory Listing - Security vulnerabilities - 1count
(4) Input site Registered Malicious url - 1count
(5) (-) MD5 : 374fb48a959a96ce92ae0e4346763293 / Virustotal : 2021-05-18 01:14:29 4/68 - 1count
(6) (+) MD5 : XPP.exe (02767a23a2e6b59b337dee3f44b75f39) - 1count
(7) (+) MD5 : WAX.exe (970247901268bd976aa5eb37d8e703ad) - 1count
(8) (+) MD5 : PLF.exe (365d37e09e2514a935e87f9ab793ffc9) - 1count
(9) (+) MD5 : ODS.exe (67e197ce60aee392b9a6d6c1f0c8273a) - 1count
(10) (+) MD5 : MKO.exe (c28479bce1d7cfc221be5b71bf470164) - 1count
(11) (+) MD5 : MAL.exe (10c3c7a5841b1a9bf81362243ad9e7e4) - 1count
(12) (+) MD5 : KUI.exe (331795ffdb6c9f6940d86d4a59c6180e) - 1count
(13) (+) MD5 : JNN.exe (f4b56009dcee0d306b8316618e0b96d3) - 1count
(14) (+) MD5 : JBO.exe (49481a54a5c2af610b1dea941b3ba062) - 1count
(15) (+) MD5 : FBK.exe (0ba742f6d1c206638efd5064acd6f862) - 1count
(16) (+) MD5 : EGG.exe (13e0cd9df74775213bc78eba0c269add) - 1count
(17) (+) MD5 : ABU.exe (47de54f1f21a47cbabe3b547d041da92) - 1count

Public Link : http://zerocert.org/?code=cf9d5bd982ec5d47c7dfa9970c7695e3f6b2cef2ee91d7d17b814f1a038d05bc

*Latest detected Domain

이 사이트는 최근 90일 동안 악성URL 삽입된 적이 없습니다.
이 사이트는 최근 90일 동안 악성코드 중개 역할한 적이 없습니다.
이 사이트는 최근 90일 동안 악성코드를 유포한 적이 없습니다.
Relation domain not found
same Domain not found

http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/ -> Malware url
    -> Directory Listing - Security vulnerabilities
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/ABU.exe
    -> (+) MD5 : ABU.exe (47de54f1f21a47cbabe3b547d041da92)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/EGG.exe
    -> (+) MD5 : EGG.exe (13e0cd9df74775213bc78eba0c269add)
    -> Suspicious file (Virustotal detection ratio)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/FBK.exe
    -> (+) MD5 : FBK.exe (0ba742f6d1c206638efd5064acd6f862)
    -> Suspicious file (Virustotal detection ratio)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/JBO.exe
    -> (+) MD5 : JBO.exe (49481a54a5c2af610b1dea941b3ba062)
    -> Suspicious file (Virustotal detection ratio)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/JNN.exe
    -> (+) MD5 : JNN.exe (f4b56009dcee0d306b8316618e0b96d3)
    -> Suspicious file (Virustotal detection ratio)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/KUI.exe
    -> (+) MD5 : KUI.exe (331795ffdb6c9f6940d86d4a59c6180e)
    -> Suspicious file (Virustotal detection ratio)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/MAL.exe
    -> (+) MD5 : MAL.exe (10c3c7a5841b1a9bf81362243ad9e7e4)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/MKO.exe
    -> (+) MD5 : MKO.exe (c28479bce1d7cfc221be5b71bf470164)
    -> Suspicious file (Virustotal detection ratio)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/ODS.exe
    -> (+) MD5 : ODS.exe (67e197ce60aee392b9a6d6c1f0c8273a)
    -> Suspicious file (Virustotal detection ratio)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/PLF.exe
    -> (+) MD5 : PLF.exe (365d37e09e2514a935e87f9ab793ffc9)
    -> Suspicious file (Virustotal detection ratio)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/WAX.exe
    -> (+) MD5 : WAX.exe (970247901268bd976aa5eb37d8e703ad)
    -> Suspicious file (Virustotal detection ratio)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/XPP.exe
    -> (+) MD5 : XPP.exe (02767a23a2e6b59b337dee3f44b75f39)
    -> Suspicious file (Virustotal detection ratio)
    -> EXE File Signatures
  [exe] http://hshjiopklmsacnzbcjuewahfdsnvmlazbcuewqjh.ydns.eu/img/putty.exe
    -> (-) MD5 : 374fb48a959a96ce92ae0e4346763293 / Virustotal : 2021-05-18 01:14:29 4/68
    -> EXE File Signatures

*Country
unknown

*Whois
% The WHOIS service offered by EURid and the access to the records
% in the EURid WHOIS database are provided for information purposes
% only. It allows persons to check whether a specific domain name
% is still available or not and to obtain information related to
% the registration records of existing domain names.
%
% EURid cannot, under any circumstances, be held liable in case the
% stored information would prove to be wrong, incomplete or not
% accurate in any sense.
%
% By submitting a query, you agree not to use the information made
% available to:
%
% - allow, enable or otherwise support the transmission of unsolicited,
% commercial advertising or other solicitations whether via email or
% otherwise;
% - target advertising in any possible way;
% - cause nuisance in any possible way by sending messages to registrants,
% whether by automated, electronic processes capable of enabling
% high volumes or by other possible means.
%
% Without prejudice to the above, it is explicitly forbidden to extract,
% copy and/or use or re-utilise in any form and by any means
% (electronically or not) the whole or a quantitatively or qualitatively
% substantial part of the contents of the WHOIS database without prior
% and explicit permission by EURid, nor in any attempt hereof, to apply
% automated, electronic processes to EURid (or its systems).
%
% You agree that any reproduction and/or transmission of data for
% commercial purposes will always be considered as the extraction of a
% substantial part of the content of the WHOIS database.
%
% By submitting the query, you agree to abide by this policy and accept
% that EURid can take measures to limit the use of its WHOIS services
% to protect the privacy of its registrants or the integrity
% of the database.
%
% The EURid WHOIS service on port 43 (textual WHOIS) never discloses
% any information concerning the registrant.
% Registrant and on-site contact information can be obtained through use of the
% web-based WHOIS service available from the EURid website www.eurid.eu
%
% WHOIS ydns.eu
Domain: ydns.eu
Script: LATIN

Registrant:
NOT DISCLOSED!
Visit www.eurid.eu for the web-based WHOIS.

On-site(s):
NOT DISCLOSED!
Visit www.eurid.eu for the web-based WHOIS.

Registrar:
Name: INWX GmbH
Website: https://www.inwx.com/en/eu-domain

Name servers:
ns1.ydns.io
ns2.ydns.io

Please visit www.eurid.eu for more info.

Website Check

Report