Scan report · 10 days agoPublic

xn--m7wq91a.hunanhongmen.com

154.82.90.164AS399077 · SC

Submittedhttps://xn--m7wq91a.hunanhongmen.com/jpmyrcpj/p8Y2A.html

Suspicious: behavioural signals scored 4 (threshold 4)

all of it from handing over a file rather than rendering a page; see the findings list

Engine tags

Verdict

2 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 10.6 s · 2 requests

01 · Visitor opensxn--m7wq91a.hunanhongmen.com/jpmyrcpj/p8Y2A.html

02 · Page shown

正在下载中 ...

03 · File delivered · malicioussyzb-p8Y2A-v83cb9a87-x64.apkHanded over by the page, not served at the scanned address.

Dangerous — confirmed threat

Automated

The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

MalwareMalware found in the downloaded file

syzb-p8Y2A-v83cb9a87-x64.apk

We analysed the file this page delivered — it is Malicious.

Success

SHA-256 0521a9d77faaa2d2aae469e50b28e6e0122688ef56f4e29bac3e4ba9736b39d0

StrongPage auto-started a file download

syzb-p8Y2A-v83cb9a87-x64.apk

The page automatically triggered a file download. Normal landing pages don't do this; malware droppers do.

Analyst noteCheck the file name/type. An auto-download of an executable or archive is a strong malware-delivery tell.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileMalicioussyzb-p8Y2A-v83cb9a87-x64.apk

SHA-2560521a9d77faaa2d2aae469e50b28e6e0122688ef56f4e29bac3e4ba9736b39d0

Fromhxxps://kzplqdwjlxrkhtvbjxbflycfqjlgckzx[.]xieshanghui[.]net/syzb-p8Y2A-v83cb9a87-x64[.]apk?t=1790115568231&auth_key=1790115580-1-0-760484916ab0c640909f487c34a37edf

Infrastructure

IP: 154.82.90.164TERAEXCH - Tcloudnet, US · AS399077SC
TLS: CN=ZeroSSL RSA DV SSL CA 2, O=ZeroSSL GmbH, C=AT · expires Nov 3, 2026

WHOIS

Registrar: Gname.com Pte. Ltd.
Created: May 21, 2014
Expires: May 21, 2027
Nameservers: n1.xundns.comn2.xundns.com

25 malicious1 suspicious

Hashes & fingerprints

Page Hashcece459cc6a1401b4b3b31a54eba88c89834ef8ce4a24d49388d964d0cace16f Favicon Hashfd30244b304d642a15055e36a4c8859650f445b05d0c36eabfc2836ee8a223fe Screenshot pHashd480ff9f00807f8f JARM29d29d00029d29d00041d41d00000000f78d2dc0ce6e5bbc5b8149a4872356 JA4Xa373a9f83c6b_7022c563de38_a7d8059b5276 Cert Thumbprint4AAB8CC6BC995AD63E9A936838C4C55C0B95A70B Cert IssuerCN=ZeroSSL RSA DV SSL CA 2, O=ZeroSSL GmbH, C=AT

Page capture

Live

Title “正在下载中 ...”

Visit Site

Engines

8 · time to verdict