Report - raw.githubusercontent.com/P-DennyGamingYT/Cat-Spoof/main/Update.zip

Report Overview

Submitted URL
raw.githubusercontent.com/P-DennyGamingYT/Cat-Spoof/main/Update.zip
IP
185.199.110.133
ASN
#54113 FASTLY
Submitted
2024-05-10 22:07:20
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
5

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
raw.githubusercontent.com	35802	2014-02-06	2014-03-01	2024-05-09	521 B	20 MB	185.199.109.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
raw.githubusercontent.com/P-DennyGamingYT/Cat-Spoof/main/Update.zip
IP
185.199.109.133
ASN
#54113 FASTLY

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
20 MB (20353408 bytes)
Hash
3e02eca6806f49bbf449de8cafc5f644
cd3c9638a17b9fee1a8745e0fab5d1d090cb5188
fe26c5ff3bf3f19259bbe43ba07430e6a25f73168a66ceec438651359f738ca0

Archive (8)

Filename

Md5

File type

Cat Spoof.exe

4ce47ddf3606f387447444db1211a512

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Cat Spoof.exe.config

224a6d94b8176847a9a72bb7133bef14

XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Bunifu.Licensing.dll

1a45c5f35d5a5b3bf94f01caae45a641

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.1.5.3.dll

b4280d2898d92ab5c3911f0305d7672f

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Cat Spoof.pdb

75a9982c9dc3d242c2a1e18f56c32d50

MSVC program database ver 7.00, 512*135 bytes

config.ini

502df57b122361ebff9fa485678d4b85

ASCII text, with CRLF line terminators

DarkUI.dll

cb1f7943a7c3cb991ec67d0374c1c591

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Siticone.UI.dll

750c58af2e56b6addecffcf152520ab8

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects ConfuserEx packed file
YARAhub by abuse.ch	malware	meth_get_eip
VirusTotal	suspicious	VirusTotal - Scan result 4/65

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

raw.githubusercontent.com/P-DennyGamingYT/Cat-Spoof/main/Update.zip

185.199.109.133

200 OK

20 MB

URL User Request GET HTTP/2
raw.githubusercontent.com/P-DennyGamingYT/Cat-Spoof/main/Update.zip
IP
185.199.109.133:443
ASN
#54113 FASTLY

Certificate
IssuerDigiCert Inc
Subject*.github.io
Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28
ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
20 MB (20353408 bytes)
Hash
3e02eca6806f49bbf449de8cafc5f644
cd3c9638a17b9fee1a8745e0fab5d1d090cb5188
fe26c5ff3bf3f19259bbe43ba07430e6a25f73168a66ceec438651359f738ca0

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 4/65

HTTP Headers

GET /P-DennyGamingYT/Cat-Spoof/main/Update.zip HTTP/1.1
Host: raw.githubusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: application/zip
etag: W/"ffc028905b139229f1c70e8bd268b67a1b7e648af698f52a4884f34d5d37ae3e"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: B46A:28EC35:15E04B3:1716ADA:663E9A76
accept-ranges: bytes
date: Fri, 10 May 2024 22:06:50 GMT
via: 1.1 varnish
x-served-by: cache-hel1410031-HEL
x-cache: MISS
x-cache-hits: 0
x-timer: S1715378810.271767,VS0,VE614
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 490162a4f1119dd928853beac1533a9186a27f0d
expires: Fri, 10 May 2024 22:11:50 GMT
source-age: 0
content-length: 20353408
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (8)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers