Report - www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.zip

Report Overview

Submitted URL
www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.zip
IP
212.227.91.231
ASN
#8560 IONOS SE
Submitted
2024-05-10 13:41:39
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
2
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.autoitscript.com	712355	2004-05-05	2012-05-21	2024-04-17	1.0 kB	14 MB	212.227.91.231

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-05-10 13:41:10	low	Client IP	212.227.91.231	ET HUNTING Observed Domain (autoitscript .com) in TLS SNI
2024-05-10 13:41:10	low	Client IP	212.227.91.231	ET HUNTING Observed Domain (autoitscript .com) in TLS SNI

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.autoitscript.com/files/autoit3/autoit-v3-setup.zip
IP
212.227.91.231
ASN
#8560 IONOS SE

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
14 MB (13504614 bytes)
Hash
0f544b1c2ae93a94146da5c2855ae8f7
b3857290a4469e2f03e1b7016fa6731502a201d6
942d85853686035f224b1d5b0df6eecc61c5a91f8b9cd4217ac338e0c8096b0f

Archive (1)

Filename

Md5

File type

autoit-v3-setup.exe

a65b5df1a846fb0bb7ad4b2da19bbbcd

PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/55

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.zip

212.227.91.231

302 Found

246 B

URL User Request GET HTTP/2
www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.zip
IP
212.227.91.231:443
ASN
#8560 IONOS SE

Certificate
IssuerGlobalSign nv-sa
Subject*.autoitscript.com
FingerprintEC:8B:4C:44:1F:7F:4A:01:2D:BF:8F:51:13:51:16:3C:E6:D7:C8:9C
ValidityTue, 02 Apr 2024 08:54:33 GMT - Sun, 04 May 2025 08:54:32 GMT

File type
HTML document, ASCII text
Size
246 B (246 bytes)
Hash
28d2418e1d1e255a7b3a2ae6d40d3de2
95fe1a613dfd95479c82c135519405b34c983b1c
f860cec382a6853ec87c09b3b5ed54f2f640ce226ea7714ecbafd993896b82d4

HTTP Headers

GET /cgi-bin/getfile.pl?autoit3/autoit-v3-setup.zip HTTP/1.1
Host: www.autoitscript.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: nginx
date: Fri, 10 May 2024 13:41:11 GMT
content-type: text/html; charset=iso-8859-1
content-length: 246
location: https://www.autoitscript.com/files/autoit3/autoit-v3-setup.zip
cache-control: max-age=3600
expires: Fri, 10 May 2024 14:41:11 GMT
x-powered-by: PleskLin
X-Firefox-Spdy: h2

www.autoitscript.com/files/autoit3/autoit-v3-setup.zip

212.227.91.231

200 OK

14 MB

URL User Request GET HTTP/2
www.autoitscript.com/files/autoit3/autoit-v3-setup.zip
IP
212.227.91.231:443
ASN
#8560 IONOS SE

Certificate
IssuerGlobalSign nv-sa
Subject*.autoitscript.com
FingerprintEC:8B:4C:44:1F:7F:4A:01:2D:BF:8F:51:13:51:16:3C:E6:D7:C8:9C
ValidityTue, 02 Apr 2024 08:54:33 GMT - Sun, 04 May 2025 08:54:32 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
14 MB (13504614 bytes)
Hash
0f544b1c2ae93a94146da5c2855ae8f7
b3857290a4469e2f03e1b7016fa6731502a201d6
942d85853686035f224b1d5b0df6eecc61c5a91f8b9cd4217ac338e0c8096b0f

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/55

HTTP Headers

GET /files/autoit3/autoit-v3-setup.zip HTTP/1.1
Host: www.autoitscript.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 13:41:11 GMT
content-type: application/zip
content-length: 13504614
last-modified: Mon, 19 Sep 2022 19:02:46 GMT
cache-control: max-age=5
expires: Fri, 10 May 2024 13:41:16 GMT
x-powered-by: PleskLin
accept-ranges: bytes
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (1)

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers