Report - raw.githubusercontent.com/YTEC-info/CH347-Softwares/main/Softwares/Windows/CH347%20Programmer%20V1.40/CH347%20Programmer%20V1.40.zip

Report Overview

Submitted URL
raw.githubusercontent.com/YTEC-info/CH347-Softwares/main/Softwares/Windows/CH347%20Programmer%20V1.40/CH347%20Programmer%20V1.40.zip
IP
185.199.109.133
ASN
#54113 FASTLY
Submitted
2024-04-25 01:07:57
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
9

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
raw.githubusercontent.com	35802	2014-02-06	2014-03-01	2024-04-23	586 B	8.1 MB	185.199.109.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
raw.githubusercontent.com/YTEC-info/CH347-Softwares/main/Softwares/Windows/CH347%20Programmer%20V1.40/CH347%20Programmer%20V1.40.zip
IP
185.199.109.133
ASN
#54113 FASTLY

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
8.1 MB (8127163 bytes)
Hash
1f49e1cad3c0ef5281a43a85f2d0702e
9221f4d12089fa15402eab4aa4e405b296b7eed9
1c3e46777e916b1ca7ff515c47bad2a0503868b2b538ff0e9141d89ecf9aada5

Archive (14)

Filename

Md5

File type

borlndmm.dll

232966bf4e5f15491481ac3958131a21

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 7 sections

CH347 Programmer.exe

ecc4f7b739710481cdac65b49b218a4b

PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections

ch347 programmer.exe�

f8b22205b91227acdd7384f92f76fd7e

PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 9 sections

ch347.exe�

f8b22205b91227acdd7384f92f76fd7e

PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 9 sections

CN.ini

b7bdf9bdbc8a1a64ffaa74f9ab9b1a1b

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dev.ini

7e039ed496682e67fa6ab110dfa031b3

Generic INItialization configuration [SystemOption]

CH341PAR.EXE

9f31af475c0201233ba4b3fe10bd40e2

PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections

CH343SER.EXE

884efab615a09cca01c5947e43cfd496

PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections

EN.ini

03468ff30c0e5f1214ca175ac9329560

Unicode text, UTF-16, little-endian text, with CRLF line terminators

Mass.bmp

07b3350fedfed3b89cf7937c62bc783e

PC bitmap, Windows 3.x format, 32 x 30 x 24, image size 2880, cbSize 2934, bits offset 54

Stop.bmp

cf02e61c7d54d16e8727e284ee9be31f

PC bitmap, Windows 3.x format, 30 x 30 x 24, image size 2760, cbSize 2814, bits offset 54

3718dc92b8311cde19294d400b19ad42

Microsoft Access Database

PT.ini

7e039ed496682e67fa6ab110dfa031b3

Generic INItialization configuration [SystemOption]

TC.ini

baa3ac904e0503df26561bd6e111d53c

Unicode text, UTF-16, little-endian text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Public Nextron YARA rules	malware	Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Public Nextron YARA rules	malware	Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
VirusTotal	malicious	VirusTotal - Scan result 55/64

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

raw.githubusercontent.com/YTEC-info/CH347-Softwares/main/Softwares/Windows/CH347%20Programmer%20V1.40/CH347%20Programmer%20V1.40.zip

185.199.109.133

8.1 MB

URL
raw.githubusercontent.com/YTEC-info/CH347-Softwares/main/Softwares/Windows/CH347%20Programmer%20V1.40/CH347%20Programmer%20V1.40.zip
IP
185.199.109.133:0
ASN
#54113 FASTLY

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
8.1 MB (8127163 bytes)
Hash
1f49e1cad3c0ef5281a43a85f2d0702e
9221f4d12089fa15402eab4aa4e405b296b7eed9
1c3e46777e916b1ca7ff515c47bad2a0503868b2b538ff0e9141d89ecf9aada5

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 55/64

HTTP Headers

GET /YTEC-info/CH347-Softwares/main/Softwares/Windows/CH347%20Programmer%20V1.40/CH347%20Programmer%20V1.40.zip HTTP/1.1
Host: raw.githubusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: application/zip
etag: W/"0582d87a45c399f8c6f4a15d6a67f46b80562df20608c274a0c3b42f8d0767f1"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: E62A:0DBE:5F5D95:639A7E:6629ACD0
accept-ranges: bytes
date: Thu, 25 Apr 2024 01:07:30 GMT
via: 1.1 varnish
x-served-by: cache-hel1410033-HEL
x-cache: MISS
x-cache-hits: 0
x-timer: S1714007249.499300,VS0,VE833
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 2d6c7a9048147336140547837ec80cef35fd8493
expires: Thu, 25 Apr 2024 01:12:30 GMT
source-age: 1
content-length: 8127163
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (14)

Detections

JavaScript (0)

HTTP Transactions (1)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers