Report Overview

  1. Submitted URL

    any-data-recovery.com/downloads/ianygo.exe?rnclid=11711324800327568501

  2. IP

    172.67.221.154

    ASN

    #13335 CLOUDFLARENET

  3. Submitted

    2024-04-18 08:10:27

    Access

    public

  4. Website Title

    about:privatebrowsing

  5. Final URL

    about:privatebrowsing

  6. Tags

  7. urlquery detections

    No alerts detected

Detections

  1. urlquery

    0

  2. Network Intrusion Detection

    0

  3. Threat Detection Systems

    3

Domain Summary

Domain / FQDNRankRegisteredFirst SeenLast Seen
www.ultfone.comunknown2015-12-082020-07-132024-04-18
any-data-recovery.comunknown2011-01-122012-05-232024-02-19

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules
SeverityIndicatorAlert
mediumwww.ultfone.com/downloads/ianygo.exe?rnclid=11711324800327568501Detect files is `SliverFox` malware

OpenPhish

No alerts detected


PhishTank

No alerts detected


mnemonic secure dns

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


Files detected

  1. URL

    www.ultfone.com/downloads/ianygo.exe?rnclid=11711324800327568501

  2. IP

    104.18.31.122

  3. ASN

    #13335 CLOUDFLARENET

  1. File type

    PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

    Size

    10 MB (10154952 bytes)

  2. Hash

    a046c5a9affdd77181e27d6f337f9d74

    7f53d5c4c5e930c25529823545eed0268f168c2c

    Detections

    AnalyzerVerdictAlert
    YARAhub by abuse.chmalware
    Detect files is `SliverFox` malware
    VirusTotalsuspicious

JavaScript (0)

HTTP Transactions (2)

URLIPResponseSize
www.ultfone.com/downloads/ianygo.exe?rnclid=11711324800327568501
104.18.31.122200 OK10 MB
any-data-recovery.com/downloads/ianygo.exe?rnclid=11711324800327568501
172.67.221.154301 Moved Permanently10 MB