Report - tongping.s3.amazonaws.com/qrcode5351c4c475aa400fa4d1eb65288858391688808765352.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240510T155707Z&X-Amz-SignedHeaders=host&X-Amz-Expires=3600&X-Amz-Credential=AKIA4HQVKJDIHKQI2MUV/20240510/us-east-1/s3/aws4_request&X-Amz-Signature=4f38589d07f427d3035256f8aec8fe77276c19adb5d2a1bef97a22bdf05e7371

Report Overview

Submitted URL
tongping.s3.amazonaws.com/qrcode5351c4c475aa400fa4d1eb65288858391688808765352.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240510T155707Z&X-Amz-SignedHeaders=host&X-Amz-Expires=3600&X-Amz-Credential=AKIA4HQVKJDIHKQI2MUV/20240510/us-east-1/s3/aws4_request&X-Amz-Signature=4f38589d07f427d3035256f8aec8fe77276c19adb5d2a1bef97a22bdf05e7371
IP
3.5.25.200
ASN
#14618 AMAZON-AES
Submitted
2024-05-10 15:57:51
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
3

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
tongping.s3.amazonaws.com	unknown	unknown	No data	No data	794 B	4.0 MB	3.5.28.184

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
tongping.s3.amazonaws.com/qrcode5351c4c475aa400fa4d1eb65288858391688808765352.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240510T155707Z&X-Amz-SignedHeaders=host&X-Amz-Expires=3600&X-Amz-Credential=AKIA4HQVKJDIHKQI2MUV/20240510/us-east-1/s3/aws4_request&X-Amz-Signature=4f38589d07f427d3035256f8aec8fe77276c19adb5d2a1bef97a22bdf05e7371
IP
3.5.28.184
ASN
#14618 AMAZON-AES

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
4.0 MB (3988134 bytes)
Hash
8049ac119ec28cacca0b3c32d232135f
f6eebb67234d461b825c87caee25730d4aec631c
45af85c04d68375c35e60610e022264831740cad0bbbb13a736945b03e15969c

Archive (20)

Filename

Md5

File type

KShare_shangyong.exe

51ead0961613010a47274373f5dabdbf

PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections

ExpansionScreen.dll

ddc9b17d8c460ee3a208f562fbcede07

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

ExpansionScreen.inf

680fb08d63265d1f92aec3044739473d

Windows setup INFormation

expansionscreen.cat

e26f73d261e1d03838afcde3ad5bd834

DER Encoded PKCS#7 Signed Data

ExpansionScreen.dll

3451470759379eaf2a4f707f8a0fd434

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections

ExpansionScreen.inf

eb837192428fd723aa9ee379442b89ce

Windows setup INFormation

expansionscreen.cat

8ba43f753813859c47697b99beb6e8bd

DER Encoded PKCS#7 Signed Data

ExpansionScreen.cer

44e3e0eee95dab118e50bb5c5c894594

Certificate, Version=3

Statbus.cer

44e3e0eee95dab118e50bb5c5c894594

Certificate, Version=3

Statbus.sys

20697a5c5d69a3176f58977e751f0a51

PE32+ executable (native) x86-64, for MS Windows, 8 sections

kmdfsamples.cat

63505c7bbe0a39fadad615f40972004d

DER Encoded PKCS#7 Signed Data

statbus.inf

b5f619475c15308c4cf9fc53c6a0066b

Windows setup INFormation

StatBus.sys

bc953e3884ec6b642c561c79b24e2a17

PE32 executable (native) Intel 80386, for MS Windows, 7 sections

kmdfsamples.cat

a4f69592bb7d3c78afbd905069d378bf

DER Encoded PKCS#7 Signed Data

statbus.inf

f2d247762bad5da899676dcad558d2a5

Windows setup INFormation

devcon.exe

2f429a7437b47ee774f9c7318b99aa0c

PE32+ executable (console) x86-64, for MS Windows, 6 sections

devcon.exe

ebe2414f870597900228a7f87ae00b8d

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

install.bat

69623f3d0f48adff67d1f18bd2de1e20

DOS batch file, ASCII text, with CRLF line terminators

install_ca.exe

13b238590da404fee7a2c0659d271a46

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

uninstall.bat

17035c4d6f0b57e23ef1e88e3beb65d8

DOS batch file, ASCII text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
VirusTotal	suspicious	VirusTotal - Scan result 2/63

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

tongping.s3.amazonaws.com/qrcode5351c4c475aa400fa4d1eb65288858391688808765352.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240510T155707Z&X-Amz-SignedHeaders=host&X-Amz-Expires=3600&X-Amz-Credential=AKIA4HQVKJDIHKQI2MUV/20240510/us-east-1/s3/aws4_request&X-Amz-Signature=4f38589d07f427d3035256f8aec8fe77276c19adb5d2a1bef97a22bdf05e7371

3.5.28.184

200 OK

4.0 MB

URL User Request GET HTTP/1.1
tongping.s3.amazonaws.com/qrcode5351c4c475aa400fa4d1eb65288858391688808765352.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240510T155707Z&X-Amz-SignedHeaders=host&X-Amz-Expires=3600&X-Amz-Credential=AKIA4HQVKJDIHKQI2MUV/20240510/us-east-1/s3/aws4_request&X-Amz-Signature=4f38589d07f427d3035256f8aec8fe77276c19adb5d2a1bef97a22bdf05e7371
IP
3.5.28.184:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subject*.s3.amazonaws.com
FingerprintDC:41:A6:3E:EE:32:6F:36:76:5A:EF:9D:17:AF:14:13:E3:05:C6:D1
ValidityTue, 10 Oct 2023 00:00:00 GMT - Wed, 03 Jul 2024 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
4.0 MB (3988134 bytes)
Hash
8049ac119ec28cacca0b3c32d232135f
f6eebb67234d461b825c87caee25730d4aec631c
45af85c04d68375c35e60610e022264831740cad0bbbb13a736945b03e15969c

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 2/63

HTTP Headers

GET /qrcode5351c4c475aa400fa4d1eb65288858391688808765352.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240510T155707Z&X-Amz-SignedHeaders=host&X-Amz-Expires=3600&X-Amz-Credential=AKIA4HQVKJDIHKQI2MUV/20240510/us-east-1/s3/aws4_request&X-Amz-Signature=4f38589d07f427d3035256f8aec8fe77276c19adb5d2a1bef97a22bdf05e7371 HTTP/1.1
Host: tongping.s3.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: BYGmMOa5wgQGJahQYHGX+aXZe4gQovYjUi4eNm/tOAQtc5ZegJN/WTTKHTjM/7pgTYQUnVzP8DWpb/ObWvMwEIpbVXp8enf9rvYC5/rkS1Q=
x-amz-request-id: KZ3AV1KZN5Z6AN89
Date: Fri, 10 May 2024 15:57:25 GMT
Last-Modified: Sat, 08 Jul 2023 09:32:47 GMT
ETag: "8049ac119ec28cacca0b3c32d232135f"
x-amz-server-side-encryption: AES256
Content-Disposition: attachment; filename ="KShare_shangyong_V1.0.67.zip"
Accept-Ranges: bytes
Content-Type: application/octet-stream
Server: AmazonS3
Content-Length: 3988134

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (20)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers