Report - raw.githubusercontent.com/JPElectron/DNSRedirOSS/main/dnsredir-download.zip

Report Overview

Submitted URL
raw.githubusercontent.com/JPElectron/DNSRedirOSS/main/dnsredir-download.zip
IP
185.199.110.133
ASN
#54113 FASTLY
Submitted
2024-04-25 16:11:31
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
raw.githubusercontent.com	35802	2014-02-06	2014-03-01	2024-04-24	529 B	283 kB	185.199.111.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
raw.githubusercontent.com/JPElectron/DNSRedirOSS/main/dnsredir-download.zip
IP
185.199.111.133
ASN
#54113 FASTLY

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
282 kB (281819 bytes)
Hash
fa5753c6779fbc6381d8222f19622c83
ed4235248e2e0bc32d92dd4e639a7ff56af12cf5
bb031372a089cc8066e180221db70952e23facecb3e1e5c6b8af7e178f63d846

Archive (25)

Filename

Md5

File type

_setup_.bat

e50da66d15e0219610909dd406ed11f2

DOS batch file, ASCII text, with CRLF line terminators

dnsredir -faq.url

06e5f59709aeaa07ca0e1649c800ceca

MS Windows 95 Internet shortcut text (URL=<http://dnsredirector.com/faq>), ASCII text, with CRLF line terminators

dnsredir -readme.url

c0f2156c5e83c9d55c2ba354bb150227

MS Windows 95 Internet shortcut text (URL=<http://dnsredirector.com/readme>), ASCII text, with CRLF line terminators

dnsredir.ini

6fe68dbf260ddd2bdf4c0d8db70ff49c

ASCII text, with CRLF line terminators

dnsrlib.dll

3d675efa9eb3b7b1be1390f6a7763f8b

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

dnsrsvc.exe

30e52da9d0bb8d17877d98f6bafd9fa3

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

dnsrsvc-install.bat

e00b5f2df5991be3019dcffc989fd013

DOS batch file, ASCII text, with CRLF line terminators

fixFirewall.bat

f9dc99496119919847d8562366bebdc4

DOS batch file, ASCII text, with CRLF line terminators

fixNTFS.bat

0c82cd298c5d662889d719ceca4f0089

DOS batch file, ASCII text, with CRLF line terminators

blocked -suggested.zip

7dd382ff531fe9b417b05232ea7bb491

Zip archive data, at least v2.0 to extract, compression method=deflate

connecttest.txt

04c3fc4a88588ee47d33d066920ac410

ASCII text, with no line terminators

ncsi.txt

cd5a4d3fdd5bffc16bf959ef75cf37bc

ASCII text, with no line terminators

REG-UrlSegmentMaxLength.reg

414e7565889c82d0170ef9f56f909c23

Windows Registry little-endian text (Win2K or above)

welcome -suggested.zip

1b9f539e9684030cabc808dedec11ecd

Zip archive data, at least v2.0 to extract, compression method=deflate

remDailyLogs.bat

aca6ce9521a973761fbab0d1ce4fcebe

DOS batch file, ASCII text, with CRLF line terminators

_checkdns_.bat

e44e8209f26520a9e1f398099f95d1fe

DOS batch file, ASCII text, with CRLF line terminators

_runreport_.bat

9aa477cfa7d8d84c9cfbfeb88a74716f

DOS batch file, ASCII text, with CRLF line terminators

_viewlivelog_.bat

7eb7356f5688024b29e023039b4f5428

DOS batch file, ASCII text, with CRLF line terminators

PS-reports.ps1

83a533154619524107b833c01ae8100c

ASCII text, with CRLF line terminators

REG-baretail-defaults.reg

e88bf5ef47924bc0db0e10dd4459335b

Windows Registry little-endian text (Win2K or above)

System.Net.IPNetwork.dll

81d3d74290b70dad002c02945767c72e

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

updater -readme.url

49692ea4a5dd3f32df93d8ea373d08c7

MS Windows 95 Internet shortcut text (URL=<http://dnsredirector.com/update>), ASCII text, with CRLF line terminators

updater.exe

29d2508e23a700b81a018e31c027651d

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

updaterdone.bat

2c980da616b1041f8b2e72d0400767e1

DOS batch file, ASCII text, with CRLF line terminators

updatersetup.bat

2400998831631effb55c67d60da9add2

DOS batch file, ASCII text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
VirusTotal	suspicious	VirusTotal - Scan result 2/65

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

raw.githubusercontent.com/JPElectron/DNSRedirOSS/main/dnsredir-download.zip

185.199.111.133

200 OK

282 kB

URL User Request GET HTTP/2
raw.githubusercontent.com/JPElectron/DNSRedirOSS/main/dnsredir-download.zip
IP
185.199.111.133:443
ASN
#54113 FASTLY

Certificate
IssuerDigiCert Inc
Subject*.github.io
Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28
ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
282 kB (281819 bytes)
Hash
fa5753c6779fbc6381d8222f19622c83
ed4235248e2e0bc32d92dd4e639a7ff56af12cf5
bb031372a089cc8066e180221db70952e23facecb3e1e5c6b8af7e178f63d846

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 2/65

HTTP Headers

GET /JPElectron/DNSRedirOSS/main/dnsredir-download.zip HTTP/1.1
Host: raw.githubusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: application/zip
etag: W/"9c427ce77feab733e9d4957455983da468747048f07ad5f4944f64f9656b90dd"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: EA4A:9F2C5:29A4B1:2B4139:662A809A
accept-ranges: bytes
date: Thu, 25 Apr 2024 16:11:06 GMT
via: 1.1 varnish
x-served-by: cache-hel1410030-HEL
x-cache: MISS
x-cache-hits: 0
x-timer: S1714061466.201937,VS0,VE159
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 16bf9372ed278841ec837236793958ae1654bd25
expires: Thu, 25 Apr 2024 16:16:06 GMT
source-age: 0
content-length: 281819
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (25)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers