Report - downloads.portableapps.com/portableapps/_cache/ZoomItPortable/7.1/ZoomIt.zip

Report Overview

Submitted URL
downloads.portableapps.com/portableapps/_cache/ZoomItPortable/7.1/ZoomIt.zip
IP
98.129.229.242
ASN
#53824 LIQUIDWEB
Submitted
2024-04-23 14:59:14
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
download2.portableapps.com	unknown	2005-01-10	2014-02-23	2024-04-18	530 B	1.2 MB	51.81.32.118
downloads.portableapps.com	unknown	2005-01-10	2014-05-09	2024-04-18	446 B	721 B	98.129.229.242

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

Files detected

URL
download2.portableapps.com/portableapps/_cache/ZoomItPortable/7.1/ZoomIt.zip
IP
51.81.32.118
ASN
#16276 OVH SAS

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.2 MB (1177491 bytes)
Hash
feaa04fcf07c5af88107d635a9410a03
a42df3113b088eef2e91cc25c97cafc442b0eaa8
4b5ce374a6c4ec917bb25135ae833cf24b5fdace4d3097393fabe8e844aeb045

Archive (4)

Filename

Md5

File type

ZoomIt.exe

759a13c56e88cb1114d6a52bebcdbffb

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

ZoomIt64.exe

45b8746713a29af6f7d633bfd898c1f3

PE32+ executable (GUI) x86-64, for MS Windows, 7 sections

ZoomIt64a.exe

50421457fd8d986bcaeeabf89a6c8c71

PE32+ executable (GUI) Aarch64, for MS Windows, 6 sections

Eula.txt

8c24c4084cdc3b7e7f7a88444a012bfc

Unicode text, UTF-8 (with BOM) text, with very long lines (518), with CRLF line terminators

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	downloads.portableapps.com/portableapps/_cache/ZoomItPortable/7.1/ZoomIt.zip	98.129.229.242	307 Temporary Redirect	373 B
URL User Request GET HTTP/1.1 downloads.portableapps.com/portableapps/_cache/ZoomItPortable/7.1/ZoomIt.zip IP 98.129.229.242:80 ASN #53824 LIQUIDWEB File type HTML document, ASCII text Size 373 B (373 bytes) Hash 4231fa5629dbb303974d6fc7cad74ce4 0501c74788ec6f9aef82d91ed184287b7236eadc 350f31561afa89a457e5124bb1bf95b7e14d7b36773738a1582914d0b5bfc93d HTTP Headers `GET /portableapps/_cache/ZoomItPortable/7.1/ZoomIt.zip HTTP/1.1 Host: downloads.portableapps.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 307 Temporary Redirect Server: Apache/2.4 Content-Type: text/html; charset=iso-8859-1 Date: Tue, 23 Apr 2024 14:58:49 GMT Location: http://download2.portableapps.com/portableapps/_cache/ZoomItPortable/7.1/ZoomIt.zip Connection: Keep-Alive Set-Cookie: X-Mapping-kjhgfmmm=35F848C5D7F69E3AC4DE9A21CE4F27CE; path=/ Content-Length: 373`

	download2.portableapps.com/portableapps/_cache/ZoomItPortable/7.1/ZoomIt.zip	51.81.32.118	200 OK	1.2 MB
URL User Request GET HTTP/2 download2.portableapps.com/portableapps/_cache/ZoomItPortable/7.1/ZoomIt.zip IP 51.81.32.118:443 ASN #16276 OVH SAS Certificate IssuerLet's Encrypt Subjectdownload2.portableapps.com Fingerprint85:F2:EE:32:0A:5C:4F:01:C6:83:73:3B:8F:D0:8F:99:87:4D:7E:B5 ValiditySun, 24 Mar 2024 11:05:43 GMT - Sat, 22 Jun 2024 11:05:42 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 1.2 MB (1177491 bytes) Hash feaa04fcf07c5af88107d635a9410a03 a42df3113b088eef2e91cc25c97cafc442b0eaa8 4b5ce374a6c4ec917bb25135ae833cf24b5fdace4d3097393fabe8e844aeb045 HTTP Headers GET /portableapps/_cache/ZoomItPortable/7.1/ZoomIt.zip HTTP/1.1 Host: download2.portableapps.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/2 200 OK date: Tue, 23 Apr 2024 14:58:49 GMT server: Apache/2.4.37 (AlmaLinux) OpenSSL/1.1.1k last-modified: Wed, 07 Feb 2024 15:20:33 GMT etag: "11f793-610cc3c6b0839" accept-ranges: bytes content-length: 1177491 content-type: application/zip X-Firefox-Spdy: h2`

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (4)

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers