Report Overview
Visitedpublic
2025-01-20 11:20:21
Tags
Submit Tags
URL
www.morkoskhalaf.com/ankhtech/Toolbox/ATToolbox/Temp/Portable/compressed/Wub.exe
Finishing URL
about:privatebrowsing
IP / ASN
104.21.90.214
Title
about:privatebrowsing
Detections
urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
0
Host Summary
| Host | Rank | Registered | First Seen | Last Seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
www.morkoskhalaf.com 1 alert(s) on this Host | unknown | 2020-03-24 | 2023-03-28 | 2025-01-14 | 721 B | 1.1 MB |  172.67.161.108 |
Related reports
Threat Detection Systems
Public InfoSec YARA rules
No alerts detected
OpenPhish
No alerts detected
PhishTank
No alerts detected
Quad9 DNS
No alerts detected
ThreatFox
No alerts detected
File detected
URL
www.morkoskhalaf.com/ankhtech/Toolbox/ATToolbox/Temp/Portable/compressed/Wub.exe
IP / ASN
104.21.90.214
File Overview
File TypeZip archive data, at least v2.0 to extract, compression method=store
Size1.1 MB (1069677 bytes)
MD539787969b6d7f5ed64faf3385442335b
SHA161b312e1cc2721a785b9596b27687541f5b8169f
Archive (4)
| Filename | MD5 | File type |
|---|---|---|
| VersionInfo.txt | e5316699929d6736e9c0c3b638ec8c2a | ISO-8859 text, with CRLF line terminators |
| Wub.exe | 82aff8883099cf75462057c4e47e88ac | PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections |
| Wub.ini | dde773082a46430b53bbfee19d8bb56f | Unicode text, UTF-16, little-endian text, with CRLF line terminators |
| Wub_x64.exe | 9d6778f7f274f7ecd4e7e875a7268b64 | PE32+ executable (GUI) x86-64, for MS Windows, 5 sections |
Detections
| Analyzer | Verdict | Alert |
|---|---|---|
| Public InfoSec YARA rules | malware | Identifies compiled AutoIT script (as EXE). |
| Public InfoSec YARA rules | malware | Identifies compiled AutoIT script (as EXE). |
JavaScript (0)
No JavaScripts
HTTP Transactions (2)
| URL | IP | Response | Size |
|---|