Report - www.hibitsoft.ir/HiBitUninstaller/HiBitUninstaller-setup-3.1.95.exe

Report Overview

Visitedpublic

2024-11-06 16:35:47

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
www.hibitsoft.ir	unknown	unknown	2017-11-19	2024-10-27	1.0 kB	3.6 MB	185.159.153.125

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-11-06	medium	www.hibitsoft.ir/HiBitUninstaller/HiBitUninstaller-setup.exe	Scans presence of the found strings using the in-house brute force method

OpenPhish

No alerts detected

PhishTank

No alerts detected

Mnemonic Secure DNS

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

www.hibitsoft.ir/HiBitUninstaller/HiBitUninstaller-setup.exe

IP / ASN

185.159.153.125

#201999 Fanavari Serverpars Argham Gostar Company Ltd.

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

Size3.6 MB (3557817 bytes)

MD5dd05dc5cbbc91d400d5753f50098276e

SHA16e03a1a2f8a1437094daf4ea02e5544d74f1c2da

SHA256fdb2fc6124b4572a4c7a8905fc428a4be1966288fe17e5d1e04491b1176976ed

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Scans presence of the found strings using the in-house brute force method
VirusTotal	suspicious	VirusTotal - Scan result 1/70

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET www.hibitsoft.ir/HiBitUninstaller/HiBitUninstaller-setup-3.1.95.exe

185.159.153.125

301 Moved Permanently

276 B

URL User Request GET HTTPS

www.hibitsoft.ir/HiBitUninstaller/HiBitUninstaller-setup-3.1.95.exe

IP / ASN

185.159.153.125

#201999 Fanavari Serverpars Argham Gostar Company Ltd.

Requested byN/A

Resource Info

File typeHTML document, ASCII text

First Seen2023-07-02

Last Seen2024-11-27

Times Seen4

Size276 B (276 bytes)

MD5fd13cf1f44de6081bdb18e98590872cb

SHA10a5216dc53a1f959653f5b3c959f20753e3c8ec7

SHA256e6fa5fda67cbbb68d4b3abd3f388ab1db9f97f85fb53dc670aff8f29584229b8

Certificate Info

IssuerLet's Encrypt

Subjecthibitsoft.ir

Fingerprint8A:3E:9B:DF:AF:37:8F:60:09:60:71:07:1C:38:22:E2:62:58:86:9A

ValiditySat, 12 Oct 2024 11:58:36 GMT - Fri, 10 Jan 2025 11:58:35 GMT

HTTP Headers

GET /HiBitUninstaller/HiBitUninstaller-setup-3.1.95.exe HTTP/1.1
Host: www.hibitsoft.ir
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 06 Nov 2024 16:35:23 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 276
Connection: keep-alive
Location: https://www.hibitsoft.ir/HiBitUninstaller/HiBitUninstaller-setup.exe

GET www.hibitsoft.ir/HiBitUninstaller/HiBitUninstaller-setup.exe

185.159.153.125

200 OK

3.6 MB

URL User Request GET HTTPS

www.hibitsoft.ir/HiBitUninstaller/HiBitUninstaller-setup.exe

IP / ASN

185.159.153.125

#201999 Fanavari Serverpars Argham Gostar Company Ltd.

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

First Seen2024-09-25

Last Seen2024-12-28

Times Seen7

Size3.6 MB (3557817 bytes)

MD5dd05dc5cbbc91d400d5753f50098276e

SHA16e03a1a2f8a1437094daf4ea02e5544d74f1c2da

SHA256fdb2fc6124b4572a4c7a8905fc428a4be1966288fe17e5d1e04491b1176976ed

Certificate Info

IssuerLet's Encrypt

Subjecthibitsoft.ir

Fingerprint8A:3E:9B:DF:AF:37:8F:60:09:60:71:07:1C:38:22:E2:62:58:86:9A

ValiditySat, 12 Oct 2024 11:58:36 GMT - Fri, 10 Jan 2025 11:58:35 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Scans presence of the found strings using the in-house brute force method
VirusTotal	suspicious	VirusTotal - Scan result 1/70

HTTP Headers

GET /HiBitUninstaller/HiBitUninstaller-setup.exe HTTP/1.1
Host: www.hibitsoft.ir
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 06 Nov 2024 16:35:23 GMT
Content-Type: application/x-msdownload
Content-Length: 3557817
Connection: keep-alive
Last-Modified: Wed, 25 Sep 2024 12:00:25 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent