Report - www.apple2works.com/marklim/ciderxpress.zip

Report Overview

Submitted URL
www.apple2works.com/marklim/ciderxpress.zip
IP
129.121.31.190
ASN
#46606 UNIFIEDLAYER-AS-1
Submitted
2024-04-24 17:02:46
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
6

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.apple2works.com	unknown	2020-06-10	2022-07-18	2023-09-02	413 B	1.9 MB	129.121.31.190

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.apple2works.com/marklim/ciderxpress.zip
IP
129.121.31.190
ASN
#46606 UNIFIEDLAYER-AS-1

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
1.9 MB (1919512 bytes)
Hash
b67f7092ac927cc791a282af794592af
91b250f1b2732b469e5f201335151f90e7db0e4f
799fb874f8ccf78705b8cdd2564a14f37b7020281e8956c926f64b3e9b3b34a2

Archive (146)

Filename

Md5

File type

DiskImage

db991237b1760a1925e6cc797dca47a0

ASCII text, with no line terminators

._DiskImage

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Headers

86c63de7bd8775780ac77380b5c049c4

ASCII text, with no line terminators

._Headers

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Resources

e58c4cf10cc7c8ef7d7167ccb641aeb4

ASCII text, with no line terminators

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

DiskImage

a83ac18482c80d995dbaedb2eb596537

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|NO_REEXPORTED_DYLIBS>] [ - ppc_7400: - Mach-O ppc_7400 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|NO_REEXPORTED_DYLIBS>] [ - x86_64: - Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|NO_REEXPORTED_DYLIBS>]

._DiskImage

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

DiskImg.h

d22ba2e3c452adacc24db4ce7453c336

C++ source, ASCII text, with CRLF line terminators

._DiskImg.h

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Headers

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Info.plist

e0e90755bd159f353ff484e288df7eed

XML 1.0 document, Unicode text, UTF-8 text

._Info.plist

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._A

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Current

7fc56270e7a70fa81a5935b72eacbe29

very short file (no magic)

._Current

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Versions

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._DiskImage.framework

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Headers

86c63de7bd8775780ac77380b5c049c4

ASCII text, with no line terminators

._Headers

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

hfs

49359c027a464880142390b264e27a54

ASCII text, with no line terminators

._hfs

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Resources

e58c4cf10cc7c8ef7d7167ccb641aeb4

ASCII text, with no line terminators

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

hfs.h

8b5710f3e13af391868f5a405da974b0

C source, ASCII text, with CRLF line terminators

._hfs.h

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Headers

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

hfs

6566313adb7c0c3a0e2a0e9830d3d82f

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>] [ - ppc_7400: - Mach-O ppc_7400 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>] [ - x86_64: - Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>]

._hfs

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Info.plist

074d73f857364e4d71aa91b10cc1188e

XML 1.0 document, ASCII text

._Info.plist

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._A

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Current

7fc56270e7a70fa81a5935b72eacbe29

very short file (no magic)

._Current

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Versions

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._hfs.framework

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Headers

86c63de7bd8775780ac77380b5c049c4

ASCII text, with no line terminators

._Headers

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

NuFX

1a4c3ffad4689539dd9bb028291f4ffd

ASCII text, with no line terminators

._NuFX

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Resources

e58c4cf10cc7c8ef7d7167ccb641aeb4

ASCII text, with no line terminators

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

NufxLib.h

1912f7ba439633556e8f18d51b0fb9cf

C source, ASCII text

._NufxLib.h

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Headers

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

NuFX

f18b191f44805e66aa2a7d45e22f26c6

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>] [ - ppc_7400: - Mach-O ppc_7400 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>] [ - x86_64: - Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>]

._NuFX

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Info.plist

a26773c28bd669e24aaad62fb9ce804c

XML 1.0 document, ASCII text

._Info.plist

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._A

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Current

7fc56270e7a70fa81a5935b72eacbe29

very short file (no magic)

._Current

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Versions

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._NuFX.framework

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Frameworks

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Info.plist

f12cbf9ec4143368650ac5a352db4b0a

XML 1.0 document, ASCII text

._Info.plist

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Info.plist

91e9357c63e98ef4cbe6cf9d08917005

XML 1.0 document, ASCII text

._Info.plist

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

QuickLookCXP

d90cd3430f0bdf50ec43e6b3858d7794

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>] [ - ppc_7400: - Mach-O ppc_7400 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>] [ - x86_64: - Mach-O 64-bit x86_64 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>]

._QuickLookCXP

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._MacOS

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

CiderXPress.png

42ef942dbb56905829df0d973d606a60

PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced

._CiderXPress.png

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

InfoPlist.strings

ef57bdd0f719a1c68f0d4fa55f5ec0cc

Unicode text, UTF-16, big-endian text

._InfoPlist.strings

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._English.lproj

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

harddisk.png

ea84fefb1f83dec111cd2fc804c5a7a3

PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced

._harddisk.png

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

jquery.js

6631a779321bc03f4a5281d3ff526254

JavaScript source, ASCII text, with very long lines (32061)

._jquery.js

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

microfloppy.png

058aa3c85c153fa402498c607dd20d85

PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced

._microfloppy.png

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

minifloppy.png

db5ec230dea4f3d3f02b5db59fd33c3e

PNG image data, 512 x 512, 8-bit/color RGB, non-interlaced

._minifloppy.png

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

style.css

a4ab34d6a543af1fe390214ddf5f61ee

ASCII text

._style.css

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

treeTable.js

2b2d3d728821bef1e284bdd7c125b061

JavaScript source, ASCII text, with very long lines (3902), with CR line terminators

._treeTable.js

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Contents

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._QuickLookCXP.qlgenerator

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._QuickLook

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Info.plist

f782d4293bc48d8da6180c3b38f4e4af

XML 1.0 document, ASCII text

._Info.plist

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

SpotlightCXP

da32a14c394dbafec2e0cf0d4f7d9278

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>] [ - ppc_7400: - Mach-O ppc_7400 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>] [ - x86_64: - Mach-O 64-bit x86_64 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>]

._SpotlightCXP

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._MacOS

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

InfoPlist.strings

c489dbb973b98d09e0ab44298bec53b4

Unicode text, UTF-16, big-endian text

._InfoPlist.strings

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

schema.strings

6ddbedc40ef2ef033c6d800e3f251901

Unicode text, UTF-16, big-endian text

._schema.strings

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._English.lproj

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

schema.xml

4e166ab1b0590faf88c5baea7badca61

XML 1.0 document, ASCII text

._schema.xml

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Contents

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._SpotlightCXP.mdimporter

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Spotlight

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Library

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

CiderXPress

6c1a57579ebf75fa36b0961d18a873a2

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>] [ - ppc_7400: - Mach-O ppc_7400 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>] [ - x86_64: - Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>]

._CiderXPress

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._MacOS

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

PkgInfo

233bbb4ea498a34744740288510dda0b

ASCII text, with no line terminators

._PkgInfo

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

AppModalDialog.nib

d973d14e96efed07be2714353cb725c1

Apple binary property list

._AppModalDialog.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

CatalogWindow.nib

6c19b034881b5844304485553d2e8ac0

Apple binary property list

._CatalogWindow.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

ChangeWindow.nib

967ed2a609adf449607a9cb196888cdc

Apple binary property list

._ChangeWindow.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

CiderXPress.icns

f79ea9ada48ffd870091207d62a97fea

Mac OS X icon, 236400 bytes, "is32" type

._CiderXPress.icns

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

CXPWindow.nib

4e1d04adee2c9c0c2a87b6fe2ffc0f67

Apple binary property list

._CXPWindow.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

DirInfoWindow.nib

2e268ed74690cfc01b50cf75fe9245bc

Apple binary property list

._DirInfoWindow.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

DocModalDialog.nib

56c1ee451e3cf1f915c894e90a6cb840

Apple binary property list

._DocModalDialog.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Credits.rtf

c2dea2eeca97b4597663e4661c9f3894

Rich Text Format data, version 1, ANSI, code page 1252

._Credits.rtf

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

InfoPlist.strings

d72878bb656f235c73b049056cd30dba

Unicode text, UTF-16, big-endian text

._InfoPlist.strings

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._en.lproj

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

FileInfoWindow.nib

84793b050f613712f64de18c94f085b6

Apple binary property list

._FileInfoWindow.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

LICENSE.txt

2ce14ddd879f8d9fdb064e8f687df3ae

ASCII text, with CRLF line terminators

._LICENSE.txt

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

MainMenu.nib

1896f3e7d1d5eaa78d30472ba4f9b630

Apple binary property list

._MainMenu.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

NewDiskImageWindow.nib

12d8edeeef267763db884292fc8d1719

Apple binary property list

._NewDiskImageWindow.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

PasteWindow.nib

4500ae71d10c6f418716ccf931d149c4

Apple binary property list

._PasteWindow.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Preferences.nib

e97b9e813c7e882d48dde52b6b3854f2

Apple binary property list

._Preferences.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

ReadMe.rtf

4bd46ff47cbef31f39fcf822fe9b2ad5

Rich Text Format data, version 1, ANSI, code page 1252

._ReadMe.rtf

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

RenameWindow.nib

1626383a255c96100b48e8ba1510fa05

Apple binary property list

._RenameWindow.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Contents

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._CiderXPress.app

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

www.apple2works.com/marklim/ciderxpress.zip

129.121.31.190

200 OK

1.9 MB

URL User Request GET HTTP/1.1
www.apple2works.com/marklim/ciderxpress.zip
IP
129.121.31.190:80
ASN
#46606 UNIFIEDLAYER-AS-1

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
1.9 MB (1919512 bytes)
Hash
b67f7092ac927cc791a282af794592af
91b250f1b2732b469e5f201335151f90e7db0e4f
799fb874f8ccf78705b8cdd2564a14f37b7020281e8956c926f64b3e9b3b34a2

HTTP Headers

GET /marklim/ciderxpress.zip HTTP/1.1
Host: www.apple2works.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:02:21 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Thu, 11 Jan 2024 17:07:12 GMT
Accept-Ranges: bytes
Content-Length: 1919512
Keep-Alive: timeout=5, max=75
Content-Type: application/zip