Report - www.softwareok.de/Download/DesktopOK.zip

Report Overview

Visited public
2023-12-12 23:21:42
Tags
URL
www.softwareok.de/Download/DesktopOK.zip
Finishing URL
about:privatebrowsing
IP / ASN
212.227.175.120
#8560 IONOS SE
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
zerossl.ocsp.sectigo.com	4049	2018-08-16	2020-05-09 21:05:29	2023-12-12 17:38:31	348 B	1.2 kB	104.18.38.233
www.softwareok.de	unknown	unknown	2012-05-25 19:42:20	2023-12-04 03:20:45	506 B	601 kB	212.227.175.120

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-12-12 23:21:16	low	212.227.175.120	Client IP	ET INFO Observed ZeroSSL SSL/TLS Certificate

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.softwareok.de/Download/DesktopOK.zip
IP
212.227.175.120
ASN
#8560 IONOS SE

File type
Zip archive data, at least v2.0 to extract, compression method=deflate - data
Size
601 kB (600692 bytes)
Hash
2fa6c1f6d67664210e5b1c1fd16d18bd
7adeeb54f1d9d970c067feb819cba35310133264
16ab387e458e998d24ab00a93780db1db55ee4a7b88326b2051fe00a624a0116

Archive (9)

Filename

Md5

File type

leggimi.txt

db868c0dccce19bd9200a801a7adbd0f

ISO-8859 text, with CRLF line terminators

liesmich.txt

20744746a90487ed39c298ffa2f8c238

ISO-8859 text, with CRLF line terminators

Lisez-moi.txt

2e0b5dde7802377936aaff70cd7b9285

ISO-8859 text, with CRLF line terminators

readme.txt

8004f9524b7385b294b6f2e0378ce944

news or mail, ASCII text, with CRLF line terminators

прочетиме.txt

8d8c56abf4f2d52dfee3f3910becd4d3

Unicode text, UTF-8 text, with CRLF line terminators

ПрочтиМеня.txt

bb40f1a62a41d5eec06a3f090fbd5c0b

ISO-8859 text, with CRLF line terminators

ЧитайМеня.txt

b7445bd85f60d5e924bb69189fb4be03

Unicode text, UTF-16, little-endian text, with CRLF line terminators

읽어보기.txt

baf0a8ba8adba4c43d36949666fab3e0

Unicode text, UTF-16, little-endian text, with CRLF line terminators

DesktopOK.exe

ac6c13cdc8e107d03f00efff28d203d2

PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	zerossl.ocsp.sectigo.com/	104.18.38.233		728 B
URL zerossl.ocsp.sectigo.com/ IP 104.18.38.233:0 ASN #13335 CLOUDFLARENET File type data Size 728 B (728 bytes) Hash f05dcfcf95aed19220c9e7169eab781a 71644eebd951c078fcae9c82ae6b5c5229722143 f846a09555a9b719c7e0100bd0b323f603fe544a64fe6e36ae657d549cca5277 HTTP Headers `POST / HTTP/1.1 Host: zerossl.ocsp.sectigo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 84 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 12 Dec 2023 23:21:16 GMT Content-Type: application/ocsp-response Content-Length: 728 Connection: keep-alive Last-Modified: Mon, 11 Dec 2023 12:53:31 GMT Expires: Mon, 18 Dec 2023 12:53:30 GMT Etag: "71644eebd951c078fcae9c82ae6b5c5229722143" Cache-Control: max-age=480133,s-maxage=1800,public,no-transform,must-revalidate X-CCACDN-Proxy-ID: mcdpinlb2 X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8349b3e5da1c7130-OSL`

	www.softwareok.de/Download/DesktopOK.zip	212.227.175.120	200 OK	601 kB
URL User Request GET HTTP/2 www.softwareok.de/Download/DesktopOK.zip IP 212.227.175.120:443 ASN #8560 IONOS SE Certificate IssuerZeroSSL Subjectsoftwareok.de Fingerprint2A:EC:F8:65:B5:6F:57:B7:FF:8D:71:06:97:23:C0:79:F3:AE:CB:9C ValidityWed, 22 Nov 2023 00:00:00 GMT - Tue, 20 Feb 2024 23:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate - data Size 601 kB (600692 bytes) Hash 2fa6c1f6d67664210e5b1c1fd16d18bd 7adeeb54f1d9d970c067feb819cba35310133264 16ab387e458e998d24ab00a93780db1db55ee4a7b88326b2051fe00a624a0116 HTTP Headers `GET /Download/DesktopOK.zip HTTP/1.1 Host: www.softwareok.de User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK content-type: application/x-zip-compressed last-modified: Thu, 19 Oct 2023 10:47:38 GMT accept-ranges: bytes etag: "58d92cad792da1:0" server: Microsoft-IIS/10.0 date: Tue, 12 Dec 2023 23:21:16 GMT content-length: 600692 X-Firefox-Spdy: h2`

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (9)

Detections

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers