Report - crapware.aidf.org/download/cm413

Report Overview

Submitted URL
crapware.aidf.org/download/cm413_64.zip
IP
81.177.140.11
ASN
#8342 JSC RTComm.RU
Submitted
2024-05-04 11:02:55
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
3

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
crapware.aidf.org	unknown	2008-05-04	2012-05-30	2024-03-12	409 B	2.8 MB	81.177.140.11

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
crapware.aidf.org/download/cm413_64.zip
IP
81.177.140.11
ASN
#8342 JSC RTComm.RU

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
2.8 MB (2810297 bytes)
Hash
af4abfc0235295976303a4214bd82957
ec94de7f016c21c96bd03fb5d8e06e5e964499f4
eb695eede056b461b379d505b4d6db9878ead60050347f8605cc2a2e702e2201

Archive (71)

Filename

Md5

File type

Clickermann.exe

a43d18d0a871d1a282e6717301b9bd50

PE32+ executable (GUI) x86-64, for MS Windows, 12 sections

config.ini

9a036deebaaedb6dea4141b6deb291fc

Generic INItialization configuration [core]

config_editor.ini

f13ad46675da46f947389b348ef33d67

Generic INItialization configuration [window]

const.txt

7ce5aecc10ce04264638117e9624007f

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

history.txt

ecaa88f7fa0bf610a5a26cf545dcd3aa

Unicode text, UTF-8 text, with no line terminators

history_editor.txt

ecaa88f7fa0bf610a5a26cf545dcd3aa

Unicode text, UTF-8 text, with no line terminators

keywords.txt

5eb4acee32f34c302464084e9a2ec8d5

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

gui.txt

44ce0b5de1b8a6e45675682802c52eac

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

qinsert_menu.txt

dd14046c09b76e35cf4004883ebba367

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

for.txt

4054e195cef77424f5e92d5ae973239a

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

if_else.txt

4c8b03bb7053c093c303c099f0a8f5fa

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

if_pixel_in.txt

ed835f9fea8fe5c6deb5190ed253b1eb

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

sub.txt

7c07bebe7fec2f0226574aa7a914086b

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

gui.txt

e78ce01698c2711be50be72eeee3ca10

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

qinsert_menu.txt

45f7153e71c2122199db11034480e5be

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

ISKEYDOWN

f4136eccf7b05dbc834c184bc0cea732

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Log

5745fd668fb4278aab5759e8302587bb

Unicode text, UTF-8 (with BOM) text, with no line terminators

SUB

ec516dd4fd16d427d95eb744fbbd8eac

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

SUB � ��ࠬ��ࠬ�

aef018575d0ccc70f9758a9133a075e3

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

COLORMODE

c76bf24fba02a82a04148dce9074a141

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

COLORMODE (��⮩ ᯮᮡ �� ᭨��)

ecaaea9dee9b653bcb55bde009746e59

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

IF_PICTURE_IN

f7410e37c202b5067098b0d181c7dc1b

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

IF_PIXEL_IN

a5e2ef33af5522922cb5f9fc869f85f4

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

PXL

2842390b8e426c8c5ab1034340e09dac

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

PXLREPLACE

4370d4ed7e3f06b2c82733ebba6fd34d

Unicode text, UTF-8 (with BOM) text, with no line terminators

SCANPICTURE

c6d98a093d5ba42537c1dfe55be4528e

ISO-8859 text, with CRLF line terminators

SCANPICTURE (�ਬ��)

67bdf54d86193c4b623fc20b6943321c

ISO-8859 text, with CRLF line terminators

SCANPXL

4a200a0a8b4bc638bf83ade7acb1267b

ISO-8859 text, with CRLF line terminators

SCANPXL (�ਬ��)

069092acaf1b303f1487aca9420e171f

ISO-8859 text, with CRLF line terminators

�� ⨭��

7bb4805d75a39a4cad2d80698aa857e9

ASCII text, with CRLF line terminators

�� ⨭�� ⠩��஬

473ddabd4c77bc34069e3af7cd51f609

ISO-8859 text, with CRLF line terminators

�� 梥��

8cf4c3447cbd516903bc8a31b5405e05

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

�� 梥�� IF_PIXEL_IN

8fbcb32ffe0cc3eaf14562917cb44891

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Alt+

bfb93de3d295d299544c94ede743bcb3

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Ctrl+

5b154f3862933b4e597ee27af645a85c

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Ctrl+C

5b8f16b72225822e17d769f74b89e84d

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Ctrl+V

4045bcdf7d94652da4aebf77c73f4619

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Ctrl+X

e208bec625def98d18c0842d84740fb3

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

KeyDown + KeyUp

940a87c867d0c2aa6194ce55afabfd58

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

LDown + LUp

1cc7cbdae0727ca5b9bf98be099e8671

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Shift+

e5c627d0e5590cb95a9ae4333ac6fa72

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

�� ६��

21963278771a9cfd5ea896161885c856

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

��४��⥫�

bedf9a8a79ad89c4ee39cba90af4f927

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

��

05c671ce6cf0e5861c1a29d35170dc1b

Unicode text, UTF-8 (with BOM) text, with no line terminators

FOR

e591ac89b9c828f1249f02eae50e81b5

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

5539f6246d75aa5dafdac42728071ced

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

IF_ELSE

071ab5ba1e93e4df1c27d2b06caeed9a

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

SWITCH

ba28a81ad179b1b943e4300447ac2184

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

THREAD - ��⮪

bf6d9ab35fb078bef46edb50e5350647

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

WHILE

7c99ec84906bdc4e4248ea4d13b0f632

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

�뢮� ��ᨢ� � ��

220dcd2c5ff901120dd93e1668bd9243

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

�� + ⠩��

1b9156fb527741a53232b52890f2b590

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

�᫮�� ⠩��஬

058eefd21b59ae2a0c446029abcea5ea

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

pause.bmp

1fafba3993ad6aacee6ef6c73f717795

PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54

play.bmp

1cbfc3c80257dbda9765b9edb51e7ae7

PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54

rec.bmp

d3f50c3cbd8a75d6078e51020886f773

PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54

error.wav

bab81142ed2f8af59e2d3111abdeedd0

RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 44100 Hz

load.wav

ad8a3d51c785272c327e3ce507c0df8b

RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 22050 Hz

pause.wav

a0da323d269433b9ad050a2f6d374130

RIFF (little-endian) data, WAVE audio, Microsoft ADPCM, stereo 44100 Hz

play.wav

010a3c279ac736a2b1e2bd9138f3346c

RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 22050 Hz

record.wav

ba95b09f6c80b6d4fcc218a4009c0ace

RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 22050 Hz

silence.wav

b21513c813b1ea8f4fc82e786560694d

RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 22050 Hz

stop.wav

14e31067584bbb6baef273ac2a9a59d8

RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 11025 Hz

help.chm

c7c6614ad6511e0c2bfa727ef311f2a0

MS Windows HtmlHelp Data

ioport.dll

ac0c3ae82ec0764c605fa59e7bf05614

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

main.cms

7a854ddc59027f8c5b4a415ed05ac7c1

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

shit.bmp

ee11739d07278e43ad52426a2c3daeee

PC bitmap, Windows 3.x format, 18 x 17 x 24, image size 952, cbSize 1006, bits offset 54

LogPass.txt

a4122bb9e4f716626c03ad3543cebcc3

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Test.bmp

fa53051d5727422b28af5163367d97fd

PC bitmap, Windows 3.x format, 16 x 13 x 24, image size 626, resolution 2834 x 2834 px/m, cbSize 680, bits offset 54

��让 ��.cms

5ef2bf2dcaa0a9baf73f449ac79072f0

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

�� 寮��প�.url

888cc04f3fed5b68ac4add38fca07e6e

Generic INItialization configuration [InternetShortcut]

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpoutx64.sys
VirusTotal	suspicious	VirusTotal - Scan result 9/67

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

crapware.aidf.org/download/cm413_64.zip

81.177.140.11

200 OK

2.8 MB

URL User Request GET HTTP/1.1
crapware.aidf.org/download/cm413_64.zip
IP
81.177.140.11:80
ASN
#8342 JSC RTComm.RU

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
2.8 MB (2810297 bytes)
Hash
af4abfc0235295976303a4214bd82957
ec94de7f016c21c96bd03fb5d8e06e5e964499f4
eb695eede056b461b379d505b4d6db9878ead60050347f8605cc2a2e702e2201

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 9/67

HTTP Headers

GET /download/cm413_64.zip HTTP/1.1
Host: crapware.aidf.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 04 May 2024 11:02:28 GMT
Content-Type: application/zip
Content-Length: 2810297
Connection: keep-alive
Server: Jino.ru/mod_pizza
Last-Modified: Thu, 26 Jul 2018 07:22:24 GMT
ETag: "a110860-2ae1b9-571e1db47f1e0"
Accept-Ranges: bytes

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (71)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers