Report - cdn.medion.com/downloads/software/00_Bios_Specialist_P10

Report Overview

Submitted URL
cdn.medion.com/downloads/software/00_Bios_Specialist_P10_.zip
IP
46.38.240.32
ASN
#197540 netcup GmbH
Submitted
2024-04-24 08:24:19
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cdn.medion.com	unknown	1997-01-23	2015-09-15	2024-03-28	515 B	19 MB	46.38.240.32

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
cdn.medion.com/downloads/software/00_Bios_Specialist_P10_.zip
IP
46.38.240.32
ASN
#197540 netcup GmbH

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
19 MB (19151315 bytes)
Hash
ebeab44bda5ba4cf5ada69ec2b1a81a2
4334d4d6853fa462e85a7b24b1397089a378b5b5
7bf7c907823b17a8c8d422e61ca45c547045362be3d820a77fcda9241ce847f5

Archive (6)

Filename

Md5

File type

Checksum.exe

0db63f6a0a68795d2761d928b79e7e50

MS-DOS executable, MZ for MS-DOS

flash.nsh

c808a0d61a753330c452508588a2880a

ASCII text, with CRLF line terminators

FlashWinX64.bat

bdf0ac0b7cae2ad0ac1fa4bd206a174b

DOS batch file, ASCII text, with CRLF line terminators

NP5XPNP.BIN

d5cf7ddf1e709772428b6d686ca6f980

PE32+ executable (DLL) (EFI application) x86-64, for MS Windows, 4 sections

NP5XPNP04.efi

ad5d7633be377a1dd3fe93ecc41f1404

PE32+ executable (DLL) (EFI application) x86-64, for MS Windows, 4 sections

NP5XPNP04.exe

dd420e6cde6e1d9812c2c9d231f31718

PE32+ executable (GUI) x86-64, for MS Windows, 5 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

	URL	IP	Response	Size
	cdn.medion.com/downloads/software/00_Bios_Specialist_P10_.zip	46.38.240.32	200 OK	19 MB
URL User Request GET HTTP/2 cdn.medion.com/downloads/software/00_Bios_Specialist_P10_.zip IP 46.38.240.32:443 ASN #197540 netcup GmbH Certificate IssuerSectigo Limited Subjectcdn.medion.com FingerprintDE:0B:48:54:DC:EF:D9:16:BC:F5:95:8E:E1:4F:41:43:F5:93:3A:EE ValidityWed, 27 Mar 2024 00:00:00 GMT - Sat, 26 Apr 2025 23:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 19 MB (19151315 bytes) Hash ebeab44bda5ba4cf5ada69ec2b1a81a2 4334d4d6853fa462e85a7b24b1397089a378b5b5 7bf7c907823b17a8c8d422e61ca45c547045362be3d820a77fcda9241ce847f5 HTTP Headers `GET /downloads/software/00_Bios_Specialist_P10_.zip HTTP/1.1 Host: cdn.medion.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK server: nginx date: Wed, 24 Apr 2024 08:23:47 GMT content-type: application/zip content-length: 19151315 last-modified: Thu, 15 Jun 2023 11:53:34 GMT etag: "648afbbe-12439d3" accept-ranges: bytes X-Firefox-Spdy: h2`

cdn.medion.com/downloads/software/00_Bios_Specialist_P10_.zip

46.38.240.32

200 OK

19 MB

URL User Request GET HTTP/2
cdn.medion.com/downloads/software/00_Bios_Specialist_P10_.zip
IP
46.38.240.32:443
ASN
#197540 netcup GmbH

Certificate
IssuerSectigo Limited
Subjectcdn.medion.com
FingerprintDE:0B:48:54:DC:EF:D9:16:BC:F5:95:8E:E1:4F:41:43:F5:93:3A:EE
ValidityWed, 27 Mar 2024 00:00:00 GMT - Sat, 26 Apr 2025 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
19 MB (19151315 bytes)
Hash
ebeab44bda5ba4cf5ada69ec2b1a81a2
4334d4d6853fa462e85a7b24b1397089a378b5b5
7bf7c907823b17a8c8d422e61ca45c547045362be3d820a77fcda9241ce847f5

HTTP Headers

GET /downloads/software/00_Bios_Specialist_P10_.zip HTTP/1.1
Host: cdn.medion.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 24 Apr 2024 08:23:47 GMT
content-type: application/zip
content-length: 19151315
last-modified: Thu, 15 Jun 2023 11:53:34 GMT
etag: "648afbbe-12439d3"
accept-ranges: bytes
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (6)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers