Report - w12evo.com/ControleAcesso/HIKVISION.zip

Report Overview

Submitted URL
w12evo.com/ControleAcesso/HIKVISION.zip
IP
20.226.123.32
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Submitted
2024-04-24 14:45:30
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
6

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
w12evo.com	unknown	2016-04-11	2016-09-30	2024-04-17	493 B	21 MB	20.226.123.32

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
w12evo.com/ControleAcesso/HIKVISION.zip
IP
20.226.123.32
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
21 MB (20708162 bytes)
Hash
fdaec7cd66cafd4691d99d45924ab4bb
82ab4c966409571bbdf9abf403ef035ea6951206
50d11e98018c9c6b7c4b12ce176370e873618861cf755b9d2e8f87ed30c6053c

Archive (47)

Filename

Md5

File type

AudioRender.dll

60e100f2d733651faacaa5af6fb0ae53

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

calib.dll

242398b0cbe7f733ee122bf7e2c07e61

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

iconv.dll

73af5773bf5627fe771bf6809ec839f9

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

libcrypto-1_1.dll

d5f6b13c42b176bead93ed192f338936

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

libcurl.dll

e770854eb804ea0b233c0c659f129c04

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

libssl-1_1.dll

b096e654bc06e004084cd9a31cbdea99

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

libxml2.dll

7ee993251d55a2eab74340d27ff82260

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections

msvcr120.dll

034ccadc1c073e4216e9466b720f9849

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

ReadMe.txt

4181fb1459869fd1f8d94a5bfee7df1b

ISO-8859 text, with no line terminators

zlib1.dll

72e87ad407bb28f5b471c3396296b377

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

ClientDemoEn.exe

2a1e85e8b52ca8ddfdcd657b19dc7a24

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

gdiplus.dll

871c903a90c45ca08a9d42803916c3f7

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

GdiPlus.lib

9569a6296be5652fb00548b33226f707

current ar archive

HCCore.lib

78d99ccee721ab3640f793198a294f87

current ar archive

HCNetSDK.lib

88b512f795ffd3c725a1baf4991ada4a

current ar archive

AnalyzeData.dll

de6f623c875d13d8e809ef0775c6ad4a

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

AudioIntercom.dll

62cd27cc12b7e7f6ac0ea31a1d861c46

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

HCAlarm.dll

51f3dbf0c7db1ab53809dc5b395c6261

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

HCAlarm.lib

bc14f54a7c01d56336e4d22cc6aebfee

current ar archive

HCCoreDevCfg.dll

519e60f8aa6019cb0a025a00d5e5b2d8

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

HCDisplay.dll

5a435ffc32c456dd1d95c3151f446a8d

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

HCGeneralCfgMgr.dll

0fc0db41d2406025b76c58227bacee0a

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

HCGeneralCfgMgr.lib

6d465d67e730e2804dd0583a185fe84c

current ar archive

HCIndustry.dll

3acc0eaf7c7f81c24ef3c7edb98b77c2

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

HCPlayBack.dll

89dae01bf47aa70707e2f033f87afb6f

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

HCPreview.dll

ff93589800cf85158975114f430e895b

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

HCPreview.lib

95b1ec6a63b280f272bcaf7410057cb4

current ar archive

HCVoiceTalk.dll

18b5485995e1942b651edc20e2256d98

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

libiconv2.dll

fd1dc6c680299a2ed1eedcc3eabda601

PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, 7 sections

msvcr90.dll

4d03ca609e68f4c90cf66515218017f8

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections

OpenAL32.dll

d713bbfe7200d43c28e62f81adc95627

PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections

StreamTransClient.dll

5146042ba4c9259604da0a71c7a4b11c

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

SystemTransform.dll

76448abc5aadc01a7193edcf55683890

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

hlog.dll

72b73c9b303f130791b9244530a098e0

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

HmMerge.dll

4f07153b94647a8f0dd844ad1f79c092

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

hpr.dll

ae369f96b50537c89904ca74b38ce6a5

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

HXVA.dll

7a30cc600d21de7aad80d0de97a49a77

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

libeay32.dll

7687c070d009997aaff5135fedcd4361

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

MP_Render.dll

aaa00c04821532c545e390c89970a2f9

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

MP_VIE.dll

3ce35056fd3ebf0f6be6036d6388105a

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

NPQos.dll

cb424b7f3a5648f425b3c57e6a65a80f

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

PlayCtrl.dll

ad3d70a69c4a529f189cf509a3d020f0

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 8 sections

PlayCtrl.lib

39a36e1160b6f2359d888fc47e59344e

current ar archive

ssleay32.dll

879b8a2e30cbcd81a2c66dcf48cf23e8

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

SuperRender.dll

a8b17886041a7c7a2ac4dba3c4dea3a0

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 7 sections

YUVProcess.dll

2e84156db08c813a11bcbd7306194a99

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

zlib1.dll

0427309c8bafa34e933aa0693c75dfd6

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_stackstrings

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

	URL	IP	Response	Size
	w12evo.com/ControleAcesso/HIKVISION.zip	20.226.123.32	200 OK	21 MB
URL User Request GET HTTP/2 w12evo.com/ControleAcesso/HIKVISION.zip IP 20.226.123.32:443 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK Certificate IssuerGoDaddy.com, Inc. Subjectwww.w12evo.com FingerprintDD:CC:0E:4F:33:AC:7A:30:AA:EB:7A:7A:2E:E7:63:2A:72:A9:76:D9 ValiditySun, 08 Oct 2023 18:05:46 GMT - Sun, 14 Jul 2024 23:56:07 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 21 MB (20708162 bytes) Hash fdaec7cd66cafd4691d99d45924ab4bb 82ab4c966409571bbdf9abf403ef035ea6951206 50d11e98018c9c6b7c4b12ce176370e873618861cf755b9d2e8f87ed30c6053c HTTP Headers `GET /ControleAcesso/HIKVISION.zip HTTP/1.1 Host: w12evo.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK content-type: application/x-zip-compressed last-modified: Mon, 17 Apr 2023 00:57:51 GMT accept-ranges: bytes etag: "cc6bdca2c770d91:0" server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Wed, 24 Apr 2024 14:44:55 GMT content-length: 20708162 X-Firefox-Spdy: h2`

w12evo.com/ControleAcesso/HIKVISION.zip

20.226.123.32

200 OK

21 MB

URL User Request GET HTTP/2
w12evo.com/ControleAcesso/HIKVISION.zip
IP
20.226.123.32:443
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Certificate
IssuerGoDaddy.com, Inc.
Subjectwww.w12evo.com
FingerprintDD:CC:0E:4F:33:AC:7A:30:AA:EB:7A:7A:2E:E7:63:2A:72:A9:76:D9
ValiditySun, 08 Oct 2023 18:05:46 GMT - Sun, 14 Jul 2024 23:56:07 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
21 MB (20708162 bytes)
Hash
fdaec7cd66cafd4691d99d45924ab4bb
82ab4c966409571bbdf9abf403ef035ea6951206
50d11e98018c9c6b7c4b12ce176370e873618861cf755b9d2e8f87ed30c6053c

HTTP Headers

GET /ControleAcesso/HIKVISION.zip HTTP/1.1
Host: w12evo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/x-zip-compressed
last-modified: Mon, 17 Apr 2023 00:57:51 GMT
accept-ranges: bytes
etag: "cc6bdca2c770d91:0"
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
date: Wed, 24 Apr 2024 14:44:55 GMT
content-length: 20708162
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (47)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers