Report Overview
Visitedpublic
2025-01-19 04:36:02
Tags
Submit Tags
URL
github.com/PSGO/PPPwnGo/releases/download/v2.8-20250109/PPPwnGo-v2.8-0109.zip
Finishing URL
about:privatebrowsing
IP / ASN
140.82.121.3
#36459 GITHUB
Title
about:privatebrowsing

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
7

Host Summary

HostRankRegisteredFirst SeenLast Seen
github.com
14232007-10-092016-07-132025-01-15
objects.githubusercontent.com
1340602014-02-062021-11-012025-01-15

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected


OpenPhish

No alerts detected


PhishTank

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


File detected

URL
objects.githubusercontent.com/github-production-release-asset-2e65be/794810266/c8d26624-baa0-4912-9a75-1c0a10a1e765?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250119%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250119T043535Z&X-Amz-Expires=300&X-Amz-Signature=35a366287add34d5b18ef6f7caf46efaff04d97c4ee39ad886d8279bc1a37d03&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DPPPwnGo-v2.8-0109.zip&response-content-type=application%2Foctet-stream
IP / ASN
185.199.109.133
#54113 FASTLY
File Overview
File TypeZip archive data, at least v2.0 to extract, compression method=deflate
Size9.2 MB (9234261 bytes)
MD54ac3233d138f47e255f57b900a078789
SHA13fcf987492d775618116c047ba2f4d9e3196a890
Archive (99)
FilenameMD5File type
README.mdc6ae96d4a23b217e2800647558c80a2bUnicode text, UTF-8 text
˵��.txted975688ca3afdb197c3badfc78ad2a1Unicode text, UTF-8 text
Wait for other FWsd41d8cd98f00b204e9800998ecf8427e
Payload˵��readme.txt56812b74f96d715f779fecc5399862feUnicode text, UTF-8 text, with CRLF line terminators
goldhen.bin9caeb9afa1e26d80d0e293ade0446b10DOS executable (COM), start instruction 0xe9d21100 00f30f1e
goldhen.bin78c655db47c395434715fce94fa86743DOS executable (COM), start instruction 0xe9861100 00f30f1e
payload.bina09599036497c3554dd6a73fb71f7812DOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.binaeae08a07e580545066b5e28e208dd4fDOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.bin4c6f0ccc08e5c7d6399d24e7817b7e3fDOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.bin7bc8b565a82eddf7fe70b34311be86acDOS executable (COM), start instruction 0xe9970200 00f30f1e
goldhen.bin9caeb9afa1e26d80d0e293ade0446b10DOS executable (COM), start instruction 0xe9d21100 00f30f1e
goldhen.bin78c655db47c395434715fce94fa86743DOS executable (COM), start instruction 0xe9861100 00f30f1e
GoldHEN vs VTX.png5fabbff85db7895beb2018b66d4c2e5aPNG image data, 480 x 550, 8-bit/color RGBA, non-interlaced
goldhen.bin78c655db47c395434715fce94fa86743DOS executable (COM), start instruction 0xe9861100 00f30f1e
goldhen.bin9caeb9afa1e26d80d0e293ade0446b10DOS executable (COM), start instruction 0xe9d21100 00f30f1e
goldhen.bin78c655db47c395434715fce94fa86743DOS executable (COM), start instruction 0xe9861100 00f30f1e
goldhen.bin9caeb9afa1e26d80d0e293ade0446b10DOS executable (COM), start instruction 0xe9d21100 00f30f1e
goldhen.bin78c655db47c395434715fce94fa86743DOS executable (COM), start instruction 0xe9861100 00f30f1e
goldhen.bin9caeb9afa1e26d80d0e293ade0446b10DOS executable (COM), start instruction 0xe9d21100 00f30f1e
goldhen.bin78c655db47c395434715fce94fa86743DOS executable (COM), start instruction 0xe9861100 00f30f1e
goldhen.bin9caeb9afa1e26d80d0e293ade0446b10DOS executable (COM), start instruction 0xe9d21100 00f30f1e
goldhen.bin78c655db47c395434715fce94fa86743DOS executable (COM), start instruction 0xe9861100 00f30f1e
goldhen.bin9caeb9afa1e26d80d0e293ade0446b10DOS executable (COM), start instruction 0xe9d21100 00f30f1e
goldhen.bin78c655db47c395434715fce94fa86743DOS executable (COM), start instruction 0xe9861100 00f30f1e
goldhen.bin9caeb9afa1e26d80d0e293ade0446b10DOS executable (COM), start instruction 0xe9d21100 00f30f1e
payload.bin259a2fbed349517939de90fd3cf102caDOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.bin259a2fbed349517939de90fd3cf102caDOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.bin259a2fbed349517939de90fd3cf102caDOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.binbd70d7919dd2e0f8cb8df59c7e7bc413DOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.binbd70d7919dd2e0f8cb8df59c7e7bc413DOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.binbd70d7919dd2e0f8cb8df59c7e7bc413DOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.bindb1de0517866663ec98ab0b99d2ce3abDOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.bindb1de0517866663ec98ab0b99d2ce3abDOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.bin5ef1339fe2741d12a31d68dd3050e8bdDOS executable (COM), start instruction 0xe9940200 00f30f1e
payload.bind9f75cf066b06470b7b759f81fa87ef3DOS executable (COM), start instruction 0xe9970200 00f30f1e
payload.bin540a9e6326a6001207fa3631b1c48275DOS executable (COM), start instruction 0xe9970200 00f30f1e
goldhen.bindb7ed7262f90d2f9f8342b1ae57179f5DOS executable (COM), start instruction 0xe9661000 00f30f1e
goldhen.bin9bf90ebe4f19699e41eaad1071392c6dDOS executable (COM), start instruction 0xe9661000 00f30f1e
stage2.binbca7c2f584489f552b37d0867812be2fDOS executable (COM), start instruction 0xe96e0700 00534889
stage2.binbca7c2f584489f552b37d0867812be2fDOS executable (COM), start instruction 0xe96e0700 00534889
stage2.bin8a620c3a08c2a034e41c0c7cb0458247DOS executable (COM), start instruction 0xe96e0700 00534889
stage2.bin6b954dd1bab01a79c7f7033ae6d1fe71DOS executable (COM), start instruction 0xe96e0700 00534889
stage2.binbca7c2f584489f552b37d0867812be2fDOS executable (COM), start instruction 0xe96e0700 00534889
stage2.binc976d00ec889926f2ac9fab2fd40ecfaDOS executable (COM), start instruction 0xe96e0700 00534889
stage2.bin0c43112d611c3723adb27010c28a5c52DOS executable (COM), start instruction 0xe96e0700 00534889
stage2.bin6b954dd1bab01a79c7f7033ae6d1fe71DOS executable (COM), start instruction 0xe96e0700 00534889
stage2.bin1ae8c6d283a37ff3168c3401ac4e86a0DOS executable (COM), start instruction 0xe96e0100 00534889
stage2.binbfd749cd25b34373ba0184dc16165f3eDOS executable (COM), start instruction 0xe96e0100 00534889
stage2.bin1ae8c6d283a37ff3168c3401ac4e86a0DOS executable (COM), start instruction 0xe96e0100 00534889
stage2.binbfd749cd25b34373ba0184dc16165f3eDOS executable (COM), start instruction 0xe96e0100 00534889
stage2.bin1ae8c6d283a37ff3168c3401ac4e86a0DOS executable (COM), start instruction 0xe96e0100 00534889
stage2.binbfd749cd25b34373ba0184dc16165f3eDOS executable (COM), start instruction 0xe96e0100 00534889
stage2.binca16956520dc8ce111856491aff89917DOS executable (COM), start instruction 0xe96e0100 00534889
stage2.bin43d399fb566f47eaf0f21ab51893b661DOS executable (COM), start instruction 0xe96e0100 00534889
stage2.binca16956520dc8ce111856491aff89917DOS executable (COM), start instruction 0xe96e0100 00534889
stage2.bin43d399fb566f47eaf0f21ab51893b661DOS executable (COM), start instruction 0xe96e0100 00534889
stage2.bin3967e107d97c66571b425377dc90ba2bDOS executable (COM), start instruction 0xe96e0100 00534889
stage2.bin9da51f25f4f326952350124f6289fa84DOS executable (COM), start instruction 0xe96e0100 00534889
stage2.bin9da51f25f4f326952350124f6289fa84DOS executable (COM), start instruction 0xe96e0100 00534889
stage2.binbf4e3a7df4dd01a29300cb57c0323620DOS executable (COM), start instruction 0xe96e0100 00534889
stage2.binbf4e3a7df4dd01a29300cb57c0323620DOS executable (COM), start instruction 0xe96e0100 00534889
CPP_debug.inie7f29daa8fa0a74a73324001537d971cUnicode text, UTF-8 text, with CRLF line terminators
pppwn.exed8033fd7df4885e7e7b7ee9e6e074001PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 3 sections
PPPwnGo.exe1f2e533441f0511252c4505c10143463PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
4.��װpip��˫����.bat58194b2a72727206780a3f6f0a1e51aeASCII text, with CRLF line terminators
3.��װpython.txte69c776da0a2dda5c3927a1205f05c0fUnicode text, UTF-8 text, with CRLF line terminators
2.add Python to Path.pngd6cb744eaec2c33afc6ba4c3ed93a028PNG image data, 400 x 378, 8-bit/color RGB, non-interlaced
1.��װnpcap.txt699cdd28ed8cbc82f5f413bad33941cbUnicode text, UTF-8 text, with CRLF line terminators
5.��װscapy��˫����.batf75b5994777a0da1a7fdcda28546f454ASCII text, with CRLF, LF line terminators
pppwn.pyc1908b4da915c4908f9d35fac921b709Python script, ASCII text executable
offsets.pyd2cff007676aa9ba533bb831b9a7dfa6ASCII text
pppwn.exeba2c3b1abcde339d0597ea0e32619b59PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 3 sections
pppwn.exe87fd8e2c384052e9bfba97a92e4cd308PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 3 sections
pppwn.exe199f3d26b818603f961b0995aa5271b4PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 3 sections
Go_debug.ini415080b598b8e97f7a4da0314da57cd1ASCII text, with CRLF line terminators
ReadMe.txt01c189b3483685952ad05fb01c6400e1Unicode text, UTF-8 text, with CRLF line terminators
stage1.bin99b8083ac07bed4bf555f0ec02a7ffa4data
stage1.bin99b8083ac07bed4bf555f0ec02a7ffa4data
stage1.bin44f3cc05520077899c0cd51422811013data
stage1.bin44f3cc05520077899c0cd51422811013data
stage1.bin44f3cc05520077899c0cd51422811013data
stage1.bin565a3867eb66b0baafdeb812037c95f8data
stage1.bin1da7b4d77bcb45cbfef127c0b2892284data
stage1.bin1da7b4d77bcb45cbfef127c0b2892284data
stage1.bin1da7b4d77bcb45cbfef127c0b2892284data
stage1.bin8f8d7e2777d51905e5b4e15a27a38219data
stage1.bin8f8d7e2777d51905e5b4e15a27a38219data
stage1.bin8f8d7e2777d51905e5b4e15a27a38219data
stage1.bin896e8f979ea9621107546b49ec00ed86data
stage1.bin896e8f979ea9621107546b49ec00ed86data
stage1.bin896e8f979ea9621107546b49ec00ed86data
stage1.bin411aab2f9f2947d66286c9dd8c9b7a63data
stage1.bin411aab2f9f2947d66286c9dd8c9b7a63data
stage1.binab7db32dbe6c6e4e8f80d642a41f5d05data
stage1.bine372c39870ae642dd32c28122f6727c9data
stage1.bine372c39870ae642dd32c28122f6727c9data
stage1.bin57749fe2519d4b987da8a4291d1d9fd7data
stage1.bin57749fe2519d4b987da8a4291d1d9fd7data
stage1.bin57749fe2519d4b987da8a4291d1d9fd7data

Detections

AnalyzerVerdictAlert
Public Nextron YARA rulesmalware
Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Public Nextron YARA rulesmalware
Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits

JavaScript (0)

HTTP Transactions (2)

URLIPResponseSize
GET github.com/PSGO/PPPwnGo/releases/download/v2.8-20250109/PPPwnGo-v2.8-0109.zip
140.82.121.3302 Found0 B
GET objects.githubusercontent.com/github-production-release-asset-2e65be/794810266/c8d26624-baa0-4912-9a75-1c0a10a1e765?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250119%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250119T043535Z&X-Amz-Expires=300&X-Amz-Signature=35a366287add34d5b18ef6f7caf46efaff04d97c4ee39ad886d8279bc1a37d03&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DPPPwnGo-v2.8-0109.zip&response-content-type=application%2Foctet-stream
185.199.109.133200 OK9.2 MB