Report - stepik-files.cyber-ed.space/WhiteHat/courses-shop.zip

Report Overview

Visited public
2024-07-16 12:13:10
Tags
URL
stepik-files.cyber-ed.space/WhiteHat/courses-shop.zip
Finishing URL
about:privatebrowsing
IP / ASN
217.78.234.243
#9123 TimeWeb Ltd.
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
e6.o.lencr.org	unknown	2020-06-29	2024-06-07 08:35:09	2024-07-14 18:50:11	326 B	730 B	23.36.76.249
stepik-files.cyber-ed.space	unknown	unknown	No data	No data	507 B	3.0 MB	217.78.234.244
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-14 18:12:33	2.6 kB	7.1 kB	23.36.76.249

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
stepik-files.cyber-ed.space/WhiteHat/courses-shop.zip
IP
217.78.234.244
ASN
#9123 TimeWeb Ltd.

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
3.0 MB (3001564 bytes)
Hash
5539936cec7512070a7a794c6ae03371
d3a3487c6f9a38e776189996d9e3406183c6ae15
2bc11cb2674656b6b8016f58369bfef54df79408b2deea43fcf4f0680ddfd367

Archive (36)

Filename

Md5

File type

000-default.conf

f4e34bbd15332e373698ae10406cabd5

ASCII text

index.php

6f152299ab46b93c1056b48b7c2dab7a

HTML document, Unicode text, UTF-8 text, with very long lines (2645)

order.php

b8f4b36a55eb3b688d3023e9ff2878b1

PHP script, ASCII text

index.php

8d1c610aa3fdab2cd85fb8bd90f9546a

PHP script, ASCII text

main.php

e2d384e9a19db5d3735d6ec7c17e3d66

PHP script, ASCII text

otp.php

521d6116a702aa690b7a0dbd11c8cdc2

PHP script, ASCII text

header.inc.php

a73c14783571eee59ba45ba98d5023da

HTML document, ASCII text

config.php

56fbb88c013e6f64dc6dd9c40fcc8652

PHP script, ASCII text

footer.inc.php

2f44b0b561d535108c8ac70d38bee313

ASCII text

config.php

769cfb2fed8bfbdc62ebd21ba06bfa09

PHP script, ASCII text

receipt.php

191835e831332c29882b5213e2f2bcf2

PHP script, Unicode text, UTF-8 text, with very long lines (2645)

bootstrap.min.css

450fc463b8b1a349df717056fbb3e078

ASCII text, with very long lines (65325)

volume.png

20c60bad37a1218f9263c8a70b56235c

PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced

form2xml.js

6e3222f7fbb0d4929c81d56b88bae3bc

JavaScript source, Unicode text, UTF-8 text

dot.png

b686616beeb43fc0eca318f54275f34d

PNG image data, 4 x 4, 8-bit/color RGBA, non-interlaced

bootstrap.bundle.min.js

a454220fc07088bf1fdd19313b6bfd50

JavaScript source, ASCII text, with very long lines (65297)

pricing.css

9513ef368337bffcfd2d7e744ac8c655

ASCII text

bootstrap.min.js

14d449eb8876fa55e1ef3c2cc52b0c17

JavaScript source, ASCII text, with very long lines (48664)

apple-touch-icon-57x57.png

e741ca37ac6bdafb7d41dd31aefbfdad

PNG image data, 57 x 57, 8-bit/color RGBA, non-interlaced

holder.min.js

6266d87979b32f717d298f7adf36984a

JavaScript source, Unicode text, UTF-8 text, with very long lines (32011)

bootstrap-solid.svg

ea931a5b98a97e8b8658d9f6d537329e

SVG Scalable Vector Graphics image

pictures.png

a36c8a9ad46ec6d66df2b7cf59d0f8a4

PNG image data, 114 x 16, 8-bit/color RGBA, non-interlaced

popper.min.js

70d3fda195602fe8b75e0097eed74dde

JavaScript source, ASCII text, with very long lines (19015)

image.php

5a09a0b235efba46f2bb42e466671610

PHP script, ASCII text

script-bot.sh

e34df7d948af3d3eeeaf8afa2a9677c7

Bourne-Again shell script executable (binary data)

script-db.sh

387f8251128887d18eaa2172d71113fd

Bourne-Again shell script executable (binary data)

script-web.sh

5eb41768d57d07d4ee55616b76a68400

Bourne-Again shell script executable (binary data)

mysql-custom-config.cnf

3e08204fb27b7cff15e9cf19d2aaba7f

ASCII text

requirements.txt

440438f8451d6c45b52a7381cb0771ee

ASCII text

bot.py

1c2f9ace4093877e69092e2e56950379

Python script, ASCII text executable

geckodriver-v0.24.0-linux64.tar.gz

7552b85e43973c84763e212af7cca566

gzip compressed data, last modified: Mon Jan 28 22:49:19 2019, from Unix

start.sh

8436145b32ea0ba911b7c14551d83afe

Bourne-Again shell script, ASCII text executable

docker-compose.yml

e99d96f078ff86341b1896856945eed0

ASCII text

DockerfileBot

81fd6e2509a7a8e13c190a718e8625a2

ASCII text

DockerfileWeb

c098977c86427943cc1fdf95648eed9e

ASCII text

DockerfileDB

7296f06b7dadb17d94526fdb33956d15

ASCII text

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings
VirusTotal	malicious	VirusTotal - Scan result 12/59

JavaScript (0)

HTTP Transactions (10)

URL IP Response Size

r10.o.lencr.org/

23.36.76.249

504 B

URL
r10.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
9fc6673328a72199efee32208e052486
e3cd507761b95ae04da178d9b0da347fcaa5fce6
133266844822ea13f6d0ffc2eda97a79e99cea9ec4defec2812cf4a86751283a

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "133266844822EA13F6D0FFC2EDA97A79E99CEA9EC4DEFEC2812CF4A86751283A"
Last-Modified: Mon, 15 Jul 2024 20:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5561
Expires: Tue, 16 Jul 2024 13:45:22 GMT
Date: Tue, 16 Jul 2024 12:12:41 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.249

504 B

URL
r10.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
f5d61e015345f1d6e8a4ab6805f26f50
5e3929d1cfa9cf61ddcf3df75f9ae5902fa3c6ee
3a781ef35e2f1386215f140f851199c98fc01c4f137cc1f38192faa4a4e9106c

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "3A781EF35E2F1386215F140F851199C98FC01C4F137CC1F38192FAA4A4E9106C"
Last-Modified: Mon, 15 Jul 2024 19:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2553
Expires: Tue, 16 Jul 2024 12:55:14 GMT
Date: Tue, 16 Jul 2024 12:12:41 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.249

504 B

URL
r10.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
515a47172f3cc8fbca49fb1ef5f72e11
5b474a25a17288e58ea017f17fa456cf13893af3
13578d886dc74ebf01cfa31617c3417b42b8c8395e4bacc10a1b6f1d19bc55f2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "13578D886DC74EBF01CFA31617C3417B42B8C8395E4BACC10A1B6F1D19BC55F2"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7932
Expires: Tue, 16 Jul 2024 14:24:54 GMT
Date: Tue, 16 Jul 2024 12:12:42 GMT
Connection: keep-alive

e6.o.lencr.org/

23.36.76.249

346 B

URL
e6.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
346 B (346 bytes)
Hash
4c578352a6c1369cac03c31dcecd94de
7f0e8f48000ded77d6b7998da2b584b768cbd5a4
b3b76ae264d1ba605538afcb4da0435598c36587e1812fcc8bc590c7d9dc195a

HTTP Headers

POST / HTTP/1.1
Host: e6.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "B3B76AE264D1BA605538AFCB4DA0435598C36587E1812FCC8BC590C7D9DC195A"
Last-Modified: Mon, 15 Jul 2024 21:11:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21079
Expires: Tue, 16 Jul 2024 18:04:01 GMT
Date: Tue, 16 Jul 2024 12:12:42 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.249

504 B

URL
r10.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
d6a8982e5c8cce4f958455f8ea1e5814
d88c9d262e8282645ee77a1a3f29199b0422166a
c18d568bc2c4d8544c593d76c943798ffd2de9596cb115879d51d403f080abea

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "C18D568BC2C4D8544C593D76C943798FFD2DE9596CB115879D51D403F080ABEA"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12499
Expires: Tue, 16 Jul 2024 15:41:01 GMT
Date: Tue, 16 Jul 2024 12:12:42 GMT
Connection: keep-alive

stepik-files.cyber-ed.space/WhiteHat/courses-shop.zip

217.78.234.244

200 OK

3.0 MB

URL User Request GET HTTP/2
stepik-files.cyber-ed.space/WhiteHat/courses-shop.zip
IP
217.78.234.244:443
ASN
#9123 TimeWeb Ltd.

Certificate
IssuerLet's Encrypt
Subjectstepik-files.cyber-ed.space
Fingerprint9F:A3:08:A6:92:92:40:78:26:02:C2:C4:17:34:99:0F:E1:85:D8:31
ValidityThu, 13 Jun 2024 09:57:15 GMT - Wed, 11 Sep 2024 09:57:14 GMT

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
3.0 MB (3001564 bytes)
Hash
5539936cec7512070a7a794c6ae03371
d3a3487c6f9a38e776189996d9e3406183c6ae15
2bc11cb2674656b6b8016f58369bfef54df79408b2deea43fcf4f0680ddfd367

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 12/59

HTTP Headers

GET /WhiteHat/courses-shop.zip HTTP/1.1
Host: stepik-files.cyber-ed.space
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Tue, 16 Jul 2024 12:12:42 GMT
content-type: application/zip
content-length: 3001564
accept-ranges: bytes
last-modified: Tue, 18 Jun 2024 13:26:01 GMT
x-rgw-object-type: Normal
etag: "5539936cec7512070a7a794c6ae03371"
x-amz-meta-ctime: 1718717161.527887175
x-amz-meta-s3cmd-attrs: atime:1717617940/ctime:1717615437/gid:1001/gname:rqlbstr/md5:5539936cec7512070a7a794c6ae03371/mode:33188/mtime:1717534760/uid:1001/uname:rqlbstr
x-amz-request-id: tx00000fc2c797c2709a84a-00669663ba-13d60a-ru-1
X-Firefox-Spdy: h2

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c5fe3e5860e9afb843ae32b8f349f4c7
78e8faf3194e82bcb4fed0d89bd1989501dd8d2a
806921e95846539e7849756068c5afcd2fb93d1ccbb7604b5d8d18805538faf5

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "806921E95846539E7849756068C5AFCD2FB93D1CCBB7604B5D8D18805538FAF5"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12961
Expires: Tue, 16 Jul 2024 15:48:45 GMT
Date: Tue, 16 Jul 2024 12:12:44 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c5fe3e5860e9afb843ae32b8f349f4c7
78e8faf3194e82bcb4fed0d89bd1989501dd8d2a
806921e95846539e7849756068c5afcd2fb93d1ccbb7604b5d8d18805538faf5

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "806921E95846539E7849756068C5AFCD2FB93D1CCBB7604B5D8D18805538FAF5"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12961
Expires: Tue, 16 Jul 2024 15:48:45 GMT
Date: Tue, 16 Jul 2024 12:12:44 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.249

504 B

URL
r10.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c5fe3e5860e9afb843ae32b8f349f4c7
78e8faf3194e82bcb4fed0d89bd1989501dd8d2a
806921e95846539e7849756068c5afcd2fb93d1ccbb7604b5d8d18805538faf5

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "806921E95846539E7849756068C5AFCD2FB93D1CCBB7604B5D8D18805538FAF5"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12934
Expires: Tue, 16 Jul 2024 15:48:18 GMT
Date: Tue, 16 Jul 2024 12:12:44 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c5fe3e5860e9afb843ae32b8f349f4c7
78e8faf3194e82bcb4fed0d89bd1989501dd8d2a
806921e95846539e7849756068c5afcd2fb93d1ccbb7604b5d8d18805538faf5

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "806921E95846539E7849756068C5AFCD2FB93D1CCBB7604B5D8D18805538FAF5"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12961
Expires: Tue, 16 Jul 2024 15:48:45 GMT
Date: Tue, 16 Jul 2024 12:12:44 GMT
Connection: keep-alive

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (36)

Detections

JavaScript (0)

HTTP Transactions (10)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash