Report - conspiracy.hu/get/58/cns!oc.zip

Report Overview

Submitted URL
conspiracy.hu/get/58/cns!oc.zip
IP
95.140.42.194
ASN
#60071 RendszerNET Kft.
Submitted
2024-03-29 22:53:40
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
3

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
conspiracy.hu	unknown	2004-09-21	2012-05-22	2024-03-23	969 B	69 kB	95.140.42.194

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
conspiracy.hu/files/cns!oc.zip
IP
95.140.42.194
ASN
#60071 RendszerNET Kft.

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
69 kB (68681 bytes)
Hash
c9009787cf3bd82c5ff35ae7258003b0
a01ac69ae26970d1c4063f4194276f5c87c3ad46
f77c48b7fa1ed262bb5f6cd603906380e2977ddf3f94af0d70aa9edf36fe12a3

Archive (4)

Filename

Md5

File type

cns.nfo

aadd4b17c16c046f912804119dc3325e

ASCII text

file_id.diz

0fe5a8461d987fab12cb7b1defb0f173

ASCII text, with CRLF line terminators

OffscreenColonies.exe

20c6bcef45dcb645fb982996fdcfe20c

PE32 executable (GUI) Intel 80386, for MS Windows

OffscreenColonies.nfo

e855f8af9daa4a6172c55f012ffab72c

ISO-8859 text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
VirusTotal	malicious	VirusTotal - Scan result 14/62

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

conspiracy.hu/get/58/cns!oc.zip

95.140.42.194

302 Found

1 B

URL User Request GET HTTP/1.1
conspiracy.hu/get/58/cns!oc.zip
IP
95.140.42.194:443
ASN
#60071 RendszerNET Kft.

Certificate
IssuerLet's Encrypt
Subjectmail.conspiracy.hu
Fingerprint68:9D:7A:AD:77:62:3A:71:F9:A8:22:28:4A:31:B3:C4:8E:FF:91:12
ValiditySat, 03 Feb 2024 03:33:46 GMT - Fri, 03 May 2024 03:33:45 GMT

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
eccbc87e4b5ce2fe28308fd9f2a7baf3
77de68daecd823babbb58edb1c8e14d7106e83bb
4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce

HTTP Headers

GET /get/58/cns!oc.zip HTTP/1.1
Host: conspiracy.hu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 29 Mar 2024 22:53:15 GMT
Server: Apache
Location: https://conspiracy.hu/files/cns!oc.zip
Vary: Accept-Encoding
Content-Encoding: br
Content-Length: 1
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

conspiracy.hu/files/cns!oc.zip

95.140.42.194

200 OK

69 kB

URL User Request GET HTTP/1.1
conspiracy.hu/files/cns!oc.zip
IP
95.140.42.194:443
ASN
#60071 RendszerNET Kft.

Certificate
IssuerLet's Encrypt
Subjectmail.conspiracy.hu
Fingerprint68:9D:7A:AD:77:62:3A:71:F9:A8:22:28:4A:31:B3:C4:8E:FF:91:12
ValiditySat, 03 Feb 2024 03:33:46 GMT - Fri, 03 May 2024 03:33:45 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
69 kB (68681 bytes)
Hash
c9009787cf3bd82c5ff35ae7258003b0
a01ac69ae26970d1c4063f4194276f5c87c3ad46
f77c48b7fa1ed262bb5f6cd603906380e2977ddf3f94af0d70aa9edf36fe12a3

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 14/62

HTTP Headers

GET /files/cns!oc.zip HTTP/1.1
Host: conspiracy.hu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 29 Mar 2024 22:53:15 GMT
Server: Apache
Last-Modified: Fri, 03 Apr 2015 15:56:21 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: br
Content-Length: 68681
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/zip

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (4)

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers