Report - files.vmos.cn/vmospro/plugin/2022051320085965680.zip

Report Overview

Submitted URL
files.vmos.cn/vmospro/plugin/2022051320085965680.zip
IP
171.15.110.214
ASN
#137687 Luoyang, Henan Province, P.R.China.
Submitted
2024-04-18 13:23:18
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
files.vmos.cn	unknown	2015-06-24	2019-10-09	2024-04-17	506 B	8.0 MB	119.36.124.134

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
files.vmos.cn/vmospro/plugin/2022051320085965680.zip
IP
119.36.124.134
ASN
#4837 CHINA UNICOM China169 Backbone

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
8.0 MB (7962029 bytes)
Hash
a9710d23ce275ee05a5c2b139c9e344b
90f3964b153912e1ea6270a4cc8258e5e0bb1bda
6ef8bcd4e48ee1b37548a6aaee53403f0b219825cca1629895d1969ce313a7f8

Archive (20)

Modified	Filename	Size	Md5	File type
2020-06-07 12:03	repo_cache.db	45 kB	3b2087045cb7c1d2deb054df41ecc323	SQLite 3.x database, user version 4, last written using SQLite version 3009002, file counter 4, database pages 11, cookie 0x6, schema 4, largest root page 11, UTF-8, version-valid-for 4
2020-06-07 12:03	de.robv.android.xposed.installer_preferences.xml	203 B	ab754f9a1fc14c2d3f2e88fca539c4c9	XML 1.0 document, ASCII text
2020-06-07 12:03	download_cache.xml	297 B	353322d15e4b6b8b12aec6727fa84762	XML 1.0 document, ASCII text
2020-06-07 12:03	repo.xml	130 B	eb040f0743669ee424a67d2fd18dc5ba	XML 1.0 document, ASCII text
2020-05-18 18:50	XposedInstaller_3.1.5.apk	3.1 MB	315362d994986e6584203fca282f4472	Android package (APK), with AndroidManifest.xml Zip archive data, at least v0.0 to extract, compression method=deflate
2022-04-28 15:44	app_process32	80 kB	96f726689f71b41530ed76975806648a	ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)
2008-02-29 03:33	app_process64	96 kB	4212d586dfa1eefe73c5056c399db6aa	ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV)
2008-02-29 03:33	dex2oat	149 kB	e4c93e7f50e5c9d1abb53d71b36bad68	ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)
2008-02-29 03:33	oatdump	133 kB	1014bfbf847627123634ce985d672843	ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV)
2008-02-29 03:33	patchoat	50 kB	fe0511ca3478755ff18ffa5ee02b1234	ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)
2008-02-29 03:33	XposedBridge.jar	106 kB	956145163b20889a7d895020f197e813	Android package (APK), with AndroidManifest.xml Zip archive data, at least v2.0 to extract, compression method=deflate
2008-02-29 03:33	libart-compiler.so	2.2 MB	e8ebe503ef1903af735ae9b9f3ae6cbd	ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)
2008-02-29 03:33	libart.so	4.0 MB	5e7797b046db0f786f6e6f937d04c873	ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)
2008-02-29 03:33	libsigchain.so	5.3 kB	0643c431c66ef0fe33b6561609c40e25	ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)
2008-02-29 03:33	libxposed_art.so	51 kB	7d93f694e5ffd4eb6d09d698e42f5719	ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)
2008-02-29 03:33	libart-disassembler.so	138 kB	44840f8cef99ab80dbdc5039072cfbd8	ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV)
2008-02-29 03:33	libart.so	5.5 MB	a35f21f3bc9271363d0361538be16907	ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV)
2008-02-29 03:33	libsigchain.so	5.5 kB	e10146933588d5548c66892f3e2694ea	ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV)
2008-02-29 03:33	libxposed_art.so	78 kB	9ede82ba41fd313410b707980cd42561	ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV)
2008-02-29 03:33	xposed.prop	42 B	d99f45aa4860b06580d93aadb50e2f67	ASCII text

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/63

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

files.vmos.cn/vmospro/plugin/2022051320085965680.zip

119.36.124.134

200 OK

8.0 MB

URL User Request GET HTTP/2
files.vmos.cn/vmospro/plugin/2022051320085965680.zip
IP
119.36.124.134:443
ASN
#4837 CHINA UNICOM China169 Backbone

Certificate
IssuerDigiCert Inc
Subject*.vmos.cn
Fingerprint82:E1:A6:AB:A2:D0:CB:F6:60:DE:8D:9D:4D:0C:21:1A:0F:84:06:FF
ValidityWed, 01 Nov 2023 00:00:00 GMT - Fri, 01 Nov 2024 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
8.0 MB (7962029 bytes)
Hash
a9710d23ce275ee05a5c2b139c9e344b
90f3964b153912e1ea6270a4cc8258e5e0bb1bda
6ef8bcd4e48ee1b37548a6aaee53403f0b219825cca1629895d1969ce313a7f8

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/63

HTTP Headers

GET /vmospro/plugin/2022051320085965680.zip HTTP/1.1
Host: files.vmos.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Byte-nginx
content-type: application/zip
content-length: 7962029
accept-ranges: bytes
age: 2572766
etag: "627e4a5b-797dad"
last-modified: Fri, 13 May 2022 12:08:59 GMT
x-bdcdn-cache-status: TCP_HIT
x-request-id: 0d629fe452c679097c1f4b4457c10266
x-request-ip: 91.90.42.154
x-response-cache: edge_hit
x-response-cinfo: 91.90.42.154
x-tt-trace-tag: id=5
date: Thu, 18 Apr 2024 13:22:51 GMT
via: cache04.hbxtcu02
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (20)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers