Report - www.apple2works.com/marklim/quickviewshr.zip

Report Overview

Submitted URL
www.apple2works.com/marklim/quickviewshr.zip
IP
129.121.31.190
ASN
#46606 UNIFIEDLAYER-AS-1
Submitted
2024-04-24 17:02:57
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
3

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.apple2works.com	unknown	2020-06-10	2022-07-18	2023-09-02	414 B	1.1 MB	129.121.31.190

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.apple2works.com/marklim/quickviewshr.zip
IP
129.121.31.190
ASN
#46606 UNIFIEDLAYER-AS-1

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
1.1 MB (1124860 bytes)
Hash
3bdeec66d367df0ca5ae2059a9e3de3b
630bb6afdfcd843e3c455ae745e2f48e81c2c8fc
b8980d691acc1f4dc1832967f088c316664416d9d1627177b3cedc0a19806ad1

Archive (77)

Filename

Md5

File type

Info.plist

1310731d60a02670811b62ed0d0de8b3

XML 1.0 document, ASCII text

._Info.plist

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Info.plist

1ae29a9e12777b7417bd44f812792eb9

XML 1.0 document, ASCII text

._Info.plist

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

QuickLookSHR

ef9072d4063e7c74bd4ee9a684b504e1

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>] [ - ppc_7400: - Mach-O ppc_7400 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>] [ - x86_64: - Mach-O 64-bit x86_64 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>]

._QuickLookSHR

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._MacOS

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

InfoPlist.strings

cde1782b5e3f48b4b70894c2471b121d

Unicode text, UTF-16, big-endian text

._InfoPlist.strings

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

QuickLookSHR.icns

9610376f058719c4e8a96b12ec41fabb

Mac OS X icon, 134586 bytes, "is32" type

._QuickLookSHR.icns

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._English.lproj

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Contents

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._QuickLookSHR.qlgenerator

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._QuickLook

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Info.plist

d4747c346f2af587471e3658917181ad

XML 1.0 document, ASCII text

._Info.plist

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

SpotlightSHR

5c2f2c52a0abdfabdca03c9c92e4b47f

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>] [ - ppc_7400: - Mach-O ppc_7400 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>] [ - x86_64: - Mach-O 64-bit x86_64 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>]

._SpotlightSHR

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._MacOS

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

InfoPlist.strings

63890ecdc4be83692420bcddca631384

Unicode text, UTF-16, big-endian text

._InfoPlist.strings

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

schema.strings

c1b11041b8c7c7716838c23ca8c4bd70

Unicode text, UTF-16, big-endian text

._schema.strings

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._English.lproj

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

schema.xml

a41e8cdf453c051527c4003273183f8d

XML 1.0 document, ASCII text

._schema.xml

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Contents

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._SpotlightSHR.mdimporter

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Spotlight

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Library

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

QuickViewSHR

4c432c374b87501c742d10bb378f2436

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>] [ - ppc_7400: - Mach-O ppc_7400 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>] [ - x86_64: - Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>]

._QuickViewSHR

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._MacOS

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

PkgInfo

23b7d7d024abb0f558420e098800bf27

ASCII text, with no line terminators

._PkgInfo

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Credits.rtf

70183f8dfd62e2dc08c5a755f6f9fe38

Rich Text Format data, version 1, ANSI, code page 1252

._Credits.rtf

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

DragDropWindow.nib

598e27e44f07a59d03c0f8364205c0b9

Apple binary property list

._DragDropWindow.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

DropImage.png

e8be32e583789b5f1bf5d4c5d1a701ac

PNG image data, 640 x 400, 8-bit/color RGBA, non-interlaced

._DropImage.png

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

InfoPlist.strings

d72878bb656f235c73b049056cd30dba

Unicode text, UTF-16, big-endian text

._InfoPlist.strings

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

MainMenu.nib

7c469e0df6198d50f981f682183110bd

Apple binary property list

._MainMenu.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

ProgressWindow.nib

adae26d3aa9e45e1d515d10de7f997f4

Apple binary property list

._ProgressWindow.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

QuickView.icns

59718e9d9c95ca93037aa284b5882904

Mac OS X icon, 131083 bytes, "is32" type

._QuickView.icns

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Fig1.png

06f1382c640a0e3122928655081438c4

PNG image data, 708 x 466, 8-bit/color RGBA, non-interlaced

._Fig1.png

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Fig2.png

7b033d86f0e4b9897720f2015ff256a4

PNG image data, 719 x 476, 8-bit/color RGBA, non-interlaced

._Fig2.png

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Fig3.png

1b96d19f1fee5e05cf87671f61b93fe3

PNG image data, 745 x 715, 8-bit/color RGBA, non-interlaced

._Fig3.png

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Fig4.png

072e671631d7805c1538dcf4f3f4b27d

PNG image data, 796 x 714, 8-bit/color RGBA, non-interlaced

._Fig4.png

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Fig5..png

f70ff854d62b723c52312059d273fb40

PNG image data, 467 x 201, 8-bit/color RGBA, non-interlaced

._Fig5..png

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Fig6.png

1eba526e14bf3d0474f441910d4161f2

PNG image data, 712 x 590, 8-bit/color RGBA, non-interlaced

._Fig6.png

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

TXT.rtf

2978ccb5bcc587f03dcf296916250505

Rich Text Format data, version 1, ANSI, code page 1252

._TXT.rtf

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Readme.rtfd

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Statistics.nib

dd5c5fd0559f34d98762be8df84db015

Apple binary property list

._Statistics.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

TaskView.nib

6f01568a1670c89ebefb36d624698668

Apple binary property list

._TaskView.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

VersionWindow.nib

2b24d9b270be9360192852f38e0c7ec3

Apple binary property list

._VersionWindow.nib

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._English.lproj

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Resources

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._Contents

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

._QuickViewSHR.app

32e9969fc329aaf54b022c5cac3f08f6

AppleDouble encoded Macintosh file

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

www.apple2works.com/marklim/quickviewshr.zip

129.121.31.190

200 OK

1.1 MB

URL User Request GET HTTP/1.1
www.apple2works.com/marklim/quickviewshr.zip
IP
129.121.31.190:80
ASN
#46606 UNIFIEDLAYER-AS-1

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
1.1 MB (1124860 bytes)
Hash
3bdeec66d367df0ca5ae2059a9e3de3b
630bb6afdfcd843e3c455ae745e2f48e81c2c8fc
b8980d691acc1f4dc1832967f088c316664416d9d1627177b3cedc0a19806ad1

HTTP Headers

GET /marklim/quickviewshr.zip HTTP/1.1
Host: www.apple2works.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:02:31 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Wed, 17 Jan 2024 18:17:13 GMT
Accept-Ranges: bytes
Content-Length: 1124860
Keep-Alive: timeout=5, max=75
Content-Type: application/zip