Report - www.apple2works.com/marklim/nushrinkitx.zip

Report Overview

Submitted URL
www.apple2works.com/marklim/nushrinkitx.zip
IP
129.121.31.190
ASN
#46606 UNIFIEDLAYER-AS-1
Submitted
2024-04-24 17:02:49
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.apple2works.com	unknown	2020-06-10	2022-07-18	2023-09-02	413 B	1.4 MB	129.121.31.190

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.apple2works.com/marklim/nushrinkitx.zip
IP
129.121.31.190
ASN
#46606 UNIFIEDLAYER-AS-1

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
1.4 MB (1372945 bytes)
Hash
6086a5eabd69e06d0d6eeed90cf6dbe4
ea73761592700867557d72a1229f5a1c9c6c6407
331b58d12e3b16ad2e7968608ce92632db87fa2b85f6101fdc319325ea6f4092

Archive (110)

Filename

Md5

File type

NuShrinkItX

03d97271a32adc5b811522205598ac0b

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>] [ - ppc_7400: - Mach-O ppc_7400 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>] [ - x86_64: - Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK>]

._NuShrinkItX

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._MacOS

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

NUPreferences.nib

230d333bc5a36c3ed328f6329c0cbe2a

Apple binary property list

._NUPreferences.nib

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

AdvancedPreferences.nib

8a61e53ea9f001348b4a678a10501fac

Apple binary property list

._AdvancedPreferences.nib

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

NUWindow.nib

d0713a4ecf47f70f62d6835ea8c9fa14

Apple binary property list

._NUWindow.nib

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

ProgressView.nib

151990486cd9b10ea790b570b176a0cb

Apple binary property list

._ProgressView.nib

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

CleanPanel.nib

76ef291a4ce14e5e5fe7026ea77ad448

Apple binary property list

._CleanPanel.nib

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

FType.Apple

595870316ad106951b80868b25135626

PDP-11 UNIX/RT ldp

._FType.Apple

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

MainMenu.nib

cbe005b727c7c8ba3bc684b4991b9856

Apple binary property list

._MainMenu.nib

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

InfoPlist.strings

d72878bb656f235c73b049056cd30dba

Unicode text, UTF-16, big-endian text

._InfoPlist.strings

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Credits.rtf

745f379f9ebb85517bcbb0b58ed3fff5

Rich Text Format data, version 1, ANSI, code page 1252

._Credits.rtf

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

ProgressWindow.nib

ed1f8059f8f6034cfa5fc1ec7f5b5141

Apple binary property list

._ProgressWindow.nib

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

AttributesWindow.nib

9af34a9547196e857e07e4a5d715e721

Apple binary property list

._AttributesWindow.nib

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

GeneralPreferences.nib

b2305c83b003018105ac9fc869093097

Apple binary property list

._GeneralPreferences.nib

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Archive.icns

a041688db1ed7a0228648e7827818e14

Mac OS X icon, 338944 bytes, "is32" type

._Archive.icns

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

defaultPrefs.plist

3719d4c816c640e892654ea368e179ce

XML 1.0 document, ASCII text

._defaultPrefs.plist

7385f8b6b312e1842817798ebc0aba1c

AppleDouble encoded Macintosh file

MoreFileInfoWindow.nib

c94c95793336994e17b3ec7e6e150b16

Apple binary property list

._MoreFileInfoWindow.nib

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

PreviewWindow.nib

371643ef02d01728e74762d5888cc848

Apple binary property list

._PreviewWindow.nib

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._English.lproj

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

65C02.plist

943dcfb8d351cb102b97d1b268756412

XML 1.0 document, ASCII text

._65C02.plist

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Documentation.rtf

bde8324a9de31591a7dfbe8c644f263d

Rich Text Format data, version 1, ANSI, code page 1252

._Documentation.rtf

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

AppleSoft.plist

94649dcbb06fc39ba9e0b155c75df29a

XML 1.0 document, ASCII text

._AppleSoft.plist

1a49b31c546e59ceb4ab3d5e71e36b65

AppleDouble encoded Macintosh file

6502.plist

dac005161ff881718cabc13361ea9a95

XML 1.0 document, ASCII text

._6502.plist

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Resources

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

SpotlightSHK

33cb433d2b0e3045923aeff8669511e1

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>] [ - ppc_7400: - Mach-O ppc_7400 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>] [ - x86_64: - Mach-O 64-bit x86_64 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>]

._SpotlightSHK

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._MacOS

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

InfoPlist.strings

7d18d5282c657a6c2660c86cace3f41d

Unicode text, UTF-16, big-endian text

._InfoPlist.strings

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

schema.strings

d309340317c1de9b30b5800d45869ebb

Unicode text, UTF-16, big-endian text

._schema.strings

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._English.lproj

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

schema.xml

d3f3cfc74c5a87c7b2586638e6ee60eb

XML 1.0 document, ASCII text

._schema.xml

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Resources

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Info.plist

b59edcb3b25704f257d45caab0c80141

XML 1.0 document, ASCII text

._Info.plist

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Contents

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._SpotlightSHK.mdimporter

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Spotlight

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

QuickLookSHK

95daa319448bf215cbd992f1d14398a6

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>] [ - ppc_7400: - Mach-O ppc_7400 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>] [ - x86_64: - Mach-O 64-bit x86_64 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>]

._QuickLookSHK

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._MacOS

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Archive.png

e92420faefbef874126deab8e264285e

PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced

._Archive.png

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

InfoPlist.strings

76ab4f8101f07b9f1efc6266603e1325

Unicode text, UTF-16, big-endian text

._InfoPlist.strings

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Archive.icns

a041688db1ed7a0228648e7827818e14

Mac OS X icon, 338944 bytes, "is32" type

._Archive.icns

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._English.lproj

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

treeTable.js

2b2d3d728821bef1e284bdd7c125b061

JavaScript source, ASCII text, with very long lines (3902), with CR line terminators

._treeTable.js

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

style.css

73333a6059f5c6dca269790b0fc62c0f

ASCII text

._style.css

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

jquery.js

6631a779321bc03f4a5281d3ff526254

JavaScript source, ASCII text, with very long lines (32061)

._jquery.js

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Resources

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Info.plist

1511bf1748fe738c9db2ec0b70f826cf

XML 1.0 document, ASCII text

._Info.plist

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Contents

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._QuickLookSHK.qlgenerator

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._QuickLook

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Library

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Resources

e58c4cf10cc7c8ef7d7167ccb641aeb4

ASCII text, with no line terminators

._Resources

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Info.plist

9d3547e2f99bbea3f675926c526dfe13

XML 1.0 document, ASCII text

._Info.plist

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Resources

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

NuFx

7a0cd124c5355db86a927c506043a1a1

Mach-O universal binary with 3 architectures: [i386: - Mach-O i386 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>] [ - ppc_7400: - Mach-O ppc_7400 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>] [ - x86_64: - Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>]

._NuFx

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

NufxLib.h

0b7514a3725d43bd839855b40c02921c

C source, ASCII text

._NufxLib.h

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Headers

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._A

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Current

7fc56270e7a70fa81a5935b72eacbe29

very short file (no magic)

._Current

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Versions

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

NuFx

7e01ed8e99f8c711762dba2a5c80840c

ASCII text, with no line terminators

._NuFx

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Headers

86c63de7bd8775780ac77380b5c049c4

ASCII text, with no line terminators

._Headers

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._NuFx.framework

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Frameworks

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Info.plist

7e56e0b367c15e4cfb867037b3517339

XML 1.0 document, ASCII text

._Info.plist

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

PkgInfo

23b7d7d024abb0f558420e098800bf27

ASCII text, with no line terminators

._PkgInfo

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._Contents

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

._NuShrinkItX.app

7961c1fc74ec39f5d3bd7bb2dcf6d155

AppleDouble encoded Macintosh file

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

www.apple2works.com/marklim/nushrinkitx.zip

129.121.31.190

200 OK

1.4 MB

URL User Request GET HTTP/1.1
www.apple2works.com/marklim/nushrinkitx.zip
IP
129.121.31.190:80
ASN
#46606 UNIFIEDLAYER-AS-1

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
1.4 MB (1372945 bytes)
Hash
6086a5eabd69e06d0d6eeed90cf6dbe4
ea73761592700867557d72a1229f5a1c9c6c6407
331b58d12e3b16ad2e7968608ce92632db87fa2b85f6101fdc319325ea6f4092

HTTP Headers

GET /marklim/nushrinkitx.zip HTTP/1.1
Host: www.apple2works.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:02:23 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Thu, 30 Nov 2023 17:07:16 GMT
Accept-Ranges: bytes
Content-Length: 1372945
Keep-Alive: timeout=5, max=75
Content-Type: application/zip