Report - www.airwindows.com/wp-content/uploads/StarterKit.zip

Report Overview

Submitted URL
www.airwindows.com/wp-content/uploads/StarterKit.zip
IP
192.185.46.61
ASN
#19871 NETWORK-SOLUTIONS-HOSTING
Submitted
2024-04-19 10:03:07
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.airwindows.com	unknown	1998-05-04	2014-04-04	2024-03-13	506 B	6.4 MB	192.185.46.61

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.airwindows.com/wp-content/uploads/StarterKit.zip
IP
192.185.46.61
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
6.4 MB (6432905 bytes)
Hash
4a16f1796eab9bfa795f41c67f86a246
ac7170a11a845ffdc9ec7161d5ec40b08c6b6ea3
416c0791af4c40c6b77003e8a861e2d12283eabfa9f8fcfeffb59d32758bdc30

Archive (68)

Filename

Md5

File type

._StarterKit

ce4251907c8774587d85a0fc9f90ba0e

AppleDouble encoded Macintosh file

SignedMacVST.dmg

ba3316e519d9c01d4739b40871ebef0b

zlib compressed data

._SignedMacVST.dmg

f5032445d250042839f4a56d1f268966

AppleDouble encoded Macintosh file

.DS_Store

25a5f42dd57b18b0ab3bda2362c5b87a

Apple Desktop Services Store

._.DS_Store

e494d47df6524d3e93c42311a302bcfa

AppleDouble encoded Macintosh file

._WinVST64

798a7ba49e4e2898682d20e615618021

AppleDouble encoded Macintosh file

SignedMacAU.dmg

c8aa72dd1d7775fb8aeccb1a4cce5121

zlib compressed data

._SignedMacAU.dmg

c96c3e3544d73db1f92ad804f1e31aa9

AppleDouble encoded Macintosh file

HowToUse.txt

fcbb4f81d08d1bd5ad8b8f561696615a

ASCII text, with very long lines (634)

._HowToUse.txt

5b03c2bf5201e19db3eb7fbc231d17fb

AppleDouble encoded Macintosh file

._LinuxVST

798a7ba49e4e2898682d20e615618021

AppleDouble encoded Macintosh file

DeBess.so

e71b85ff62f4784b0f60f68ed553614c

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Baxandall.so

452c5c99f8d761fe2aab3a449a734c03

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Capacitor2.so

989abaeb90ee917afb29237670215ec5

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

.DS_Store

194577a7e20bdcc7afbb718f502c134c

Apple Desktop Services Store

._.DS_Store

b9a94cc8f4aac450fb21641eaf065c6d

AppleDouble encoded Macintosh file

Srsly2.so

b8c3c0977f0823d44e353b30df7ac07e

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Hypersonic.so

a2b6427cbfebf5682a104f7d1285cc56

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

ClipOnly2.so

2cc8c9908ad85e22e3b26642146c227e

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Console7Channel.so

6590a0e2e04df374d5ccd519d1fcf827

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Console7Buss.so

37eccbaf0066f11b2f69a6f08647a8ee

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Interstage.so

cf5b08ac80c017dfecb110a984f65dbb

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Focus.so

9fa52fe4668f0abaca11c464167974b8

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Channel9.so

40e1f60159fac52fa3d1e75a5ac9c441

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Pressure5.so

862d2dc85589e81e3d47fb153280b09e

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

PurestGain.so

0194f2d3962590eca4d86b74bfccef93

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Galactic.so

284ea8b8297d9589124cf469ef50e12f

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Monitoring.so

ee00b96bdad4573271dcdb029f2ff0f3

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Console7Cascade.so

da052eedd11a6d4077dc631674b366b0

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Verbity.so

16ffc1d9509bc698a0e4685f832dc4f7

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)

Capacitor264.dll

13c76d5fec071dbfbc8f4e1cf193a56f

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

.DS_Store

194577a7e20bdcc7afbb718f502c134c

Apple Desktop Services Store

._.DS_Store

e494d47df6524d3e93c42311a302bcfa

AppleDouble encoded Macintosh file

Galactic64.dll

d396774e6db0d183f5fdb00a25f8c5ac

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Console7Buss64.dll

25bf8054d948053c19606e4ee6d7b331

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Monitoring64.dll

a5969d5961a815907af5c047a7217ddc

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

DeBess64.dll

27ea6036bd4f188350a3733dc4adccd2

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Channel964.dll

42e53dda48a498b53d2c65243e4fe289

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Focus64.dll

397730e8f3ffd994f7bf38a36fde18bd

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Verbity64.dll

75642c41cd86b7cf97ec313fb904e284

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

PurestGain64.dll

69af58ac3dd5f87fc4cfaa33e1e51d82

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Console7Cascade64.dll

a6512cdbf9b6f0b628f8d693547a5ffd

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Srsly264.dll

23108f4226b65f42b37c6030de7f4c26

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Interstage64.dll

c513ec5457c8b67d2a4e45d8665bcd3e

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Console7Channel64.dll

894afb3034e6f0437c9b864127ed09c0

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Baxandall64.dll

fcb53b4774c9ce54de87b678b0c09179

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

ClipOnly264.dll

e0478afebebd99d8833ecfdc4e7dea16

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Pressure564.dll

ebefbcfa9473ec601ef46026a5bf5911

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

Hypersonic64.dll

c7ddc6cef197b1c8fdf2e48730ac1c98

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

DeBess.so

d431cd098a03b11d4a671182c4d9770e

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Baxandall.so

e3d1e544a4a0b5c80f9bf930ee6c4e47

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Capacitor2.so

7d75ef2e82cba8bf1045a067bde0b051

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

.DS_Store

194577a7e20bdcc7afbb718f502c134c

Apple Desktop Services Store

._.DS_Store

e494d47df6524d3e93c42311a302bcfa

AppleDouble encoded Macintosh file

Srsly2.so

bc4d9ea0936a217f1147b3adf3e615aa

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Hypersonic.so

f32cb00fd879e97e8752167a583b75f1

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

ClipOnly2.so

7d801567519ad63381a56f222dd3dd8c

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Console7Channel.so

c386024dd07aff8558a96daa09adb12d

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Console7Buss.so

c532ead8a0ecfb2c1eea48f620d930e5

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Interstage.so

08d5d64a280a823cde043978b59921c3

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Focus.so

e194ac3795726a796b0bfa56fb4215e9

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Channel9.so

7a2d73513006b64d219bae1c1caee3da

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Pressure5.so

dcf6361376d4a8db4ab43d05552dd3f3

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

PurestGain.so

297003389e4509ab7dad7d83ab91b005

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Galactic.so

96eb6d64419f027f19d77f56a6cd514c

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Monitoring.so

17222cded745efc577acb3e18ad0c85b

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Console7Cascade.so

13ecd4f72cd548452b2cf1523939c85d

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Verbity.so

e950d72334c8e5047266729c499e8dac

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/63

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

www.airwindows.com/wp-content/uploads/StarterKit.zip

192.185.46.61

200 OK

6.4 MB

URL User Request GET HTTP/2
www.airwindows.com/wp-content/uploads/StarterKit.zip
IP
192.185.46.61:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Certificate
IssuercPanel, Inc.
Subjectairwindows.com
FingerprintD3:7D:20:96:71:8D:92:C1:E3:5C:53:4E:E9:F7:D1:2F:3D:AE:31:CF
ValidityFri, 05 Apr 2024 00:00:00 GMT - Thu, 04 Jul 2024 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
6.4 MB (6432905 bytes)
Hash
4a16f1796eab9bfa795f41c67f86a246
ac7170a11a845ffdc9ec7161d5ec40b08c6b6ea3
416c0791af4c40c6b77003e8a861e2d12283eabfa9f8fcfeffb59d32758bdc30

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/63

HTTP Headers

GET /wp-content/uploads/StarterKit.zip HTTP/1.1
Host: www.airwindows.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Mon, 04 Apr 2022 11:30:37 GMT
accept-ranges: bytes
content-length: 6432905
content-type: application/zip
date: Fri, 19 Apr 2024 10:02:39 GMT
server: Apache
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (68)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers