Report - www.fbl.cz/wp-content/uploads/arctel/download/atn434lssh.zip

Report Overview

Submitted URL
www.fbl.cz/wp-content/uploads/arctel/download/atn434lssh.zip
IP
94.112.247.39
ASN
#16019 Vodafone Czech Republic a.s.
Submitted
2024-03-29 10:16:58
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
3

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.fbl.cz	unknown	1996-10-10	2015-11-20	2024-02-27	514 B	4.6 MB	94.112.247.39

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.fbl.cz/wp-content/uploads/arctel/download/atn434lssh.zip
IP
94.112.247.39
ASN
#16019 Vodafone Czech Republic a.s.

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
4.6 MB (4566263 bytes)
Hash
fd908456f98f281a360a43f6bdd25ef7
ac6bce4325e9ccf7f5b3eafc3d2615fdcbaca047
6f6a9ee54d27d1b80cbf9da5db6a87f847e6d1297a44b4d83ed894a9ab9e2525

Archive (63)

Filename

Md5

File type

ANSI.KBD

214215e0e33a95825bf49f5cdf01830e

ASCII text, with CRLF line terminators

ANSI32.DLL

bc77b54e036f7ea77772cad4e684101c

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

ARCTEL.INI

a3959436d51907ad872a9342c66a7754

Windows setup INFormation

ArcTel32.EXE

4235b49fa4b0132af502fad886f7ef3a

PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

ArcTel32.HLP

f389a88b86dba3ed33c6537966634aa7

MS Windows 3.1 help, Tue Sep 7 08:16:41 2021, 144518 bytes

ATEL32.DLL

efade1f3005ee5fa03c9f026e4e878e6

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 7 sections

AtlTSlic.EXE

ca0ffa7f540ed9dde58a25f353adc3b1

PE32 executable (console) Intel 80386, for MS Windows, 6 sections

CTI_MNE.TXT

bc3a9016b33e87318273af90e6dafb7b

ASCII text, with CRLF line terminators

ATWCZE32.DLL

a7fe3a3bd1c9d14fe9128b3590a9c762

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 3 sections

DECG2UNI.MAP

a8ee1069dbefd98413f2e26832379512

ASCII text, with CRLF line terminators

DOS2UNI.MAP

37a449f9d67a898d8a5d9e37b7a2b842

ASCII text, with CRLF line terminators

FtpSrv32.EXE

fc52b9f98e3ea5113df43a372d177438

PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections

ISO2LAT.MAP

271e9bff6ad6e38448e17dbc41c57b51

ASCII text, with CRLF line terminators

ISO2UNI.MAP

9ab17c11b62563bcd9c2d5a2485202ee

ASCII text, with CRLF line terminators

ISO2WIN.MAP

ad710fda2b2ae530655c5b4730ad1425

ASCII text, with CRLF line terminators

ISOSTRIP.MAP

4f69f4338ae4bf5b639254635fdba1c0

ASCII text, with CRLF line terminators

LAT2ISO.MAP

8f46ffb173e0034b89223f6ad0168d73

ASCII text, with CRLF line terminators

LAT2MJK.MAP

1a774dbb80cdf1a958883a5fdf0c07f9

ASCII text, with CRLF line terminators

LATSTRIP.MAP

6395b1fdfaac8f713cb8e71efcce7567

ASCII text, with CRLF line terminators

LICTCP32.EXE

2d04de280e5001045c3b6d8b5aad5200

PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections

LINUX.KBD

2a52a95222ab3e2e853d13de95f0fde3

ASCII text, with CRLF line terminators

LINUX32.DLL

ff857b5c5bedfc4adce50661e8e950ca

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

MJK2LAT.MAP

8ab4dde3a77fbb224b3fbb09493099c9

ASCII text, with CRLF line terminators

MJK2UNI.MAP

955c3ba96d82d70c1670684934a0df1c

ASCII text, with CRLF line terminators

SETUP.EXE

0858dc3f72cc2572c242c37bf3dd47c1

PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections

STPCZE32.DLL

57e0384ff91ba144ed568bf218176309

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 3 sections

arctel.termcap

08918208b5805d91404ea5e3ac312adb

ASCII text

arctel.terminfo.src

137d5ac8a98c6623275916e7faf92cf0

ASCII text

localftp

b92ecf28e465a0d707d43be939bdd681

ASCII text

lprint

65625da57dc8227b66de0315e1cfca87

POSIX shell script, ASCII text executable

mscreencap

6f6c8e388b95547cc63679e7449e1a26

ASCII text

unpgkey

58aeb03b8fd136e0bb79588e2ac2fb30

ASCII text

VT220.KBD

7b9e776fdb82456a01e41ecfa7b15995

ASCII text, with CRLF line terminators

VT320.KBD

99b4fc1b35f49ad72d7b2afc6bd16dd0

ASCII text, with CRLF line terminators

VT32032.DLL

f90d291bfcd8724384eeafec573234c6

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

WIN2ISO.MAP

02435c09f491518bf80468451f95728c

ASCII text, with CRLF line terminators

WIN2UNI.MAP

4afb6e172616e8ed8885e81977aa8f1a

ASCII text, with CRLF line terminators

WIN2WIN.MAP

fdf2a786d8f958714a6c4e81f81485fe

ASCII text, with CRLF line terminators

WLPCZE32.DLL

440c732da7781e32f3210563e9703667

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 3 sections

WLPR32.EXE

54114a6f5bd29506406a37af7b2f6578

PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

WLPR32.HLP

b1da564c034481192d3921f520180acc

MS Windows 3.1 help, Tue Sep 7 08:18:34 2021, 31945 bytes

WLPR_NT.REG

60ef196cf7f69ed43427d9ee3f176236

Windows Registry text (Win95 or above)

WY160.KBD

6613ea48031820170363340e7e6f5861

ASCII text, with CRLF line terminators

WY16032.DLL

ee5941c649bfa202094acbc7a52c9c66

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

WYLG2UNI.MAP

4726a1a886f2368391f3bc8159248532

ASCII text, with CRLF line terminators

SETUP.INF

90927c6feb8b948e66015b62a1d1798b

Generic INItialization configuration [setup data]

AUTHORS.txt

6f2e36170b3770269e9ea27fd89f3048

ASCII text, with CRLF line terminators

BSD.txt

b2b1211c19e60ef2dd6dc3a4e29befe2

ASCII text, with CRLF line terminators

ChangeLog.txt

80a660381420611d806e6874186ed816

ASCII text, with CRLF line terminators

COPYING.txt

1e790718360b97e5ee36343ccdb9808e

ASCII text, with CRLF line terminators

INSTALL.txt

793f9311efc6c587285a1d5788c2c7ed

ASCII text, with CRLF line terminators

LibSSH.DLL

b6ea1ce5b78f9be0059e2116d691bdcb

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 7 sections

README.txt

0bfa7b91c69fa0f12b7afebdfe207681

ASCII text, with CRLF line terminators

ACKNOWLEDGEMENTS.txt

c45f32e77d8b7b2f110e0d1d4b07736c

ASCII text, with CRLF line terminators

CHANGES.txt

dd617f5a503065a548a37c2597acdafe

Generic INItialization configuration [Matt Caswell]

FAQ.txt

50868b9d78bb3faed2b23dace5bc149c

ASCII text, with CRLF line terminators

INSTALL.txt

c43b3c66907cf6b9bd83cc1e89496bee

ASCII text, with CRLF line terminators

libcrypto-1_1.dll

208f5645bd7b6f13d0058c36834f2902

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 8 sections

libssl-1_1.dll

fbeb9d810939adb3b634f9a1466ab19c

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 8 sections

LICENSE.txt

cd010da4cf5b82714dbc32f3e05df760

ASCII text, with CRLF line terminators

NEWS.txt

cf3b28ca118e15e4e3595d947e6ee562

Generic INItialization configuration [25 Mar 2021]

README.txt

d7609d7c98567bfb5d55ae4f78b5ce2c

ASCII text, with CRLF line terminators

vcruntime140.dll

a2523ea6950e248cbdf18c9ea1a844f6

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 6 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

	URL	IP	Response	Size
	www.fbl.cz/wp-content/uploads/arctel/download/atn434lssh.zip	94.112.247.39	200 OK	4.6 MB
URL User Request GET HTTP/1.1 www.fbl.cz/wp-content/uploads/arctel/download/atn434lssh.zip IP 94.112.247.39:443 ASN #16019 Vodafone Czech Republic a.s. Certificate IssuerLet's Encrypt Subjectwww.fbl.cz Fingerprint5E:FF:7C:61:47:A7:D5:F2:94:9E:59:3C:C7:19:E3:34:31:90:49:44 ValidityTue, 27 Feb 2024 07:05:44 GMT - Mon, 27 May 2024 07:05:43 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 4.6 MB (4566263 bytes) Hash fd908456f98f281a360a43f6bdd25ef7 ac6bce4325e9ccf7f5b3eafc3d2615fdcbaca047 6f6a9ee54d27d1b80cbf9da5db6a87f847e6d1297a44b4d83ed894a9ab9e2525 HTTP Headers `GET /wp-content/uploads/arctel/download/atn434lssh.zip HTTP/1.1 Host: www.fbl.cz User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 200 OK Date: Fri, 29 Mar 2024 10:16:30 GMT Server: Apache/2.4.37 (centos) OpenSSL/1.1.1k Strict-Transport-Security: max-age=86400 Vary: Accept-Encoding Last-Modified: Thu, 07 Apr 2022 15:34:59 GMT ETag: "45acf7-5dc1238802ec0" Accept-Ranges: bytes Content-Length: 4566263 Cache-Control: max-age=31536000, public Expires: Sat, 29 Mar 2025 10:16:30 GMT Referrer-Policy: no-referrer-when-downgrade Pragma: public Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/zip

www.fbl.cz/wp-content/uploads/arctel/download/atn434lssh.zip

94.112.247.39

200 OK

4.6 MB

URL User Request GET HTTP/1.1
www.fbl.cz/wp-content/uploads/arctel/download/atn434lssh.zip
IP
94.112.247.39:443
ASN
#16019 Vodafone Czech Republic a.s.

Certificate
IssuerLet's Encrypt
Subjectwww.fbl.cz
Fingerprint5E:FF:7C:61:47:A7:D5:F2:94:9E:59:3C:C7:19:E3:34:31:90:49:44
ValidityTue, 27 Feb 2024 07:05:44 GMT - Mon, 27 May 2024 07:05:43 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
4.6 MB (4566263 bytes)
Hash
fd908456f98f281a360a43f6bdd25ef7
ac6bce4325e9ccf7f5b3eafc3d2615fdcbaca047
6f6a9ee54d27d1b80cbf9da5db6a87f847e6d1297a44b4d83ed894a9ab9e2525

HTTP Headers

GET /wp-content/uploads/arctel/download/atn434lssh.zip HTTP/1.1
Host: www.fbl.cz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 29 Mar 2024 10:16:30 GMT
Server: Apache/2.4.37 (centos) OpenSSL/1.1.1k
Strict-Transport-Security: max-age=86400
Vary: Accept-Encoding
Last-Modified: Thu, 07 Apr 2022 15:34:59 GMT
ETag: "45acf7-5dc1238802ec0"
Accept-Ranges: bytes
Content-Length: 4566263
Cache-Control: max-age=31536000, public
Expires: Sat, 29 Mar 2025 10:16:30 GMT
Referrer-Policy: no-referrer-when-downgrade
Pragma: public
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/zip

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (63)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers