Report - www.aniva-ltd.ru/vds_clients/imb/vs_oed.zip

Report Overview

Submitted URL
www.aniva-ltd.ru/vds_clients/imb/vs_oed.zip
IP
213.189.197.203
ASN
#6903 Rusonyx, Ltd.
Submitted
2024-04-17 07:24:10
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.aniva-ltd.ru	unknown	2006-08-03	2015-03-21	2023-12-30	680 B	4.3 MB	213.189.197.203

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.aniva-ltd.ru/vds_clients/imb/vs_oed.zip
IP
213.189.197.203
ASN
#6903 Rusonyx, Ltd.

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
4.2 MB (4246656 bytes)
Hash
2b29e6a316dcbf57ced858aae9ffa293
de087e9234c7cea8c2ffb39b8809e4961116b650
b96a104ef6f84ed843c3efb4f7d68583a20c89552868ee1f84e31cbf4869acd8

Archive (1)

Filename

Md5

File type

VS_OED.EXE

0d04d890bd2e5b7879bcbdb9e0cffca0

PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	www.aniva-ltd.ru/	213.189.197.203		3.5 kB
URL www.aniva-ltd.ru/ IP 213.189.197.203:0 ASN #6903 Rusonyx, Ltd. File type HTML document, ISO-8859 text Size 3.5 kB (3520 bytes) Hash 2c5213080cda96341a1392840ca40bd1 74446e5d0590332bfed56d7e4914aee49aa58016 541bd631ef88bd02aadc88197b3a7a0cfb92046b3969f0998ff3199d632ed0fb HTTP Headers `GET / HTTP/1.1 Host: www.aniva-ltd.ru User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Date: Wed, 17 Apr 2024 07:23:45 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 3520 Connection: keep-alive Last-Modified: Wed, 03 Apr 2024 04:15:11 GMT ETag: "34ac396-dc0-660cd7cf" Accept-Ranges: bytes Content-Language: ru`

	www.aniva-ltd.ru/vds_clients/imb/vs_oed.zip	213.189.197.203	200 OK	4.2 MB
URL User Request GET HTTP/1.1 www.aniva-ltd.ru/vds_clients/imb/vs_oed.zip IP 213.189.197.203:80 ASN #6903 Rusonyx, Ltd. File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 4.2 MB (4246656 bytes) Hash 2b29e6a316dcbf57ced858aae9ffa293 de087e9234c7cea8c2ffb39b8809e4961116b650 b96a104ef6f84ed843c3efb4f7d68583a20c89552868ee1f84e31cbf4869acd8 HTTP Headers `GET /vds_clients/imb/vs_oed.zip HTTP/1.1 Host: www.aniva-ltd.ru User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Date: Wed, 17 Apr 2024 07:23:45 GMT Content-Type: application/zip Content-Length: 4246656 Connection: keep-alive Last-Modified: Wed, 27 Mar 2024 09:13:38 GMT ETag: "34ac77b-40cc80-6603e342" Accept-Ranges: bytes`