Report - github.com/Ken5998/OpenCore-VMware-Workstation-AMD/releases/download/0.6.9/EFI.zip

Report Overview

Submitted URL
github.com/Ken5998/OpenCore-VMware-Workstation-AMD/releases/download/0.6.9/EFI.zip
IP
140.82.121.3
ASN
#36459 GITHUB
Submitted
2024-03-29 09:02:13
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
github.com	1423	2007-10-09	2016-07-13	2024-03-24	536 B	3.9 kB	140.82.121.3
objects.githubusercontent.com	134060	2014-02-06	2021-11-01	2024-03-29	986 B	1.2 MB	185.199.108.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
objects.githubusercontent.com/github-production-release-asset-2e65be/319084287/ac75ee00-b989-11eb-8151-29db6e34d831?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240329%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240329T090146Z&X-Amz-Expires=300&X-Amz-Signature=13844d08f59cbe598de11cffb5af0bac7e445ded3cd7973085f06d191721e971&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=319084287&response-content-disposition=attachment%3B%20filename%3DEFI.zip&response-content-type=application%2Foctet-stream
IP
185.199.108.133
ASN
#54113 FASTLY

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
1.2 MB (1193489 bytes)
Hash
f5cf9aae966ae140f439c3ade87df0ac
f8cc871904a7ef6f70605dd87bd073bc0669d834
4155a456809664ea218d91ebf95cfeb7fbeaf423f92e6ccd0795323dc716a8e5

Archive (67)

Filename

Md5

File type

._BOOT

d056a1a7ba65ec26bbcd0e85b142cd70

AppleDouble encoded Macintosh file

BOOTx64.efi

681157df6c58bafdc592acab79406de0

PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows, 4 sections

._BOOTx64.efi

372face0f486117fb794b3252e372691

AppleDouble encoded Macintosh file

._OC

92baa108222c0dc2a300466209d4bc3e

AppleDouble encoded Macintosh file

._ACPI

d056a1a7ba65ec26bbcd0e85b142cd70

AppleDouble encoded Macintosh file

._Tools

d056a1a7ba65ec26bbcd0e85b142cd70

AppleDouble encoded Macintosh file

.DS_Store

be3843a3d7690a447087d98b42ccacfb

Apple Desktop Services Store

._.DS_Store

b9a94cc8f4aac450fb21641eaf065c6d

AppleDouble encoded Macintosh file

._Drivers

d056a1a7ba65ec26bbcd0e85b142cd70

AppleDouble encoded Macintosh file

._Kexts

d056a1a7ba65ec26bbcd0e85b142cd70

AppleDouble encoded Macintosh file

._Resources

d056a1a7ba65ec26bbcd0e85b142cd70

AppleDouble encoded Macintosh file

OpenCore.efi

5b8545e031bd9341f7bc20fe313cc390

PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows, 4 sections

._OpenCore.efi

372face0f486117fb794b3252e372691

AppleDouble encoded Macintosh file

config.plist

92fc50c7229010172b9e016e956ed3fb

XML 1.0 document, ASCII text

._config.plist

8810fe47dcb29a662ebbef5ef1f7612a

AppleDouble encoded Macintosh file

SSDT-EHCI.aml

eef33dda615e2c6e44c2c72fe8307056

ACPI Machine Language file 'SSDT' QEMUUSB 0 by KGP, revision 1, 163 bytes, created by INTL 20190509

._SSDT-EHCI.aml

73184317b9e9d805641b870763edd0d5

AppleDouble encoded Macintosh file

SSDT-EC.aml

aa509ca60ef391c9c3685b508c297b77

ACPI Machine Language file 'SSDT' SsdtEC 1000 by ACDT, revision 2, 267 bytes, created by INTL 20190509

._SSDT-EC.aml

73184317b9e9d805641b870763edd0d5

AppleDouble encoded Macintosh file

.DS_Store

a4428dc5e76ea9c12f66a8899671313a

Apple Desktop Services Store

._.DS_Store

b9a94cc8f4aac450fb21641eaf065c6d

AppleDouble encoded Macintosh file

SSDT-DTGP.aml

056f08ebab9051f9e90d55e0ccb0ffe6

ACPI Machine Language file 'SSDT' DTPG 1000 by KGP, revision 2, 100 bytes, created by INTL 20190509

._SSDT-DTGP.aml

73184317b9e9d805641b870763edd0d5

AppleDouble encoded Macintosh file

FixShutdown-USB-SSDT.aml

1df901c2c7171b71c3d813d0e9ed42e2

ACPI Machine Language file 'SSDT' ZPTS 0 by Slav, revision 2, 108 bytes, created by INTL 20200925

._FixShutdown-USB-SSDT.aml

dc9d5501069c97a09d7fbdd65c46c793

AppleDouble encoded Macintosh file

SSDT-EC-USBX-DESKTOP.aml

d521d6c1c17c77b93ec483d34e13cb8f

ACPI Machine Language file 'SSDT' SsdtEC 1000 by DRTNIA, revision 2, 6561 bytes, created by INTL 20190509

._SSDT-EC-USBX-DESKTOP.aml

4de5caef63a16c4e9d662dbec8407524

AppleDouble encoded Macintosh file

SSDT-PLUG.aml

6ea191044be70ec60f4a2114da85fde2

ACPI Machine Language file 'SSDT' CpuPlug 3000 by CpuRef, revision 2, 177 bytes, created by INTL 20190509

._SSDT-PLUG.aml

73184317b9e9d805641b870763edd0d5

AppleDouble encoded Macintosh file

OpenShell.efi

e65ef8f2f723cca533b5781f7c254476

PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows, 4 sections

._OpenShell.efi

372face0f486117fb794b3252e372691

AppleDouble encoded Macintosh file

ResetSystem.efi

01b6a596a98aeb0c6ada615af502bd26

PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows, 4 sections

._ResetSystem.efi

372face0f486117fb794b3252e372691

AppleDouble encoded Macintosh file

OpenRuntime.efi

071ef024f9d7e72fe2ec2aa24b45274b

PE32+ executable (EFI runtime driver) x86-64 (stripped to external PDB), for MS Windows, 4 sections

._OpenRuntime.efi

372face0f486117fb794b3252e372691

AppleDouble encoded Macintosh file

.DS_Store

3624634960a553c98d901477b10d139f

Apple Desktop Services Store

._.DS_Store

b9a94cc8f4aac450fb21641eaf065c6d

AppleDouble encoded Macintosh file

OpenCanopy.efi

5f4a2cadf0678baeb3bf090ad713b9f0

PE32+ executable (EFI boot service driver) x86-64 (stripped to external PDB), for MS Windows, 4 sections

._OpenCanopy.efi

372face0f486117fb794b3252e372691

AppleDouble encoded Macintosh file

VBoxHfs.efi

13529297648997e4dfe04e24b8b4f75c

PE32+ executable (EFI boot service driver) x86-64 (stripped to external PDB), for MS Windows, 3 sections

._VBoxHfs.efi

73184317b9e9d805641b870763edd0d5

AppleDouble encoded Macintosh file

OpenHfsPlus.efi

ed8ab33aaccf16d13bcb11233a3cec42

PE32+ executable (EFI boot service driver) x86-64 (stripped to external PDB), for MS Windows, 4 sections

._OpenHfsPlus.efi

372face0f486117fb794b3252e372691

AppleDouble encoded Macintosh file

.DS_Store

b00bbfaefbce2543b8a93be612cdcc2c

Apple Desktop Services Store

._.DS_Store

b9a94cc8f4aac450fb21641eaf065c6d

AppleDouble encoded Macintosh file

._VoodooHDA.kext

03073565a1cef5ba6133144db20edd5e

AppleDouble encoded Macintosh file

._Label

d056a1a7ba65ec26bbcd0e85b142cd70

AppleDouble encoded Macintosh file

._Image

d056a1a7ba65ec26bbcd0e85b142cd70

AppleDouble encoded Macintosh file

._Audio

d056a1a7ba65ec26bbcd0e85b142cd70

AppleDouble encoded Macintosh file

._Font

d056a1a7ba65ec26bbcd0e85b142cd70

AppleDouble encoded Macintosh file

._Contents

994a32df3afab92d75fbc8f8916da673

AppleDouble encoded Macintosh file

Info.plist

7ecd48feca25cf3e9dcb201b7db59394

XML 1.0 document, Unicode text, UTF-8 text

Info.plist

2ce1f4e51fa77b406e969fbefa433f92

XML 1.0 document, Unicode text, UTF-8 text

.__CodeSignature

994a32df3afab92d75fbc8f8916da673

AppleDouble encoded Macintosh file

._MacOS

994a32df3afab92d75fbc8f8916da673

AppleDouble encoded Macintosh file

Info.plist

0640ba6b4da41815b235c95448dd6e13

XML 1.0 document, ASCII text

._Info.plist

e32b4d3719bbf768f28f348ccd929089

AppleDouble encoded Macintosh file

Info.plist

73e5832d6160e06e630898739cdcc61c

XML 1.0 document, Unicode text, UTF-8 text

Info.plist

0a1f61cfd449f87ea51a4eef802cd436

XML 1.0 document, Unicode text, UTF-8 text

Lilu

477b4ec8e828209eac07e593a22ee9c6

Mach-O 64-bit x86_64 kext bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>

HibernationFixup

a3f73f73725b96f78dee539e4a467fe7

Mach-O 64-bit x86_64 kext bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>

CodeResources

1cbab353c7b2834b87e2f87da81f5ce5

XML 1.0 document, ASCII text

._CodeResources

a081e0e4f637ae771914a0e01da0a39f

AppleDouble encoded Macintosh file

VoodooHDA

61c90dfe116693b473a6e2e4ed8ec015

Mach-O 64-bit x86_64 kext bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>

._VoodooHDA

994a32df3afab92d75fbc8f8916da673

AppleDouble encoded Macintosh file

NVMeFix

2da562cdd72fd00aa49bd878dda470e0

Mach-O 64-bit x86_64 kext bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>

VirtualSMC

28139490b74d1b4f3e2c4de648a5f72a

Mach-O 64-bit x86_64 kext bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	github.com/Ken5998/OpenCore-VMware-Workstation-AMD/releases/download/0.6.9/EFI.zip	140.82.121.3	302 Found	0 B
URL User Request GET HTTP/2 github.com/Ken5998/OpenCore-VMware-Workstation-AMD/releases/download/0.6.9/EFI.zip IP 140.82.121.3:443 ASN #36459 GITHUB Certificate IssuerSectigo Limited Subjectgithub.com FingerprintE7:03:5B:CC:1C:18:77:1F:79:2F:90:86:6B:6C:1D:F8:DF:AA:BD:C0 ValidityThu, 07 Mar 2024 00:00:00 GMT - Fri, 07 Mar 2025 23:59:59 GMT File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers GET /Ken5998/OpenCore-VMware-Workstation-AMD/releases/download/0.6.9/EFI.zip HTTP/1.1 Host: github.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 302 Found server: GitHub.com date: Fri, 29 Mar 2024 09:01:46 GMT content-type: text/html; charset=utf-8 vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/319084287/ac75ee00-b989-11eb-8151-29db6e34d831?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240329%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240329T090146Z&X-Amz-Expires=300&X-Amz-Signature=13844d08f59cbe598de11cffb5af0bac7e445ded3cd7973085f06d191721e971&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=319084287&response-content-disposition=attachment%3B%20filename%3DEFI.zip&response-content-type=application%2Foctet-stream cache-control: no-cache strict-transport-security: max-age=31536000; includeSubdomains; preload x-frame-options: deny x-content-type-options: nosniff x-xss-protection: 0 referrer-policy: no-referrer-when-downgrade content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/ content-length: 0 x-github-request-id: D000:2B65A4:2603F91:268511E:66068379 X-Firefox-Spdy: h2

	objects.githubusercontent.com/github-production-release-asset-2e65be/319084287/ac75ee00-b989-11eb-8151-29db6e34d831?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240329%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240329T090146Z&X-Amz-Expires=300&X-Amz-Signature=13844d08f59cbe598de11cffb5af0bac7e445ded3cd7973085f06d191721e971&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=319084287&response-content-disposition=attachment%3B%20filename%3DEFI.zip&response-content-type=application%2Foctet-stream	185.199.108.133	200 OK	1.2 MB
URL User Request GET HTTP/2 objects.githubusercontent.com/github-production-release-asset-2e65be/319084287/ac75ee00-b989-11eb-8151-29db6e34d831?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240329%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240329T090146Z&X-Amz-Expires=300&X-Amz-Signature=13844d08f59cbe598de11cffb5af0bac7e445ded3cd7973085f06d191721e971&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=319084287&response-content-disposition=attachment%3B%20filename%3DEFI.zip&response-content-type=application%2Foctet-stream IP 185.199.108.133:443 ASN #54113 FASTLY Certificate IssuerDigiCert Inc Subject.github.io Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28 ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=store Size 1.2 MB (1193489 bytes) Hash f5cf9aae966ae140f439c3ade87df0ac f8cc871904a7ef6f70605dd87bd073bc0669d834 4155a456809664ea218d91ebf95cfeb7fbeaf423f92e6ccd0795323dc716a8e5 HTTP Headers GET /github-production-release-asset-2e65be/319084287/ac75ee00-b989-11eb-8151-29db6e34d831?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240329%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240329T090146Z&X-Amz-Expires=300&X-Amz-Signature=13844d08f59cbe598de11cffb5af0bac7e445ded3cd7973085f06d191721e971&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=319084287&response-content-disposition=attachment%3B%20filename%3DEFI.zip&response-content-type=application%2Foctet-stream HTTP/1.1 Host: objects.githubusercontent.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 200 OK content-type: application/octet-stream content-md5: 9c+arpZq4UD0OcOt6H3wrA== last-modified: Tue, 07 Dec 2021 18:46:53 GMT etag: "0x8D9B9B1F02B45BD" server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 89dcf521-401e-003b-2ab2-81a4f1000000 x-ms-version: 2020-10-02 x-ms-creation-time: Tue, 17 Aug 2021 17:12:10 GMT x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob content-disposition: attachment; filename=EFI.zip x-ms-server-encrypted: true via: 1.1 varnish, 1.1 varnish accept-ranges: bytes date: Fri, 29 Mar 2024 09:01:46 GMT age: 0 x-served-by: cache-iad-kjyo7100114-IAD, cache-hel1410028-HEL x-cache: HIT, MISS x-cache-hits: 6, 0 x-timer: S1711702906.128142,VS0,VE504 content-length: 1193489 X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (67)

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers