Report - www.aniva-ltd.ru/vds_clients/imb/vs_ki

Report Overview

Submitted URL
www.aniva-ltd.ru/vds_clients/imb/vs_ki_rutdf.zip
IP
213.189.197.203
ASN
#6903 Rusonyx, Ltd.
Submitted
2024-04-17 07:24:18
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.aniva-ltd.ru	unknown	2006-08-03	2015-03-21	2023-12-30	685 B	595 kB	213.189.197.203

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.aniva-ltd.ru/vds_clients/imb/vs_ki_rutdf.zip
IP
213.189.197.203
ASN
#6903 Rusonyx, Ltd.

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
591 kB (590812 bytes)
Hash
b566f33963b0ffd83c1075815db656b1
4b5bcfee49e8645ddfced351d76d1cdd809f41c1
29e5cdf9c37133862c1e56abec3477c08583ead180c9b294c2d9fb42d324381c

Archive (6)

Filename

Md5

File type

RUTDF.ini

23267c4e748d5b74cbe562458802758e

Generic INItialization configuration [RUTDF]

ListClientQBCH.xls

4f0e8a8df30b0e3c1bd93c07548295c1

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Last Saved By: A, Last Saved Time/Date: Thu Mar 16 10:37:48 2023, Security: 0

Code.txt

b139b878a2326d0bdc58a7c01dcb4732

ISO-8859 text, with CRLF line terminators

list.xml

4b5ca7eb3f561c5acbe3339b943e0dae

XML 1.0 document, Non-ISO extended-ASCII text, with CRLF line terminators

RUTDF30.xml

f01fd093c27dd22835f445baec17d840

XML 1.0 document, Non-ISO extended-ASCII text, with very long lines (972), with CRLF line terminators

vs_ki_rutdf.dll

a751a5568fbfe421d3d891cb27304dd7

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 7 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Size
	www.aniva-ltd.ru/	213.189.197.203	3.5 kB
URL www.aniva-ltd.ru/ IP 213.189.197.203:0 ASN #6903 Rusonyx, Ltd. File type HTML document, ISO-8859 text Size 3.5 kB (3520 bytes) Hash 2c5213080cda96341a1392840ca40bd1 74446e5d0590332bfed56d7e4914aee49aa58016 541bd631ef88bd02aadc88197b3a7a0cfb92046b3969f0998ff3199d632ed0fb HTTP Headers `GET / HTTP/1.1 Host: www.aniva-ltd.ru User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Date: Wed, 17 Apr 2024 07:23:55 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 3520 Connection: keep-alive Last-Modified: Wed, 03 Apr 2024 04:15:11 GMT ETag: "34ac396-dc0-660cd7cf" Accept-Ranges: bytes Content-Language: ru`

	www.aniva-ltd.ru/vds_clients/imb/vs_ki_rutdf.zip	213.189.197.203	591 kB
URL User Request GET www.aniva-ltd.ru/vds_clients/imb/vs_ki_rutdf.zip IP 213.189.197.203:0 ASN #6903 Rusonyx, Ltd. File type Zip archive data, at least v1.0 to extract, compression method=store Size 591 kB (590812 bytes) Hash b566f33963b0ffd83c1075815db656b1 4b5bcfee49e8645ddfced351d76d1cdd809f41c1 29e5cdf9c37133862c1e56abec3477c08583ead180c9b294c2d9fb42d324381c HTTP Headers `GET /vds_clients/imb/vs_ki_rutdf.zip HTTP/1.1 Host: www.aniva-ltd.ru User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Date: Wed, 17 Apr 2024 07:23:55 GMT Content-Type: application/zip Content-Length: 590812 Connection: keep-alive Last-Modified: Wed, 03 Apr 2024 18:39:16 GMT ETag: "34ac755-903dc-660da254" Accept-Ranges: bytes`

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (6)

Detections

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET

IP

ASN

File type

Size

Hash

HTTP Headers