Report - download.plop.at/files/rawwritewin.exe

Report Overview

Visitedpublic

2025-04-24 17:29:00

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
download.plop.at	unknown	unknown	2014-10-07	2025-04-20	506 B	379 kB	46.4.35.177

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-04-24	medium	download.plop.at/files/rawwritewin.exe	Scans presence of the found strings using the in-house brute force method

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

download.plop.at/files/rawwritewin.exe

IP / ASN

46.4.35.177

#24940 Hetzner Online GmbH

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

Size378 kB (378368 bytes)

MD5d0c11064de7fd59954d1b1e7c37dd9c1

SHA155daae9c477f684b29a6083fb192c21dbaeab30e

SHA256efd5ba117f352df7e2e3e664a3bd441d3dc80619593a91cf9fec04303755c2cc

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Scans presence of the found strings using the in-house brute force method

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET download.plop.at/files/rawwritewin.exe

46.4.35.177

200 OK

378 kB

URL

download.plop.at/files/rawwritewin.exe

IP / ASN

46.4.35.177

#24940 Hetzner Online GmbH

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

First Seen2023-06-18

Last Seen2025-08-01

Times Seen305

Size378 kB (378368 bytes)

MD5d0c11064de7fd59954d1b1e7c37dd9c1

SHA155daae9c477f684b29a6083fb192c21dbaeab30e

SHA256efd5ba117f352df7e2e3e664a3bd441d3dc80619593a91cf9fec04303755c2cc

Certificate Info

IssuerLet's Encrypt

Subjectwww.plop.at

Fingerprint56:42:6F:EE:E3:38:88:28:08:EF:BC:9E:3A:93:A9:4D:48:FF:89:BD

ValidityTue, 01 Apr 2025 10:04:10 GMT - Mon, 30 Jun 2025 10:04:09 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Scans presence of the found strings using the in-house brute force method

HTTP Headers

GET /files/rawwritewin.exe HTTP/1.1
Host: download.plop.at
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 24 Apr 2025 17:28:26 GMT
Server: Apache
Last-Modified: Sun, 02 Jan 2000 17:16:18 GMT
ETag: "5c600-35d23d3283c80"
Accept-Ranges: bytes
Content-Length: 378368
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-msdownload