Report - files.brasilsofts.com/licenses/autocadcivil3d/bs

Report Overview

Visitedpublic

2025-04-30 02:42:55

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
files.brasilsofts.com	unknown	2021-11-11	2025-04-28	2025-04-28	526 B	9.8 MB	188.114.96.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

files.brasilsofts.com/licenses/autocadcivil3d/bs_civil.zip

IP / ASN

188.114.96.1

#13335 CLOUDFLARENET

File Overview

File TypeZip archive data, at least v2.0 to extract, compression method=deflate

Size9.8 MB (9799888 bytes)

MD5b71f1a2620cfbfc208c5d47b6e6e7bb6

SHA1e71a32a86272673bb81a7abf815d36ffc48ee190

SHA256704180cdea5a8f5242127540b5eebc8414b641611756b07d61744cdb3baee934

Archive (7)

Modified	Filename	Size	MD5	File type
2023-11-14 14:06	nlm11-19-4-1-ipv4-ipv6-win64.msi	8.6 MB	bbd4394d0c1d30fbf9ad4715ff217821	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Autodesk Network License Manager, Author: Autodesk, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install Autodesk Network License Manager., Template: x64;1033, Revision Number: {BBE89B55-0FAB-4F58-8D36-D2C58562A06F}, Create Time/Date: Tue Sep 12 08:54:40 2023, Last Saved Time/Date: Tue Sep 12 08:54:40 2023, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
2023-11-14 11:10	adskflex.exe	2.9 MB	e974687b0135a662623056078a8e58e1	PE32+ executable (console) x86-64, for MS Windows, 8 sections
2025-01-17 01:51	License.lic	261 kB	5d084d2eb8545feeb03487da52804c3e	ASCII text, with very long lines (473), with CRLF line terminators
2023-09-11 23:50	lmgrd.exe	1.4 MB	5511d5d99c5b8d7c5147be9c0b4b9ba6	PE32+ executable (console) x86-64, for MS Windows, 9 sections
2023-09-11 23:50	lmtools.exe	1.6 MB	58c91376ac43ef1e60a339c794132932	PE32+ executable (GUI) x86-64, for MS Windows, 9 sections
2023-09-11 23:50	lmutil.exe	1.4 MB	795074805b95913a8edb4e7dcdd58715	PE32+ executable (console) x86-64, for MS Windows, 9 sections
2020-10-07 15:52	netapi32.dll	131 kB	5c51cc926c76b23830d27a97445bf734	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows, 11 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware
VirusTotal	suspicious	VirusTotal - Scan result 4/68

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET files.brasilsofts.com/licenses/autocadcivil3d/bs_civil.zip

188.114.96.1

200 OK

9.8 MB

URL

files.brasilsofts.com/licenses/autocadcivil3d/bs_civil.zip

IP / ASN

188.114.96.1

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeZip archive data, at least v2.0 to extract, compression method=deflate

First Seen2025-04-30

Last Seen2025-04-30

Times Seen1

Size9.8 MB (9799888 bytes)

MD5b71f1a2620cfbfc208c5d47b6e6e7bb6

SHA1e71a32a86272673bb81a7abf815d36ffc48ee190

SHA256704180cdea5a8f5242127540b5eebc8414b641611756b07d61744cdb3baee934

Certificate Info

IssuerGoogle Trust Services

Subjectbrasilsofts.com

FingerprintA3:E8:C9:EA:5D:77:22:B0:51:AD:2E:DE:4C:02:FC:0B:61:B0:54:7C

ValidityWed, 23 Apr 2025 16:15:43 GMT - Tue, 22 Jul 2025 17:13:09 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 4/68

HTTP Headers

GET /licenses/autocadcivil3d/bs_civil.zip HTTP/1.1
Host: files.brasilsofts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 30 Apr 2025 02:42:20 GMT
content-type: application/zip
content-length: 9799888
cache-control: public, max-age=31536000
expires: Thu, 29 May 2025 11:57:47 GMT
last-modified: Fri, 17 Jan 2025 04:56:32 GMT
accept-ranges: bytes
vary: User-Agent,Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ObUZr4EZlTWpsaqBhspw560YztVARGyIu5QqkPENp3MGNdd52corzn33xiIuL1jqPzH6wcaG43LfVj53UcSqQ2eNaxBmBVeus9tDcNtkQ4TciD7qrVJibE5Vd5rDXD%2BNpbtnHeAr%2BfU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 9383af6db9345697-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfCacheStatus;desc="HIT", cfL4;desc="?proto=TCP&rtt=8541&min_rtt=632&rtt_var=11519&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3284&recv_bytes=1288&delivery_rate=2291139&cwnd=254&unsent_bytes=0&cid=906aaa218b3b2d96&ts=265&x=0"
X-Firefox-Spdy: h2