Report - update.vibranium.co.in/nfr/nf10.zip

Report Overview

Visited public
2024-02-22 06:22:17
Tags
URL
update.vibranium.co.in/nfr/nf10.zip
Finishing URL
about:privatebrowsing
IP / ASN
104.21.54.138
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
update.vibranium.co.in	unknown	2021-06-02	2022-08-23 15:24:31	2024-02-21 00:22:46	678 B	5.6 MB	172.67.138.251
aus5.mozilla.org	2548	1998-01-24	2015-10-27 08:06:24	2024-02-21 18:12:22	511 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
update.vibranium.co.in/nfr/nf10.zip
IP
104.21.54.138
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
5.6 MB (5597250 bytes)
Hash
91ddffd083eb984a07b53c022fd01ceb
8b3aaa6ed3a555ca270ea01075acc658f6ec44db
01c9b768fd9db0962291afee8a8a1791a7b2c89b71668f66ce36ca6c548f7960

Archive (27)

Filename

Md5

File type

import_root_cert.exe

307c58a033b693ca03f44fb4a9a1482c

PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

LDll.dll

a0ccb94414a73caf12c0c31dc76aafff

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 7 sections

libcrypto-1_1.dll

37944ff014b60f81fb3b340e83f29802

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

libeay32.dll

4c765c124058752eda82b4fe5d30b2b7

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

libssl-1_1.dll

de228184bf43053907d32e8b17031ede

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

netdll.dll

b5f310f6fa38b9a2c068110845db3ca3

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

netfilter2.sys

ab41efb8daf5e35414c5ad24129472e3

PE32 executable (native) Intel 80386, for MS Windows, 6 sections

netfilter2_64.sys

61e7d4e5472c2c9f118e0664b29ab410

PE32+ executable (native) x86-64, for MS Windows, 6 sections

netfilter3.sys

888840b477d099d4b5b42a66038b81e0

PE32 executable (native) Intel 80386, for MS Windows, 6 sections

netfilter3_64.sys

376220a395a4edc854ed96f21ef69345

PE32+ executable (native) x86-64, for MS Windows, 7 sections

nfapi.dll

cfcd327aba6ab5c8fa3ed63578c3c2d4

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

ProtocolFilters.dll

d6db87121fc1bdad92db8b769ce5029a

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

signtool10.exe

304ac799839d7e6c374501ef982a677a

PE32+ executable (console) x86-64, for MS Windows, 6 sections

ssleay32.dll

1783d088f8a885313423238df35aeea4

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

certutil.exe

3337b8d5aab06d9072e3d4a72e0f9d26

PE32 executable (console) Intel 80386, for MS Windows, 4 sections

freebl3.dll

124ad66540633cb743122e2ea5d18c71

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

libnspr4.dll

c954b7e9d500badf4dd0a512a273f583

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

libplc4.dll

27b213629fc5b93c819ed03f17d027b5

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

libplds4.dll

556c4d654d05a291d144c05a1ff1cd3a

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

nss3.dll

86cbdc08307ec5a60d5dae63f1bf7f1d

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

nssckbi.dll

659f25dd0fc41f0d756386ab45fa426b

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

nssdbm3.dll

32dd3c576d236577e9f23ee4d016c467

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

nssutil3.dll

30e199190dcd45ba0d122fcd30c274be

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

smime3.dll

022b6fb51d33f9a076329d7a91b40620

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

softokn3.dll

485aa9dc1d332ef1a9dc31f19a526f82

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

sqlite3.dll

6ac28cf170907ba16b68bd39ee86bc29

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections

catnames.txt

9811c87a1d9487feed41df2b8704d767

Unicode text, UTF-8 text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
VirusTotal	suspicious	VirusTotal - Scan result 3/65

JavaScript (0)

HTTP Transactions (3)

URL IP Response Size

update.vibranium.co.in/

172.67.138.251

471 B

URL
update.vibranium.co.in/
IP
172.67.138.251:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with CRLF line terminators
Size
471 B (471 bytes)
Hash
64ceb94fc0e61d94570438e414ef1f68
47c3d6f3f40ead05f5dd735c33efb614a9fccb81
c59becd922dafd1a4199fa8c70461c8a1b0464eb2de43962354ca1bd2d4d7051

HTTP Headers

GET / HTTP/1.1
Host: update.vibranium.co.in
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 22 Feb 2024 06:21:52 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 24 Jun 2021 13:35:26 GMT
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dBRPA7AQYqckZPuWmbfGJ2KTmTsSjhLUdeg%2FkycAmcp4N5zcN4m%2FgDRRunUzBy6D%2BoQ4Zrk5pysZn694wfMkX2UNtdRQEewHN6288Huf6TwD%2BkQQIexfMrPvC7mlwUu8%2BgUz9NKd8eUT"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 859521a51f3f7127-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

update.vibranium.co.in/nfr/nf10.zip

104.21.54.138

200 OK

5.6 MB

URL User Request GET HTTP/1.1
update.vibranium.co.in/nfr/nf10.zip
IP
104.21.54.138:80
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
5.6 MB (5597250 bytes)
Hash
91ddffd083eb984a07b53c022fd01ceb
8b3aaa6ed3a555ca270ea01075acc658f6ec44db
01c9b768fd9db0962291afee8a8a1791a7b2c89b71668f66ce36ca6c548f7960

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 3/65

HTTP Headers

GET /nfr/nf10.zip HTTP/1.1
Host: update.vibranium.co.in
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 22 Feb 2024 06:21:53 GMT
Content-Type: application/x-zip-compressed
Content-Length: 5597250
Connection: keep-alive
Last-Modified: Fri, 04 Feb 2022 12:00:33 GMT
ETag: "5e884ed0be19d81:0"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0qluZIJ%2FqaQadTU54CRhclQ%2FJoqZzdysPcUB8533iJ2yaB6AUDnyzQXyEFuhogAMLK4lR2Y6hrpThL3t6Nmob4b3MnSf2Vfs4Jg0kq4fv8gcQScyeL3iy3WS1BuyPmeYKKZ5TaeNBdPy"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 859521a8afaf5688-OSL
alt-svc: h2=":443"; ma=60

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL
aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml
IP
35.244.181.201:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
XML 1.0 document, ASCII text, with very long lines (332)
Size
444 B (444 bytes)
Hash
3b324dec137a87ef7e24a30a65b13dd0
c0faa95b2f1018e264b3a14aaf50d1003e6c27b3
6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-04-09-14-36-40.chain; p384ecdsa=m5uUnqtTs79WpmsujMZFji_sUdtQ9dRCFNdRsJuI2IksBiRcvDA2-ee2uCi8vuhDbC-pCX4NHN9GpwklVWwTkBPFDn_fHlFlbjl9I_On_ZMsHv_MUt2l5BHYoC1DJo_h
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Thu, 22 Feb 2024 06:20:29 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 99
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (27)

Detections

JavaScript (0)

HTTP Transactions (3)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers