Report - www.qslonline.de/hk/download/hamfunktag.zip

Report Overview

Visitedpublic

2024-11-03 21:40:00

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
www.qslonline.de	unknown	unknown	2018-11-09	2024-11-03	497 B	8.0 MB	192.124.249.90

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Mnemonic Secure DNS

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

www.qslonline.de/hk/download/hamfunktag.zip

IP / ASN

192.124.249.90

#30148 SUCURI-SEC

File Overview

File TypeZip archive data, at least v2.0 to extract, compression method=deflate

Size8.0 MB (8019410 bytes)

MD5194cfec36b57958535b2c888f144b4c9

SHA1e3391cff28d60c165864c136b8cadf8cd47d421f

SHA25695b6a07a7f376c3e4d32f368f926eae93ea9e837a3dca9ee454171e888f50294

Archive (8)

Modified	Filename	Size	MD5	File type
2009-10-05 15:28	HAMCONT.HLP	15 kB	18cf36d5f2839f1944fff535c9fc6d32	MS Windows 3.1 help, Mon Oct 5 13:28:53 2009, 15329 bytes
2009-10-05 15:30	hamcont.doc	34 kB	80c091310f24e150e29a7947df4f8d37	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Title: bersicht, Author: DM2FDO, Template: Normal.dot, Last Saved By: Internet, Revision Number: 10, Name of Creating Application: Microsoft Word 9.0, Create Time/Date: Thu Sep 19 15:46:00 2002, Last Saved Time/Date: Mon Oct 5 13:30:00 2009, Number of Pages: 1, Number of Words: 1062, Number of Characters: 6056, Security: 0
2003-04-02 18:15	hamcont.cnt	307 B	c8010571fae5ad314eaa90dc3714121f	MS Windows help file Content, based "hamcont.hlp", ISO-8859 text, with CRLF line terminators
2020-05-16 14:55	borlndmm.dll	73 kB	4553fc3048f2088bb2ae609a6c68645f	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 10 sections
2009-10-05 17:21	hamcont.chm	16 kB	4cdf959c2bbcf7976149ce142d933acc	MS Windows HtmlHelp Data
2020-10-29 15:18	daten.db	1.6 MB	5c20d40fafa9fc7fe98589bfb6b2dcc7	SQLite 3.x database, last written using SQLite version 3008006, file counter 88, database pages 383, cookie 0x4c, schema 4, UTF-8, version-valid-for 88
2016-02-17 09:00	DelZip192.dll	319 kB	8cae54ab7086ae3a186dfaf5583c6159	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, 7 sections
2022-08-25 16:18	hamfunktagkassel.exe	17 MB	f15063efaee2d076855131cddba19c7a	PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	pe_detect_tls_callbacks
VirusTotal	suspicious	VirusTotal - Scan result 2/65

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET www.qslonline.de/hk/download/hamfunktag.zip

192.124.249.90

200 OK

8.0 MB

URL

www.qslonline.de/hk/download/hamfunktag.zip

IP / ASN

192.124.249.90

#30148 SUCURI-SEC

Requested byN/A

Resource Info

File typeZip archive data, at least v2.0 to extract, compression method=deflate

First Seen2024-11-03

Last Seen2024-11-03

Times Seen2

Size8.0 MB (8019410 bytes)

MD5194cfec36b57958535b2c888f144b4c9

SHA1e3391cff28d60c165864c136b8cadf8cd47d421f

SHA25695b6a07a7f376c3e4d32f368f926eae93ea9e837a3dca9ee454171e888f50294

Certificate Info

IssuerStarfield Technologies, Inc.

Subjectqslonline.de

Fingerprint3A:40:5E:60:C0:1E:14:74:EB:97:98:2A:9F:3C:94:0D:42:A0:94:E9

ValidityFri, 16 Aug 2024 14:44:49 GMT - Sat, 16 Aug 2025 14:44:49 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 2/65

HTTP Headers

GET /hk/download/hamfunktag.zip HTTP/1.1
Host: www.qslonline.de
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Sun, 03 Nov 2024 21:39:30 GMT
content-type: application/zip
content-length: 8019410
x-sucuri-id: 19040
last-modified: Thu, 25 Aug 2022 14:18:59 GMT
etag: "7a5dd2-5e7117a7c9ac0"
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-sucuri-cache: MISS
X-Firefox-Spdy: h2