Report - www.ifx4crypto.org/downloads/itc4setup.exe?v=170425

Report Overview

Visitedpublic

2024-03-13 01:30:24

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
www.ifx4crypto.org	unknown	2021-05-25	2021-06-03 09:32:46	2024-03-11 11:45:54	505 B	3.4 MB	195.201.188.46
aus5.mozilla.org	2548	1998-01-24	2015-10-27 08:06:24	2024-03-12 05:11:03	511 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

www.ifx4crypto.org/downloads/itc4setup.exe?v=170425

IP / ASN

195.201.188.46

#24940 Hetzner Online GmbH

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

Size3.4 MB (3427552 bytes)

MD5ff4143f33e730af40f9d5c9e2deb73c9

SHA15d86da9616c21eb5faf021ae31c94186fbe69edd

SHA256c1844c598136662cc9a4f3f742336e0ca66601fbd1039d7cb19f045448d0c1a0

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 3/73

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET www.ifx4crypto.org/downloads/itc4setup.exe?v=170425

195.201.188.46

200 OK

3.4 MB

URL User Request GET HTTPS

www.ifx4crypto.org/downloads/itc4setup.exe?v=170425

IP / ASN

195.201.188.46

#24940 Hetzner Online GmbH

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

First Seen2023-06-01

Last Seen2025-05-09

Times Seen430

Size3.4 MB (3427552 bytes)

MD5ff4143f33e730af40f9d5c9e2deb73c9

SHA15d86da9616c21eb5faf021ae31c94186fbe69edd

SHA256c1844c598136662cc9a4f3f742336e0ca66601fbd1039d7cb19f045448d0c1a0

Certificate Info

IssuerLet's Encrypt

Subjectifx4crypto.org

FingerprintA8:33:FC:46:0F:AD:54:60:71:62:0A:2D:2C:17:44:33:E3:6A:17:D5

ValidityFri, 19 Jan 2024 11:57:52 GMT - Thu, 18 Apr 2024 11:57:51 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 3/73

HTTP Headers

GET /downloads/itc4setup.exe?v=170425 HTTP/1.1
Host: www.ifx4crypto.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 13 Mar 2024 01:29:58 GMT
content-type: application/octet-stream
content-length: 3427552
last-modified: Fri, 07 Oct 2022 07:58:30 GMT
etag: "344ce0-5ea6d2cf9cf3f"
accept-ranges: bytes
expires: Wed, 13 Mar 2024 01:29:57 GMT
cache-control: no-cache
strict-transport-security: max-age=31536000;
X-Firefox-Spdy: h2

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-97-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL HTTP

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-97-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

IP / ASN

35.244.181.201

#396982 GOOGLE-CLOUD-PLATFORM

Requested byN/A

Resource Info

File typeXML 1.0 document, ASCII text, with very long lines (332)

First Seen2023-10-13

Last Seen2025-06-20

Times Seen185315

Size444 B (444 bytes)

MD53b324dec137a87ef7e24a30a65b13dd0

SHA1c0faa95b2f1018e264b3a14aaf50d1003e6c27b3

SHA2566cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-97-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-04-29-22-13-57.chain; p384ecdsa=DpoXrATUwporOMuLQ6PBrpf6OhCtzX4QTfxQuxxgIs30Y9Nbp_boQ071Ms9tkBMVNOYSwKbHWseVT3AHyO6kO6AC_gz7kGLm_q1iXEuA-PjCazClTosPyUGQxybNOaby
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Wed, 13 Mar 2024 01:29:07 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 70
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2