Report - ftp6.nero.com/tools/NeroFirstAidKit.zip

Report Overview

Visited public
2024-07-21 15:16:20
Tags
URL
ftp6.nero.com/tools/NeroFirstAidKit.zip
Finishing URL
about:privatebrowsing
IP / ASN
193.24.239.233
#31276 Die Netz-Werker Systemmanagement und Datennetze AG
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-20 18:12:19	2.3 kB	6.2 kB	23.36.77.32
ftp6.nero.com	unknown	1997-11-04	2012-06-26 21:02:47	2024-03-19 16:28:31	493 B	2.5 MB	193.24.239.233

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
ftp6.nero.com/tools/NeroFirstAidKit.zip
IP
193.24.239.233
ASN
#31276 Die Netz-Werker Systemmanagement und Datennetze AG

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
2.5 MB (2484187 bytes)
Hash
8a3f90d5037b0552cec795b23a653cfd
4405c2a5a1079fba50c1f9aa8485614ac1142876
57b8e63ebe720ccd46c210b8dc9066206faa1a95053a8f01f0fbafbcc750ee71

Archive (1)

Filename

Md5

File type

FirstAidKit.exe

32a2dfd926c3dfed7d5c2d4f96867d99

PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (8)

	URL	IP	Response	Size
	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 3bd6a6d19bf0ab70e4e0cd3d2833afe1 0dd2ee68cf939d2482a9b30bf767f412eb97e492 23c60c02f8a6f1f7fe01f9f4661cf04a03c046522201927dfa7c51ceba6c5449 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "23C60C02F8A6F1F7FE01F9F4661CF04A03C046522201927DFA7C51CEBA6C5449" Last-Modified: Sat, 20 Jul 2024 20:21:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10122 Expires: Sun, 21 Jul 2024 18:04:32 GMT Date: Sun, 21 Jul 2024 15:15:50 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 2f796f6340ac7eef4fa2891ac8f8aa1a 27bbc7bb6314b31dcab89f198bc258b040593aa7 778d02decabf7dff03bf5ec4c4eb0f03ac789e89bcfe58353c266c9d66c08834 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "778D02DECABF7DFF03BF5EC4C4EB0F03AC789E89BCFE58353C266C9D66C08834" Last-Modified: Sat, 20 Jul 2024 19:16:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=13462 Expires: Sun, 21 Jul 2024 19:00:12 GMT Date: Sun, 21 Jul 2024 15:15:50 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash cf41dddde2cb04d4f8b233b01318bde1 f7f9259cebf98c255ea506e7d7f0170c1e6a9604 90a7510dc4acc5716c9a82e10dcbb6074af14f502e3847f8b6c43caef244ca12 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "90A7510DC4ACC5716C9A82E10DCBB6074AF14F502E3847F8B6C43CAEF244CA12" Last-Modified: Sat, 20 Jul 2024 20:19:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3296 Expires: Sun, 21 Jul 2024 16:10:46 GMT Date: Sun, 21 Jul 2024 15:15:50 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 41b470cfcb4d809b7689783076e07c76 919b05dba2523cc4b8e9a6e873fe777fd753ee1b 951ae19e1eb066355bf55ff2163f6d14b689088fa3dd443fb01d889bb28fe095 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "951AE19E1EB066355BF55FF2163F6D14B689088FA3DD443FB01D889BB28FE095" Last-Modified: Sat, 20 Jul 2024 19:16:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12160 Expires: Sun, 21 Jul 2024 18:38:30 GMT Date: Sun, 21 Jul 2024 15:15:50 GMT Connection: keep-alive`

	ftp6.nero.com/tools/NeroFirstAidKit.zip	193.24.239.233	200 OK	2.5 MB
URL User Request GET HTTP/1.1 ftp6.nero.com/tools/NeroFirstAidKit.zip IP 193.24.239.233:443 ASN #31276 Die Netz-Werker Systemmanagement und Datennetze AG Certificate IssuerGlobalSign nv-sa Subject.nero.com Fingerprint49:11:81:30:88:D1:58:49:1C:40:D9:34:D7:47:F4:C3:47:7C:10:F0 ValidityWed, 15 Nov 2023 12:39:43 GMT - Mon, 16 Dec 2024 12:39:42 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 2.5 MB (2484187 bytes) Hash 8a3f90d5037b0552cec795b23a653cfd 4405c2a5a1079fba50c1f9aa8485614ac1142876 57b8e63ebe720ccd46c210b8dc9066206faa1a95053a8f01f0fbafbcc750ee71 HTTP Headers `GET /tools/NeroFirstAidKit.zip HTTP/1.1 Host: ftp6.nero.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Sun, 21 Jul 2024 15:15:51 GMT Server: Apache/2.4.61 (Debian) Last-Modified: Mon, 21 Sep 2020 07:15:45 GMT ETag: "25e7db-5afcd9e79c33b" Accept-Ranges: bytes Content-Length: 2484187 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/zip`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash abdbb83f974102baaaa6f77ee331d442 053c22e9dce284413f8a2d4433748edbdd91b77b 23a21016e52b76d94858b277e1a729969fc7f0f66b9212013f3b1cd64fc2591c HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "23A21016E52B76D94858B277E1A729969FC7F0F66B9212013F3B1CD64FC2591C" Last-Modified: Sat, 20 Jul 2024 19:17:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=11983 Expires: Sun, 21 Jul 2024 18:35:35 GMT Date: Sun, 21 Jul 2024 15:15:52 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash abdbb83f974102baaaa6f77ee331d442 053c22e9dce284413f8a2d4433748edbdd91b77b 23a21016e52b76d94858b277e1a729969fc7f0f66b9212013f3b1cd64fc2591c HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "23A21016E52B76D94858B277E1A729969FC7F0F66B9212013F3B1CD64FC2591C" Last-Modified: Sat, 20 Jul 2024 19:17:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=11983 Expires: Sun, 21 Jul 2024 18:35:35 GMT Date: Sun, 21 Jul 2024 15:15:52 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash abdbb83f974102baaaa6f77ee331d442 053c22e9dce284413f8a2d4433748edbdd91b77b 23a21016e52b76d94858b277e1a729969fc7f0f66b9212013f3b1cd64fc2591c HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "23A21016E52B76D94858B277E1A729969FC7F0F66B9212013F3B1CD64FC2591C" Last-Modified: Sat, 20 Jul 2024 19:17:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=11983 Expires: Sun, 21 Jul 2024 18:35:35 GMT Date: Sun, 21 Jul 2024 15:15:52 GMT Connection: keep-alive`

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (1)

Detections

JavaScript (0)

HTTP Transactions (8)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers