Report - cdnb.p30download.ir/p30dl-software/KMPlayer.v2024.11.18.12.x64

Report Overview

Visitedpublic

2024-12-06 12:12:31

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
cdnb.p30download.ir	unknown	unknown	2024-10-29	2024-12-01	536 B	48 MB	5.144.134.5
aus5.mozilla.org	2548	1998-01-24	2015-10-27	2024-12-04	512 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

cdnb.p30download.ir/p30dl-software/KMPlayer.v2024.11.18.12.x64_p30download.com.exe

IP / ASN

5.144.134.5

#59441 NOAVARAN SHABAKEH SABZ MEHREGAN (Ltd.)

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

Size48 MB (48313600 bytes)

MD52aee07b3259faa496b3c8e0ff6a4b92d

SHA129efe5a22573c47b5ed5ab8e7d5ccc869987fb4d

SHA25672dd135c3a0e695fa97d37dce94cc1da8edb90ffe8c0196b67bacbbce4f8bf54

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 3/69

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET cdnb.p30download.ir/p30dl-software/KMPlayer.v2024.11.18.12.x64_p30download.com.exe

5.144.134.5

200 OK

48 MB

URL

cdnb.p30download.ir/p30dl-software/KMPlayer.v2024.11.18.12.x64_p30download.com.exe

IP / ASN

5.144.134.5

#59441 NOAVARAN SHABAKEH SABZ MEHREGAN (Ltd.)

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

First Seen2024-11-19

Last Seen2024-12-06

Times Seen5

Size48 MB (48313600 bytes)

MD52aee07b3259faa496b3c8e0ff6a4b92d

SHA129efe5a22573c47b5ed5ab8e7d5ccc869987fb4d

SHA25672dd135c3a0e695fa97d37dce94cc1da8edb90ffe8c0196b67bacbbce4f8bf54

Certificate Info

IssuerUnizeto Technologies S.A.

Subject*.p30download.ir

Fingerprint97:C1:FC:B2:CD:85:BA:ED:41:88:80:DB:33:11:7F:85:83:C1:51:F4

ValidityTue, 27 Feb 2024 09:20:37 GMT - Wed, 26 Feb 2025 09:20:36 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 3/69

HTTP Headers

GET /p30dl-software/KMPlayer.v2024.11.18.12.x64_p30download.com.exe HTTP/1.1
Host: cdnb.p30download.ir
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=2678400, public, must-revalidate, proxy-revalidate
content-type: application/octet-stream
date: Fri, 06 Dec 2024 20:42:06 GMT
expires: Mon, 6 Jan 2025 20:42:06 UTC
last-modified: Tue, 19 Nov 2024 14:07:32 GMT
content-length: 48313600
X-Firefox-Spdy: h2

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

200 OK

444 B

URL

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

IP / ASN

35.244.181.201

#396982 GOOGLE-CLOUD-PLATFORM

Requested byN/A

Resource Info

File typeXML 1.0 document, ASCII text, with very long lines (332)

First Seen2023-10-13

Last Seen2025-06-20

Times Seen185315

Size444 B (444 bytes)

MD53b324dec137a87ef7e24a30a65b13dd0

SHA1c0faa95b2f1018e264b3a14aaf50d1003e6c27b3

SHA2566cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/202402/aus.content-signature.mozilla.org-2025-01-22-11-21-23.chain; p384ecdsa=xTJ75C1L1X41fUgDiDvwajZR2ZeF_AVV9lCM9cvfrUyG_VfD_Ld0pN1suVJ9leRn0BeHm9UO06fuLFmpsgTyplFr6fg1Q3QpOxW9wILUpULlmy-EEaH_BiXxMHr6jCGk
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: MISS
content-encoding: gzip
via: 1.1 google
date: Fri, 06 Dec 2024 12:11:40 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 45
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2