Report - www.rfidfans.com/app/gw/update.zip

Report Overview

Visited public
2025-05-02 06:49:36
Tags
URL
www.rfidfans.com/app/gw/update.zip
Finishing URL
about:privatebrowsing
IP / ASN
60.220.179.43
#4837 CHINA UNICOM China169 Backbone
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.rfidfans.com	unknown	2020-11-28	2021-09-14	2025-02-21	502 B	12 MB	116.142.249.98

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.rfidfans.com/app/gw/update.zip
IP
116.142.249.98
ASN
#4837 CHINA UNICOM China169 Backbone

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
12 MB (11925883 bytes)
Hash
f37b871d71420c4aa2daf6734e51a409
fd199c69a3ccb05dd46cfa048b2d2af70b417831
2d69f6169b4877aa12ad79cc75074dc508b355c86cbe4601dd085c6f2e77d2d1

Archive (63)

Filename

Md5

File type

Chinese.txt

b4f5df149fca04a1723854f190a3424a

Unicode text, UTF-8 text

Dutch.txt

14954ce90fe4e4c5f7f6cbb847c785c0

ASCII text, with CRLF line terminators

English.txt

899ed515b6c41a2ed3cf36b88eb260d8

ASCII text

Francais.txt

a46b795ceb5a6546ad7392e7d0297eb3

Unicode text, UTF-8 text

Franxais.txt

a46b795ceb5a6546ad7392e7d0297eb3

Unicode text, UTF-8 text

German.txt

bb198e5b6cb7cc7cd49e4ced130874e7

Unicode text, UTF-8 text, with CRLF line terminators

Greek.txt

9c7ec2425a12e9c5157739e733148dce

Unicode text, UTF-8 text

Italiano.txt

2b6f1feaccf751ef95500720624d98d7

Unicode text, UTF-8 text

languages.la

e2cc47dc5f4bcd133a71bb5a79419f8e

Unicode text, UTF-8 text, with very long lines (3716), with CRLF line terminators

Spanish.txt

c1b257c210b55d428468e7a051c92b1f

Unicode text, UTF-8 (with BOM) text

Svenska.txt

2c6cc077271fd70104c6229d1df43325

Unicode text, UTF-8 text

blankq.db

f7ceeb63e9db26611f4e7b5e722563b9

data

libcom.dll

bedfff9a8296392992a458d03ba69e08

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

libnfc.dll

fcbdca4dc480b1d5d5474b18b5c79979

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 18 sections

libnfc0.dll

a77d0cf15758556d18c0ba0f7aa9cf94

Unicode text, UTF-8 text

libnfc11.dll

3513a766c4b5e756b8bd4f5a9e13267e

Unicode text, UTF-8 text, with CRLF line terminators

libnfc_hardnested.exe

42930a2bc658fd0a9a97de09965478b7

PE32 executable (console) Intel 80386, for MS Windows, 15 sections

libusb6.dll

1d8215f7f8cd02a553499b534ccfb4d5

PE32+ executable (DLL) (console) x86-64, for MS Windows, 5 sections

mfcuk.exe

c4898632a6aa5a1e82054d84587c2fe9

PE32 executable (console) Intel 80386, for MS Windows, 7 sections

mfoc.exe

20c1ff3203a1fd42bc49d5504b481e30

PE32 executable (console) Intel 80386, for MS Windows, 7 sections

mfocx64.exe

b41a805b29f1d0aea517fe5c7783e44a

PE32+ executable (console) x86-64, for MS Windows, 7 sections

nfc-mfsetuid.exe

c527e2073d596fc99f5ada8f92903130

PE32 executable (console) Intel 80386, for MS Windows, 7 sections

nfc.dll

80778c8efa46d42efb398776e90f24ee

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 7 sections

nfcemulatetag.exe

8e6876730ec52340403ea80b71762f1a

PE32 executable (console) Intel 80386, for MS Windows, 7 sections

nfctag.exe

c3af3e28ed4a369861a79d67e226c3b7

PE32 executable (console) Intel 80386, for MS Windows, 7 sections

nfd.dll

af9df826fb085012f8d3d71c01991b80

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

nlist.exe

725d259ba5cad7056703d508210cd8c9

PE32 executable (console) Intel 80386, for MS Windows, 7 sections

pthreadVC2.dll

7812f0f73eda837e9353b3a433abc9a9

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

libnfc.dll

b8a4ffdea1128cfc9f907783939768e6

ASCII text, with no line terminators

mfcuk_tmpl_oyster.mfd

9f62d968ba9f9555ab015d956b3b4220

data

mfcuk_tmpl_ratb.mfd

286326eb129608ac621269976aba816c

data

mfcuk_tmpl_skgt.mfd

6b0fe7676b68e5b08b06ab53cac38676

data

trace1.txt

c85d21cd244dd2e63d5b64e8d0b06f84

ASCII text, with CRLF line terminators

trace2.txt

b716f1fc636a0dfcf90c39c12fb69e79

ASCII text, with CRLF line terminators

trace3.txt

93e59e02a8a39d329e61f772eaf49d07

ASCII text, with CRLF line terminators

update.zip

f0cef2f96d6043de89e723082f5683f6

HTML document, ASCII text, with very long lines (1836)

NfcKing.resources.dll

a330f9fe98d62403d7f7408355d64df6

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

iClass-Black.txt

26dff97f8305d50b755d32d61259c44b

Unicode text, UTF-8 (with BOM) text

MIfare-S20-320b-Black.txt

bf8b3bdf35cf7a121cf99fddc7f5984c

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

MIfare-S20-320b.txt

34d0770bcdd84a03eef753d94db73657

Unicode text, UTF-8 (with BOM) text

MIfare-S50-1k-Black.txt

cb06cb7f6afee00bcdbb1871492be4f1

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

MIfare-S50-1k.txt

b54a6c9642aa668ba1e1383273ebcdc0

Unicode text, UTF-8 (with BOM) text

Ultralight-EV1-164B-Black.txt

2b5343ab1b756abe287cfa1e846cfebb

ASCII text, with CRLF line terminators

Ultralight-EV1-164B.txt

9eda333fb47eb07f4e38e653814a4318

ASCII text

NfcKing.resources.dll

2429d7eea11c0ce709ff5a91367ba527

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Be.Windows.Forms.HexBox.dll

7a6a1deafc87dda48858f80b3c3eec0f

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

ChameleonMiniGUI.exe

b0380e0a549e1212e53bac7a45107988

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

ChameleonMiniGUI.exe.config

21893023c4029d62fd41528922e21dee

XML 1.0 document, ASCII text, with CRLF line terminators

Crapto1Sharp.dll

c8903d18a45ab817d572b6b2cf426084

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

DynamicExpresso.Core.dll

8634d7e93d203b7df8dbfcc450a30819

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Map.xml

ecaa88f7fa0bf610a5a26cf545dcd3aa

Unicode text, UTF-8 text, with no line terminators

msvcr100.dll

53e17c3eedcb0479971fbbe99fa9c0a0

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections

NfcKing.exe

65f9384d65d9f06ff4d673eceb28ddf8

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Ntool.exe

7e55ce880a3048ee74530b1596179c02

PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections

PN532CardReader.pdb

d41d8cd98f00b204e9800998ecf8427e

update.exe

3c4af7fc1dd461f223e12656052c40d3

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

update.exe.config

bb5dc6045efa2481926d1cd9fd06796c

XML 1.0 document, ASCII text, with CRLF line terminators

updatelist

e2eaa09ebff91f76498a259822ecf665

ASCII text, with CRLF line terminators

history.db

d41d8cd98f00b204e9800998ecf8427e

config.ini

c21379e0e63b869fc4a328945899fa7a

ASCII text, with CRLF line terminators

ico.ico

c644abb58baceb44a6be3d6061fb494a

MS Windows icon resource - 8 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel

libnfc.conf

03c7c29dfa47390cb2223c2c990ee19a

ASCII text

Cdc_com.exe

182d502acf9be563d439550ed89ae54f

PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive, 5 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	meth_stackstrings
VirusTotal	malicious	VirusTotal - Scan result 33/68

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

www.rfidfans.com/app/gw/update.zip

116.142.249.98

200 OK

12 MB

URL User Request GET
www.rfidfans.com/app/gw/update.zip
IP
116.142.249.98:443
ASN
#4837 CHINA UNICOM China169 Backbone

Certificate
IssuerSectigo Limited
Subjectwww.rfidfans.com
FingerprintD1:DC:95:B8:35:B0:18:7B:2D:86:E3:86:3E:BC:C8:64:9C:E0:DE:5C
ValidityWed, 10 Jul 2024 00:00:00 GMT - Sun, 10 Aug 2025 23:59:59 GMT

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
12 MB (11925883 bytes)
Hash
f37b871d71420c4aa2daf6734e51a409
fd199c69a3ccb05dd46cfa048b2d2af70b417831
2d69f6169b4877aa12ad79cc75074dc508b355c86cbe4601dd085c6f2e77d2d1

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 33/68

HTTP Headers

GET /app/gw/update.zip HTTP/1.1
Host: www.rfidfans.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Etag: "680df95f-b5f97b"
Server: nginx
Date: Tue, 29 Apr 2025 14:30:00 GMT
Content-Type: application/zip
Strict-Transport-Security: max-age=31536000
Last-Modified: Sun, 27 Apr 2025 09:31:11 GMT
Content-Length: 11925883
Accept-Ranges: bytes
X-NWS-LOG-UUID: 9873737869073920461
Connection: keep-alive
X-Cache-Lookup: Cache Refresh Hit, Cache Miss

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (63)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers