Report Overview
Visitedpublic
2024-04-03 18:48:19
Tags
Submit Tags
URL
github.com/amitxv/SCEWIN/releases/download/5.05.01.0002/SCEWIN.zip
Finishing URL
about:privatebrowsing
IP / ASN
140.82.121.4
#36459 GITHUB
Title
about:privatebrowsing

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
9

Host Summary

HostRankRegisteredFirst SeenLast Seen
github.com
14232007-10-092016-07-13 12:28:222024-03-24 14:57:11
objects.githubusercontent.com
1340602014-02-062021-11-01 22:34:292024-04-03 04:15:12

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected


OpenPhish

No alerts detected


PhishTank

No alerts detected


mnemonic secure dns

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


File detected

URL
objects.githubusercontent.com/github-production-release-asset-2e65be/678130167/04a307af-ce81-4897-9be4-33f73ecf3ac2?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240403%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240403T184753Z&X-Amz-Expires=300&X-Amz-Signature=2b14086023745d515a807b0f3eee4667f5ef100fc0a16b91c372a0e8c697e57d&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=678130167&response-content-disposition=attachment%3B%20filename%3DSCEWIN.zip&response-content-type=application%2Foctet-stream
IP / ASN
185.199.111.133
#54113 FASTLY
File Overview
File TypeZip archive data, at least v2.0 to extract, compression method=store
Size296 kB (295847 bytes)
MD57ea904c92b77f2bdcc05a0bad0e0dfcb
SHA18916621647b0746a77b7aea364f34ee4a5491641
Archive (5)
FilenameMD5File type
amifldrv64.syse5e8ecb20bc5630414707295327d755ePE32+ executable (native) x86-64, for MS Windows, 5 sections
amigendrv64.sys7b9717c608a5f5a1c816128a609e9575PE32+ executable (native) x86-64, for MS Windows, 9 sections
Export.batbf354baed02884dc4cf002db55818873DOS batch file, ASCII text, with CRLF line terminators
Import.bat69ef99d985f7bc5e5e35471b251a84a3DOS batch file, ASCII text, with CRLF line terminators
SCEWIN_64.exed89e8173dc0b82d80add7451d4aa4622PE32+ executable (console) x86-64, for MS Windows, 4 sections

Detections

AnalyzerVerdictAlert
YARAhub by abuse.chmalware
signed_sys_with_vulnerablity
Elastic Security YARA Rulesmalware
Windows.VulnDriver.Amifldrv
Public Nextron YARA rulesmalware
Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amifldrv64.sys
YARAhub by abuse.chmalware
signed_sys_with_vulnerablity
Elastic Security YARA Rulesmalware
Windows.VulnDriver.Amifldrv
YARAhub by abuse.chmalware
files - file ~tmp01925d3f.exe
VirusTotalsuspicious

JavaScript (0)

HTTP Transactions (2)

URLIPResponseSize
GET github.com/amitxv/SCEWIN/releases/download/5.05.01.0002/SCEWIN.zip
140.82.121.4302 Found0 B
GET objects.githubusercontent.com/github-production-release-asset-2e65be/678130167/04a307af-ce81-4897-9be4-33f73ecf3ac2?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240403%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240403T184753Z&X-Amz-Expires=300&X-Amz-Signature=2b14086023745d515a807b0f3eee4667f5ef100fc0a16b91c372a0e8c697e57d&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=678130167&response-content-disposition=attachment%3B%20filename%3DSCEWIN.zip&response-content-type=application%2Foctet-stream
185.199.111.133200 OK296 kB