Report - ftp.nluug.nl/pub/vim/pc/gvim81.zip

Report Overview

Visited public
2025-05-07 06:59:02
Tags
URL
ftp.nluug.nl/pub/vim/pc/gvim81.zip
Finishing URL
about:privatebrowsing
IP / ASN
145.220.21.40
#1101 SURF B.V.
Title
about:privatebrowsing

Detections

urlquery

0

Network Intrusion Detection

0

Threat Detection Systems

7

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ftp.nluug.nl	183809	unknown	No data	No data	502 B	1.9 MB	145.220.21.40

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
ftp.nluug.nl/pub/vim/pc/gvim81.zip
IP
145.220.21.40
ASN
#1101 SURF B.V.

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.9 MB (1888311 bytes)
Hash
ccbf87e76bf2808dc857c16b8cf15cd0
f7b0b24aeaf043ec08dcd11bc0c5b9995a44ee12
2a37f54db4d045fd25df40cbfa3abac40b6898b68adb1eac44890e6d6a417458

Archive (10)

Filename

Md5

File type

xxd.exe

8fb2fdc87d9155c3373ede38a533cbf7

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

tee.exe

967836f5ef6d3a9bf5c6f50ec37e1c73

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

gvimext.dll

3dcd1e31430481b43fbb5c58c83a7c7d

PE32+ executable (DLL) (console) x86-64, for MS Windows, 7 sections

uninstal.exe

b057cd02a148f18a7d2220fe8236cf6f

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

install.exe

5e5e25d8d7f8edc78f3dbc9cd761a48a

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

gvimext.dll

78fc601ce58233155292c98cae9372f6

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 6 sections

vimrun.exe

950dd2210c66a19974b550a3abae54f5

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

gvim.exe

d8fe064b63977c480a339c28bbb31ffe

PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections

README_bindos.txt

6bf16aeb1a77609a9c3d3e5871b631cf

ASCII text

uninstal.txt

aa23536d7a24ddbc43a8c5f03e1b5674

ASCII text

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/61

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

ftp.nluug.nl/pub/vim/pc/gvim81.zip

145.220.21.40

200 OK

1.9 MB

URL User Request GET
ftp.nluug.nl/pub/vim/pc/gvim81.zip
IP
145.220.21.40:443
ASN
#1101 SURF B.V.

Certificate
IssuerLet's Encrypt
Subjectftp.nluug.nl
Fingerprint08:A0:C3:A6:1D:D5:0C:12:49:C7:51:39:9A:7F:D6:DB:D9:0D:1A:AB
ValidityWed, 19 Mar 2025 20:02:04 GMT - Tue, 17 Jun 2025 20:02:03 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.9 MB (1888311 bytes)
Hash
ccbf87e76bf2808dc857c16b8cf15cd0
f7b0b24aeaf043ec08dcd11bc0c5b9995a44ee12
2a37f54db4d045fd25df40cbfa3abac40b6898b68adb1eac44890e6d6a417458

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/61

HTTP Headers

GET /pub/vim/pc/gvim81.zip HTTP/1.1
Host: ftp.nluug.nl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 07 May 2025 06:58:29 GMT
content-type: application/zip
content-length: 1888311
last-modified: Fri, 18 May 2018 16:40:32 GMT
etag: "5aff0200-1cd037"
x-frame-options: sameorigin
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
accept-ranges: bytes
X-Firefox-Spdy: h2