Report - download.tenorshare.com/downloads/iOS/Mac/hotfix_irestoreB.zip

Report Overview

Visited public
2024-11-06 07:18:51
Tags
URL
download.tenorshare.com/downloads/iOS/Mac/hotfix_irestoreB.zip
Finishing URL
about:privatebrowsing
IP / ASN
104.18.24.249
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

0

Network Intrusion Detection

0

Threat Detection Systems

2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
download.tenorshare.com	275424	2010-08-24	2016-01-21	2024-10-31	516 B	2.0 MB	104.18.25.249

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Mnemonic Secure DNS

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
download.tenorshare.com/downloads/iOS/Mac/hotfix_irestoreB.zip
IP
104.18.25.249
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
2.0 MB (2026199 bytes)
Hash
5be6aa9e2e444a7889d4dfdae7ec1e3e
3bbd5a268e7834541e1b844ef12a47d51d9bc791
592eeb950421996d62e087d623aa89d4cb6ed47aa66a67cf4152da1d3aad3e4c

Archive (10)

Filename

Md5

File type

libla_irecovery.dylib

d081fd24f512b8dba31de32a5b782483

Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>

libla_plist.dylib

52e657db3ede0be864edbf47f1ebedd3

Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>

libssl.1.1.dylib

d38dd4a87d9b5ee99c4aca650f3b464a

Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>

libla_common.dylib

962a97e953641ac713dbd349e17eb93c

Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>

exela_irestore

330577d21f78394f3fe3e118096a21e1

Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE|HAS_TLV_DESCRIPTORS>

libzip.5.5.dylib

76afda63c9d268c4bc1a176b2fe05fd5

Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>

libla_imobiledevice.dylib

4093228c865813abefed8da2d014ed7e

Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>

libcrypto.1.1.dylib

95f7293147101449081e9dfa3a9065e2

Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>

libla_usbmuxd.dylib

cdd431b37876a7d840f1673d6af054f4

Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>

libla_tatsu.dylib

28c836c5dc484e9436ef59dc04d7574c

Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 9/68

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

download.tenorshare.com/downloads/iOS/Mac/hotfix_irestoreB.zip

104.18.25.249

200 OK

2.0 MB

URL User Request GET HTTP/1.1
download.tenorshare.com/downloads/iOS/Mac/hotfix_irestoreB.zip
IP
104.18.25.249:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjecttenorshare.com
Fingerprint95:DE:63:FB:D6:5E:F2:D9:61:96:C3:B7:26:78:45:49:DC:AB:BC:B2
ValiditySun, 08 Sep 2024 10:18:07 GMT - Sat, 07 Dec 2024 11:18:03 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
2.0 MB (2026199 bytes)
Hash
5be6aa9e2e444a7889d4dfdae7ec1e3e
3bbd5a268e7834541e1b844ef12a47d51d9bc791
592eeb950421996d62e087d623aa89d4cb6ed47aa66a67cf4152da1d3aad3e4c

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 9/68

HTTP Headers

GET /downloads/iOS/Mac/hotfix_irestoreB.zip HTTP/1.1
Host: download.tenorshare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 06 Nov 2024 07:18:26 GMT
Content-Type: application/octet-stream
Content-Length: 2026199
Connection: keep-alive
CF-Ray: 8de34f3e1fca0b45-OSL
CF-Cache-Status: HIT
Accept-Ranges: bytes
Age: 315977
Cache-Control: public, max-age=691200
Content-Disposition: attachment;filename=hotfix_irestoreB.zip
ETag: "66f4bde6-1eead7"
Expires: Thu, 14 Nov 2024 07:18:26 GMT
Last-Modified: Thu, 26 Sep 2024 01:50:30 GMT
Vary: Accept-Encoding
Set-Cookie: __cf_bm=bBPwk0G3cPEwhZMZB04LlbMxoJcBgbVYXTwtBJ3lWJQ-1730877506-1.0.1.1-rAq8eFoVuA7cf6C1QP6dZzdu3CcBlUN_AUQ2PRTocUOeOAHQdqy6FSx5oLFBVyGRT2Zv36sLr_if8jh40FKv0A; path=/; expires=Wed, 06-Nov-24 07:48:26 GMT; domain=.tenorshare.com; HttpOnly; Secure; SameSite=None
Server: cloudflare