Report - pixir.pl/wp-content/uploads/2024/09/searchtool-for-win-v1.5.3.231115-r1.zip

Report Overview

Visitedpublic

2025-01-17 22:28:34

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
pixir.pl	unknown	2016-04-28	2017-09-29	2025-01-17	529 B	12 MB	104.21.69.236

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

pixir.pl/wp-content/uploads/2024/09/searchtool-for-win-v1.5.3.231115-r1.zip

IP / ASN

104.21.69.236

#13335 CLOUDFLARENET

File Overview

File TypeZip archive data, at least v2.0 to extract, compression method=deflate

Size12 MB (11496661 bytes)

MD53434201564df0583593e2b18c7937bb9

SHA177ff47b41c3504457a069a85d950bb6cf49e3582

SHA256f92be9e9e59b628a3bbbee024c243e9da2579ba6ea216f1ae1b892bd4136ec7b

Archive (1)

Modified	Filename	Size	MD5	File type
2024-04-25 10:38	SearchTool for WIN_V1.5.3.231115_R1.exe	12 MB	d4ee8ae099c9a81a33432a3708b26369	PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Scans presence of the found strings using the in-house brute force method

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

	URL	IP	Response	Size
	GET pixir.pl/wp-content/uploads/2024/09/searchtool-for-win-v1.5.3.231115-r1.zip	104.21.69.236	200 OK	12 MB
URL pixir.pl/wp-content/uploads/2024/09/searchtool-for-win-v1.5.3.231115-r1.zip IP / ASN 104.21.69.236 #13335 CLOUDFLARENET Requested byN/A Resource Info File typeZip archive data, at least v2.0 to extract, compression method=deflate First Seen2025-01-17 Last Seen2025-01-17 Times Seen1 Size12 MB (11496661 bytes) MD53434201564df0583593e2b18c7937bb9 SHA177ff47b41c3504457a069a85d950bb6cf49e3582 SHA256f92be9e9e59b628a3bbbee024c243e9da2579ba6ea216f1ae1b892bd4136ec7b Certificate Info IssuerGoogle Trust Services Subjectpixir.pl FingerprintF2:39:99:84:08:B5:8D:0A:20:D1:66:42:3D:C2:FD:B6:EF:54:46:41 ValiditySun, 05 Jan 2025 01:04:57 GMT - Sat, 05 Apr 2025 02:03:39 GMT HTTP Headers GET /wp-content/uploads/2024/09/searchtool-for-win-v1.5.3.231115-r1.zip HTTP/1.1 Host: pixir.pl User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 200 OK date: Fri, 17 Jan 2025 22:28:07 GMT content-type: application/zip content-length: 11496661 last-modified: Mon, 23 Sep 2024 09:42:23 GMT etag: "66f137ff-af6cd5" x-xss-protection: 1; mode=block x-content-type-options: nosniff x-frame-options: DENY cache-control: max-age=14400 cf-cache-status: MISS accept-ranges: bytes report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5WbIoTwGGghfllpm%2BLr80VjsccLDMNaGTVTMC7qEuPs0L92G10TKXX%2B6NzZUGvjzFn6vl2ii4H6qCWIV%2FiXkks6pp7tzH3g4%2FILi61tkLIIH1GAcYDXJpfCoEg%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare cf-ray: 9039c6cbaee356be-OSL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6432&min_rtt=449&rtt_var=11966&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3263&recv_bytes=1280&delivery_rate=7375212&cwnd=254&unsent_bytes=0&cid=9b533acf744f5f50&ts=217&x=0" X-Firefox-Spdy: h2

GET pixir.pl/wp-content/uploads/2024/09/searchtool-for-win-v1.5.3.231115-r1.zip

104.21.69.236

200 OK

12 MB

URL

pixir.pl/wp-content/uploads/2024/09/searchtool-for-win-v1.5.3.231115-r1.zip

IP / ASN

104.21.69.236

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeZip archive data, at least v2.0 to extract, compression method=deflate

First Seen2025-01-17

Last Seen2025-01-17

Times Seen1

Size12 MB (11496661 bytes)

MD53434201564df0583593e2b18c7937bb9

SHA177ff47b41c3504457a069a85d950bb6cf49e3582

SHA256f92be9e9e59b628a3bbbee024c243e9da2579ba6ea216f1ae1b892bd4136ec7b

Certificate Info

IssuerGoogle Trust Services

Subjectpixir.pl

FingerprintF2:39:99:84:08:B5:8D:0A:20:D1:66:42:3D:C2:FD:B6:EF:54:46:41

ValiditySun, 05 Jan 2025 01:04:57 GMT - Sat, 05 Apr 2025 02:03:39 GMT

HTTP Headers

GET /wp-content/uploads/2024/09/searchtool-for-win-v1.5.3.231115-r1.zip HTTP/1.1
Host: pixir.pl
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 17 Jan 2025 22:28:07 GMT
content-type: application/zip
content-length: 11496661
last-modified: Mon, 23 Sep 2024 09:42:23 GMT
etag: "66f137ff-af6cd5"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-frame-options: DENY
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5WbIoTwGGghfllpm%2BLr80VjsccLDMNaGTVTMC7qEuPs0L92G10TKXX%2B6NzZUGvjzFn6vl2ii4H6qCWIV%2FiXkks6pp7tzH3g4%2FILi61tkLIIH1GAcYDXJpfCoEg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9039c6cbaee356be-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6432&min_rtt=449&rtt_var=11966&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3263&recv_bytes=1280&delivery_rate=7375212&cwnd=254&unsent_bytes=0&cid=9b533acf744f5f50&ts=217&x=0"
X-Firefox-Spdy: h2