Report - support.xmplay.com/files/12/xmp-libxmp.zip?v=911106

Report Overview

Visited public
2025-02-08 12:25:44
Tags
URL
support.xmplay.com/files/12/xmp-libxmp.zip?v=911106
Finishing URL
about:privatebrowsing
IP / ASN
104.21.48.1
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
support.xmplay.com	unknown	2001-09-19	2012-12-24	2025-02-06	517 B	467 kB	104.21.112.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
support.xmplay.com/files/12/xmp-libxmp.zip?v=911106
IP
104.21.112.1
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
466 kB (465934 bytes)
Hash
88aa73b5bff563e632453292d04dd3ef
0d97fe25ee5b5abe4725d19bd06b1466239790c5
a80ec0c73bb3f8fd0c8e7cef9e91d694246a0fcff52891a479277d31bbbaeef8

Archive (3)

Filename

Md5

File type

formats.txt

c096d7b08050b5a0a87c2b7512015e2a

ISO-8859 text, with CRLF line terminators

xmp-libxmp.dll

9f01289194342d5052a680b3e41480cd

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

xmp-libXMP.txt

dfbe486965395ea82013e96957136ced

Unicode text, UTF-8 text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
VirusTotal	suspicious	VirusTotal - Scan result 9/66

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

support.xmplay.com/files/12/xmp-libxmp.zip?v=911106

104.21.112.1

200 OK

466 kB

URL
support.xmplay.com/files/12/xmp-libxmp.zip?v=911106
IP
104.21.112.1:0
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
466 kB (465934 bytes)
Hash
88aa73b5bff563e632453292d04dd3ef
0d97fe25ee5b5abe4725d19bd06b1466239790c5
a80ec0c73bb3f8fd0c8e7cef9e91d694246a0fcff52891a479277d31bbbaeef8

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 9/66

HTTP Headers

GET /files/12/xmp-libxmp.zip?v=911106 HTTP/1.1
Host: support.xmplay.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 08 Feb 2025 12:25:14 GMT
content-type: application/zip
content-length: 465934
last-modified: Fri, 03 Jan 2025 13:31:46 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 102130
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ulGDqu08zy8ytws4Ly2dud2cBUCTgPvHEjZf8L0kaamlqHj%2FzjyF31jnJ3ynGzk36jzplFfAR3u04RuZW4%2BmLx0QPBu0IAVMsMdU7eL3vlpMaZtVmS3JEtn7CzR%2BwLcuuyUx424%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 90eb99e6db0556a5-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=562&min_rtt=515&rtt_var=165&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3197&recv_bytes=1151&delivery_rate=6862559&cwnd=253&unsent_bytes=0&cid=751106501f8c46d6&ts=40&x=0"
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (3)

Detections

JavaScript (0)

HTTP Transactions (1)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers