Report - awojnar.v.prz.edu.pl/download/vbEVEBMQRybxt5exAgI0YUKEwSBTk5FFcMFCE,ldDVYeJh8eN00yUhkzFBgWXwRCVDAoSgMDDShGCF9QQ3ZEDl0/ltbeam.zip

Report Overview

Visited public
2024-03-26 09:18:36
Tags
URL
awojnar.v.prz.edu.pl/download/vbEVEBMQRybxt5exAgI0YUKEwSBTk5FFcMFCE,ldDVYeJh8eN00yUhkzFBgWXwRCVDAoSgMDDShGCF9QQ3ZEDl0/ltbeam.zip
Finishing URL
about:privatebrowsing
IP / ASN
89.188.199.27
#25468 Rzeszow University of Technology
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
geant.ocsp.sectigo.com	50227	unknown	2020-04-15 16:47:00	2024-03-25 13:54:46	334 B	1.2 kB	172.64.149.23
awojnar.v.prz.edu.pl	unknown	2003-01-23	2023-06-01 14:44:07	2023-12-27 13:53:24	582 B	12 MB	89.188.199.27

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
awojnar.v.prz.edu.pl/download/vbEVEBMQRybxt5exAgI0YUKEwSBTk5FFcMFCE,ldDVYeJh8eN00yUhkzFBgWXwRCVDAoSgMDDShGCF9QQ3ZEDl0/ltbeam.zip
IP
89.188.199.27
ASN
#25468 Rzeszow University of Technology

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
12 MB (11524470 bytes)
Hash
5e969123e9333a6ab66dc2c6a25cc7e3
bae608710b542f1e5a26495c5e1771180aaac02c
c75b05f0bac0bd39adfce499fef98c0c261e1167fd197ebab91b3694a3a94ee9

Archive (53)

Filename

Md5

File type

ASYCFILT.DLL

c89e401800de62e5702e085d898eed20

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections

CMCTLFR.DLL

249cb7a18509505fcfbf6b73d1a8fe0e

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 2 sections

CMDLGFR.DLL

a23596f0a33bff856f6a48a5ec13b4a1

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 2 sections

COMCAT.DLL

3b180da2b50b954a55fe37afba58d428

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections

COMCTL32.OCX

eb5f811c1f78005b3c147599a0cccf51

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections

COMDLG32.OCX

ab412429f1e5fb9708a8cdea07479099

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections

EXAMPLE_1.DAT

6cb3c92c9a6f294e76324737c3404036

ASCII text, with CRLF line terminators

EXAMPLE_2.DAT

2f32832ec85ce7136c47a2d80bfa3e9e

ISO-8859 text, with CRLF line terminators

EXAMPLE_3.DAT

728ad7c303e70f60a421729c0f4fdea8

ASCII text, with CRLF line terminators

EXAMPLE_4.DAT

5976ef75faf186fc029ab68cec8d20a6

ASCII text, with CRLF line terminators

EXAMPLE_5.LTB

dbeebbbd567fe6399dbbf66b2ac810a9

ASCII text, with CRLF line terminators

FLXGDFR.DLL

9762df023e56c413c9084c954b6a8ae4

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 2 sections

Haunch.xls

93828b33f6a126738409d259d7d66ecc

Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: Gala, Last Saved By: GALEA, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jan 11 12:16:59 2002, Create Time/Date: Sun Dec 30 13:57:40 2001, Last Saved Time/Date: Tue Nov 23 15:01:56 2010, Security: 0

LTBeam.CAB

8ea77e48d0a953d46ad7f7b8de5ac89d

Microsoft Cabinet archive data, many, 5777979 bytes, 50 files, at 0x1830 last modified Sun, Feb 10 2012 18:11:28 +A "LTBeam.exe" last modified Sun, Apr 13 2008 18:33:34 +A "msvbvm60.dll", flags 0x4, ID 45285, number 1, extra bytes 6144 in head, 502 datablocks, 0x1 compression

LTBeam.DFT

048aeff037fda28e0b1eb4327453c609

ISO-8859 text, with CRLF line terminators

LTBeam.exe

953a6d4b4d982f434d342b57280e20fa

PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections

Ltbeam.ico

8aafb1dacaee41819fec29891740b0ec

MS Windows icon resource - 1 icon, 32x32, 16 colors

LTBeam.INI

a301426a12ee97c61e5a990786847744

ASCII text, with CRLF line terminators

LTBeam.LTB

8f0d818b9091086309355c19cb60a787

ASCII text, with CRLF line terminators

LTBeam_F.msg

b3ff379cef10b241c6cc96bc6597d36e

data

LTBeam_UK.msg

032cd555235dde1b22c79d2fb6ca57c7

data

LTB_F.cnt

1dd24c5e3659cd56bee0d1ddbd5c6a6a

MS Windows help file Content, based "LTB_F", ISO-8859 text, with CRLF line terminators

LTB_F.HLP

8d595eb328011fc79bb6fcea93d0c80b

MS Windows help Bookmark, 2267402 bytes

LTB_UK.cnt

9144424a73ed7b97f4426d16263de20d

MS Windows help file Content, based "LTB_UK", ASCII text, with CRLF line terminators

LTB_UK.HLP

7e09d4b54bb789c9eb66be651320719d

MS Windows help Bookmark, 1591056 bytes

MFC40.DLL

3c711ad90c7ea24c2e53b9d4cc1c87d2

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 6 sections

mfc40loc.dll

92764574444ac85a48034b00423c2b4e

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 2 sections

mfc42.dll

cdab46933b035c6208f518b63d718a12

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

MSFLXGRD.OCX

3f7a98d7be824143c7c88fc447e944ac

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections

MSSTDFMT.DLL

719e0f4d1114f700f564e9ae47f0e3ee

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 6 sections

msvbvm60.dll

f4a1f1a1990f0619ab30f62f66b03836

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

MSVCRT.DLL

0a8e038a03d7e409e5140fc9222af3a8

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

MSVCRT40.DLL

37b3c7afd09cf8dd315c506565d776cb

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

OLEAUT32.DLL

7b156d230278b8c914ef3f4169fec1cc

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections

OLEPRO32.DLL

ce0155405ea902797e88b92a78443aeb

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections

RCHTXFR.DLL

e6bf7440f0b0dadf7f42dbd7998e5acd

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 2 sections

ReleaseInfo.txt

7c1edc32f153e002611b95cd33aca7e3

ISO-8859 text, with very long lines (356), with CRLF line terminators

ReSize32.ocx

4fe716979ddd56fb00e1e9d1fcd13e1b

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

RICHED32.DLL

6801f45dfac0743d3a0d73b121e261da

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections

RICHTX32.OCX

045a16822822426c305ea7280270a3d6

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections

SECTION.DB

f014eadd472e6db01f8bc652eeac6437

data

setup.exe

8ff757c653efb2c0dda1fad0c3e60f29

PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

SETUP.LST

df62e2e856f13daa1fac49355771ee2b

Generic INItialization configuration [Bootstrap Files]

SPIN32.OCX

c4b2459ea9bb1359be7bb4ed5c14d1f6

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

ST6UNST.EXE

7a6a5fd95e9587df509bdd6ecdfe388f

PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

STDFTFR.DLL

0ab03cc002c70d28d1deec7e4b0e036e

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 2 sections

STDOLE2.TLB

1b02577f0addea32eb02a50d4a4cdd1e

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 2 sections

TABCTFR.DLL

1228fdbff0ef23579ef578b8b15a530c

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 2 sections

TABCTL32.OCX

dc925b6d77ba9ecb532e2f6750be943b

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections

THREED32.OCX

51c9e8d775c6653acf5d87bdb2ebd33e

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

Validation.pdf

30ea0694a147812d104428133c70b9e6

PDF document, version 1.2, 6 pages

VB6FR.DLL

dcbdcf28cbcf51efe6d26ba3e05d734f

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections

VB6STKIT.DLL

00b2952d8f61722002e73473a8a98ec1

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect pe file that no import table
YARAhub by abuse.ch	malware	Detect pe file that no import table
YARAhub by abuse.ch	malware	Detect pe file that no import table
YARAhub by abuse.ch	malware	Detect pe file that no import table
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	Detect pe file that no import table
YARAhub by abuse.ch	malware	Detect pe file that no import table
YARAhub by abuse.ch	malware	Detect pe file that no import table
YARAhub by abuse.ch	malware	Detect pe file that no import table
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	Detect pe file that no import table
VirusTotal	suspicious	VirusTotal - Scan result 2/65

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

geant.ocsp.sectigo.com/

172.64.149.23

727 B

URL
geant.ocsp.sectigo.com/
IP
172.64.149.23:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
727 B (727 bytes)
Hash
2365a2e071395e90992cf6582cff7f3e
58fb2cd3e16d8cb2c810f2f76f4fbf2f26e3ff33
6eda72140ade77b0a8945f2688f63f052175b1fdfac040939d7062f9b40ef211

HTTP Headers

POST / HTTP/1.1
Host: geant.ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 26 Mar 2024 09:18:01 GMT
Content-Type: application/ocsp-response
Content-Length: 727
Connection: keep-alive
Last-Modified: Sun, 24 Mar 2024 05:07:51 GMT
Expires: Sun, 31 Mar 2024 05:07:50 GMT
Etag: "58fb2cd3e16d8cb2c810f2f76f4fbf2f26e3ff33"
Cache-Control: max-age=416702,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 86a60d0d7952b529-OSL

awojnar.v.prz.edu.pl/download/vbEVEBMQRybxt5exAgI0YUKEwSBTk5FFcMFCE,ldDVYeJh8eN00yUhkzFBgWXwRCVDAoSgMDDShGCF9QQ3ZEDl0/ltbeam.zip

89.188.199.27

200 OK

12 MB

URL User Request GET HTTP/1.1
awojnar.v.prz.edu.pl/download/vbEVEBMQRybxt5exAgI0YUKEwSBTk5FFcMFCE,ldDVYeJh8eN00yUhkzFBgWXwRCVDAoSgMDDShGCF9QQ3ZEDl0/ltbeam.zip
IP
89.188.199.27:443
ASN
#25468 Rzeszow University of Technology

Certificate
IssuerGEANT Vereniging
Subject*.v.prz.edu.pl
Fingerprint91:7A:85:B1:8C:5A:45:9B:8F:0E:79:97:51:DA:73:B3:6E:BD:A0:63
ValiditySun, 04 Feb 2024 00:00:00 GMT - Mon, 03 Feb 2025 23:59:59 GMT

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
12 MB (11524470 bytes)
Hash
5e969123e9333a6ab66dc2c6a25cc7e3
bae608710b542f1e5a26495c5e1771180aaac02c
c75b05f0bac0bd39adfce499fef98c0c261e1167fd197ebab91b3694a3a94ee9

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 2/65

HTTP Headers

GET /download/vbEVEBMQRybxt5exAgI0YUKEwSBTk5FFcMFCE,ldDVYeJh8eN00yUhkzFBgWXwRCVDAoSgMDDShGCF9QQ3ZEDl0/ltbeam.zip HTTP/1.1
Host: awojnar.v.prz.edu.pl
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 26 Mar 2024 09:18:01 GMT
Server: Apache/2.4.10 (Debian)
Pragma: public
Cache-Control: public
Content-Description: File Transfer
Expires: 0
Content-Disposition: attachment; filename="ltbeam.zip"
Content-Transfer-Encoding: binary
Set-Cookie: PHPSESSID=sd4e7mt3u8el1g26evne6lqlt1; path=/; domain=.prz.edu.pl
Content-Length: 11524470
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/octet-stream

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (53)

Detections

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers