Report Overview
Visitedpublic
2024-08-28 08:05:08
Tags
Submit Tags
URL
github.com/anonyketa/EXM-Tweaking-Utility-Premium/releases/download/V1.0/exm.zip
Finishing URL
about:privatebrowsing
IP / ASN
140.82.121.4
Title
about:privatebrowsing
Detections
urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
0
Host Summary
| Host | Rank | Registered | First Seen | Last Seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
r11.o.lencr.org | unknown | 2020-06-29 | 2024-06-07 07:43:57 | 2024-08-27 18:12:09 | 1.6 kB | 4.4 kB |  23.36.77.32 | |
r10.o.lencr.org | unknown | 2020-06-29 | 2024-06-06 21:45:11 | 2024-08-27 18:12:12 | 981 B | 2.7 kB | 23.36.76.226 | |
github.com | 1423 | 2007-10-09 | 2016-07-13 12:28:22 | 2024-08-26 10:52:48 | 534 B | 4.3 kB | 140.82.121.4 | |
objects.githubusercontent.com | 134060 | 2014-02-06 | 2021-11-01 22:34:29 | 2024-08-27 16:21:30 | 988 B | 14 MB |  185.199.109.133 |
Related reports
Network Intrusion Detection Systems
Suricata /w Emerging Threats Pro
No alerts detected
Threat Detection Systems
Public InfoSec YARA rules
No alerts detected
OpenPhish
No alerts detected
PhishTank
No alerts detected
mnemonic secure dns
No alerts detected
Quad9 DNS
No alerts detected
ThreatFox
No alerts detected
File detected
URL
objects.githubusercontent.com/github-production-release-asset-2e65be/788602973/a8448863-44c7-4a40-911f-114b46201f4b?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240828%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240828T080437Z&X-Amz-Expires=300&X-Amz-Signature=c20f69d6da3fe92073d752fa07075265decd5cab466f6d0e423c44d9e69bbffb&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=788602973&response-content-disposition=attachment%3B%20filename%3Dexm.zip&response-content-type=application%2Foctet-stream
IP / ASN
185.199.109.133
File Overview
File TypeZip archive data, at least v2.0 to extract, compression method=store
Size14 MB (13896079 bytes)
MD5de4e8080f24bde2d50836aba1efaebb0
SHA14dc443ba1e8f9cdeae72e8c4c5b1694bb91d942d
Archive (18)
| Filename | MD5 | File type |
|---|---|---|
| autoruns.chm | 2c099793584365b8897fca7a4fa397e8 | MS Windows HtmlHelp Data |
| Autoruns.exe | 17bd13edd536269c417ba8e1b4534fbe | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| Autoruns64.exe | 6ae8e963b33ee52df761412b451b2962 | PE32+ executable (GUI) x86-64, for MS Windows, 7 sections |
| Autoruns64a.exe | d518661b0940e2464aa8d3073599ab89 | PE32+ executable (GUI) Aarch64, for MS Windows, 6 sections |
| autorunsc.exe | 1d4611e03d8f32ae08cf8ade9a958729 | PE32 executable (console) Intel 80386, for MS Windows, 5 sections |
| autorunsc64.exe | 848e852089ba84056308e184b034c302 | PE32+ executable (console) x86-64, for MS Windows, 7 sections |
| autorunsc64a.exe | 0c790f64e69f9d9a4cbde5e21f1a4e93 | PE32+ executable (console) Aarch64, for MS Windows, 6 sections |
| Eula.txt | 8c24c4084cdc3b7e7f7a88444a012bfc | Unicode text, UTF-8 (with BOM) text, with very long lines (518), with CRLF line terminators |
| EXMservice.exe | ab2dfff7a07b6bfc8158d8ebd047eb06 | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| FortniteSettings.exe | a39de0d010e9d34de70abad81f031e23 | PE32+ executable (GUI) x86-64, for MS Windows, 7 sections |
| Exm_Premium_Profile_V4.nip | d5563eaeb8f6e5dbfb2d01fd24b7c8d5 | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators |
| nv.config | ce6d0bc7328b0fab08de80f292c1eaa4 | XML 1.0 document, ASCII text |
| nvidiaProfileInspector.exe | ff5f39370b67a274cb58ba7e2039d2e2 | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| Reference.xml | 1a8493bff2d17c83e299101954dcb562 | XML 1.0 document, ASCII text, with CRLF line terminators |
| Exm_Premium_Power_Plan_V3.pow | abec2ceb9e8425172e1c7bbabbaf8eb1 | MS Windows registry file, NT/2000 or above |
| Wub.exe | 82aff8883099cf75462057c4e47e88ac | PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections |
| Wub.ini | a16bf55cd2ef7d9e56565b0ed1aa208a | Unicode text, UTF-16, little-endian text, with CRLF line terminators |
| Wub_x64.exe | 9d6778f7f274f7ecd4e7e875a7268b64 | PE32+ executable (GUI) x86-64, for MS Windows, 5 sections |
Detections
| Analyzer | Verdict | Alert |
|---|---|---|
| YARAhub by abuse.ch | malware | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| YARAhub by abuse.ch | malware | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| YARAhub by abuse.ch | malware | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| YARAhub by abuse.ch | malware | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| YARAhub by abuse.ch | malware | files - file ~tmp01925d3f.exe |
| YARAhub by abuse.ch | malware | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| YARAhub by abuse.ch | malware | files - file ~tmp01925d3f.exe |
| YARAhub by abuse.ch | malware | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| YARAhub by abuse.ch | malware | files - file ~tmp01925d3f.exe |
| Public Nextron YARA rules | malware | Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits |
| Public InfoSec YARA rules | malware | Identifies executable converted using PyInstaller. |
| YARAhub by abuse.ch | malware | meth_get_eip |
| Public InfoSec YARA rules | malware | Identifies compiled AutoIT script (as EXE). |
| Public InfoSec YARA rules | malware | Identifies compiled AutoIT script (as EXE). |
JavaScript (0)
No JavaScripts
HTTP Transactions (10)
| URL | IP | Response | Size |
|---|