Report - tmhacks22.ovh/dl/TM-Spoofer.zip

Report Overview

Visited public
2024-12-06 18:23:29
Tags
URL
tmhacks22.ovh/dl/TM-Spoofer.zip
Finishing URL
about:privatebrowsing
IP / ASN
172.67.204.251
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

0

Network Intrusion Detection

0

Threat Detection Systems

3

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
tmhacks22.ovh	unknown	2024-02-03	2024-02-16	2024-12-06	485 B	304 kB	104.21.44.234

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
tmhacks22.ovh/dl/TM-Spoofer.zip
IP
104.21.44.234
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
304 kB (303616 bytes)
Hash
8f986b0609da27db6d476b332429ed12
a8254f36b3fd91e79bd3f9804c1bacc4d76192c5
e65c875b62b7ea8b419ee88ed3f426699a933073076ea0720e6ec9ad419d6165

Archive (7)

Filename

Md5

File type

SPOOF APEX.txt

f1af53a2c029a161111e3c5f147e8bdd

ASCII text, with CRLF line terminators

SPOOF FORTNITE.txt

58b310fe88b168b703e563bcd774492a

ASCII text, with CRLF line terminators

SPOOF PUBG.txt

a8d44c8ce2e1b0f6069335109bee9ee9

ASCII text, with CRLF line terminators

SPOOF VALORANT.txt

3a07a271988f484307a04a598b2ff749

ASCII text, with CRLF line terminators

TM_Spoofer.exe

4658e53cfd46adb6c5956bdb25a91052

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 6 sections

SPOOF ANY BATTLEYE GAME.txt

b11c9acf2f0cfc1356f8709ad424e6d4

ASCII text, with CRLF line terminators

SPOOF ANY EAC GAME.txt

66286bb5800d6e3366311628d8e3009d

ASCII text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 50/70
ClamAV	malicious	Win.Packed.Bulz-9859365-0

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

tmhacks22.ovh/dl/TM-Spoofer.zip

104.21.44.234

200 OK

304 kB

URL User Request GET HTTP/2
tmhacks22.ovh/dl/TM-Spoofer.zip
IP
104.21.44.234:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjecttmhacks22.ovh
FingerprintCF:51:A9:83:A5:7B:CE:96:F4:0E:50:41:DD:14:5F:9C:D5:FA:45:EA
ValiditySun, 24 Nov 2024 01:32:30 GMT - Sat, 22 Feb 2025 01:32:29 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
304 kB (303616 bytes)
Hash
8f986b0609da27db6d476b332429ed12
a8254f36b3fd91e79bd3f9804c1bacc4d76192c5
e65c875b62b7ea8b419ee88ed3f426699a933073076ea0720e6ec9ad419d6165

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 50/70
ClamAV	malicious	Win.Packed.Bulz-9859365-0

HTTP Headers

GET /dl/TM-Spoofer.zip HTTP/1.1
Host: tmhacks22.ovh
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 06 Dec 2024 18:23:04 GMT
content-type: application/zip
content-length: 303616
last-modified: Sat, 02 Nov 2024 14:23:27 GMT
etag: "4a200-625eecb8d88b5"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=arYjYYb2vKs5btfKQpJ0ZpOdEaI6wDVkwddR3NQ7bNknlwTkpSm0wALhyfMYKpT4cTBhPz9LRrjUS8APS0qwtBMYUkRDJFGG9QdFopHQ5iOmfGw%2FLG6w%2F4qdlqzY1%2BpP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8ede4e130f645687-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6505&min_rtt=460&rtt_var=12051&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3202&recv_bytes=1129&delivery_rate=6601823&cwnd=254&unsent_bytes=0&cid=a7f3a2a5a1cbf786&ts=132&x=0"
X-Firefox-Spdy: h2