Report - rammichael.com/downloads/textify

Report Overview

Visitedpublic

2024-01-13 15:19:21

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
rammichael.com	379267	2007-04-07	2012-07-26 00:14:48	2024-01-11 20:24:58	785 B	576 B	35.224.163.223
ramensoftware.com	unknown	2021-04-11	2021-12-04 17:04:28	2024-01-12 23:50:24	538 B	608 kB	104.21.74.253

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-01-13	medium	ramensoftware.com/wp-content/uploads/downloads/2023/09/textify_setup.exe	files - file ~tmp01925d3f.exe

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

ramensoftware.com/wp-content/uploads/downloads/2023/09/textify_setup.exe

IP / ASN

104.21.74.253

#13335 CLOUDFLARENET

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Size607 kB (607392 bytes)

MD5ad2619b201892e4c11dbd88d89d9a39f

SHA1897ca220cf649d0b6d9d781c6afdb7763ea1ebee

SHA25668d09e1a39da33a3ba80a2eec437d764bbe79026ab323f710f88e5f71bcddd0d

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe

JavaScript (0)

HTTP Transactions (3)

URL IP Response Size

GET rammichael.com/downloads/textify_setup.exe

35.224.163.223

302 Found

0 B

URL

rammichael.com/downloads/textify_setup.exe

IP / ASN

35.224.163.223

#15169 GOOGLE

Requested byN/A

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-02

Times Seen5605971

Size0 B (0 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate Info

IssuerLet's Encrypt

Subjectrammichael.com

FingerprintA1:5E:63:F7:BE:00:7B:DC:CC:69:B9:D9:D9:70:3A:72:25:41:09:A0

ValidityWed, 13 Dec 2023 09:29:33 GMT - Tue, 12 Mar 2024 09:29:32 GMT

HTTP Headers

GET /downloads/textify_setup.exe HTTP/1.1
Host: rammichael.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Sat, 13 Jan 2024 15:19:00 GMT
Server: Apache/2.4.41 (Ubuntu)
Location: https://ramensoftware.com/wp-content/uploads/downloads/2023/09/textify_setup.exe
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

rammichael.com/

35.224.163.223

0 B

URL

rammichael.com/

IP / ASN

35.224.163.223

#15169 GOOGLE

Requested byN/A

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-02

Times Seen5605971

Size0 B (0 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate Info

IssuerLet's Encrypt

Subjectrammichael.com

FingerprintA1:5E:63:F7:BE:00:7B:DC:CC:69:B9:D9:D9:70:3A:72:25:41:09:A0

ValidityWed, 13 Dec 2023 09:29:33 GMT - Tue, 12 Mar 2024 09:29:32 GMT

HTTP Headers

GET / HTTP/1.1
Host: rammichael.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Date: Sat, 13 Jan 2024 15:19:06 GMT
Server: Apache/2.4.41 (Ubuntu)
X-Redirect-By: WordPress
Location: https://ramensoftware.com/
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET ramensoftware.com/wp-content/uploads/downloads/2023/09/textify_setup.exe

104.21.74.253

200 OK

607 kB

URL

ramensoftware.com/wp-content/uploads/downloads/2023/09/textify_setup.exe

IP / ASN

104.21.74.253

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

First Seen2023-09-03

Last Seen2025-02-23

Times Seen23

Size607 kB (607392 bytes)

MD5ad2619b201892e4c11dbd88d89d9a39f

SHA1897ca220cf649d0b6d9d781c6afdb7763ea1ebee

SHA25668d09e1a39da33a3ba80a2eec437d764bbe79026ab323f710f88e5f71bcddd0d

Certificate Info

IssuerCloudflare, Inc.

Subjectramensoftware.com

FingerprintDA:7F:1C:D5:AC:8E:5F:CB:5E:37:80:DB:09:CB:38:D0:BD:3D:69:29

ValidityTue, 26 Dec 2023 00:00:00 GMT - Wed, 25 Dec 2024 23:59:59 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe

HTTP Headers

GET /wp-content/uploads/downloads/2023/09/textify_setup.exe HTTP/1.1
Host: ramensoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 13 Jan 2024 15:19:08 GMT
content-type: application/x-msdos-program
content-length: 607392
last-modified: Fri, 01 Sep 2023 08:19:19 GMT
etag: "944a0-60447d1372a33"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VG8e1lsiK47%2BhmzjBnvVlr%2FHIKP2gyBJRNoSa7bGhnk9FG2C9S4LLGqQaGiarcnHlir2LsKOcliSBHBHjQwpktsqOS2W%2B88iHAn6ZRsLm2PNM7PmntIhD1Rp8YMSNW2nrKWkMw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 844e9d7c9f83712d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2