Scan report · about 2 months agoPublic

tecnicoepc.com

192.232.219.67AS31898 · US

Submittedhttps://tecnicoepc.com/ok/

Landed onhttps://tecnicoepc.com/ok/Windows/invite.php· 1 redirect

page delivers an executable (https://files-accl.zoho…DSupport%22%3Afalse%7D)

brand impersonation (Zoom, medium); delivers a script, not an installer ("Zoomworkspace.bat")

Engine tags

Verdict

3 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 11.6 s · 7 requests

01 · Visitor openstecnicoepc.com/ok/

02 · Redirected · 1 hopSame host, another address/ok/Windows/invite.php

03 · Page shown

Zoom Client Updatestyled as Zoom · medium

04 · File delivered · suspiciousZoomworkspace.batfiles-accl.zohoexternal.comHanded over by the page, not served at the scanned address.

05 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Dangerous — confirmed threat

Automated

Its page title claims to be Zoom, which this address is not associated with. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

Zoomworkspace.bat

We analysed the file this page delivered — it is Suspicious.

Success

SHA-256 8533bc68d2ccc87146a47c274999d17b4968dc386d54bcad52dd432e83e13eec

SupportingPage delivers an executable under a document pretext

https://files-accl.zohoexternal.com/public/workdrive-external/download/7rxexac66af3a695f48f38625c677bac32258?x-cli-msg=%7B%22linkId%22%3A%224P7pLySmX9v-114qDl%22%2C%22isFileOwner%22%3Afalse%2C%22version%22%3A%221.0%22%2C%22isWDSupport%22%3Afalse%7D · brand impersonation (Zoom, medium); delivers a script, not an installer ("Zoomworkspace.bat")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

Zoom · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileSuspiciousZoomworkspace.bat

SHA-2568533bc68d2ccc87146a47c274999d17b4968dc386d54bcad52dd432e83e13eec

Fromhxxps://files-accl[.]zohoexternal[.]com/public/workdrive-external/download/7rxexac66af3a695f48f38625c677bac32258?x-cli-msg=%7B%22linkId%22%3A%224P7pLySmX9v-114qDl%22%2C%22isFileOwner%22%3Afalse%2C%22version%22%3A%221[.]0%22%2C%22isWDSupport%22%3Afalse%7D

Infrastructure

IP: 192.232.219.67ORACLE-BMC-31898 - Oracle Corporation, US · AS31898US
TLS: CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB · expires Oct 24, 2026
Redirects: 1 hop · /ok/ → /ok/Windows/invite.php

WHOIS

Registrar: GoDaddy.com, LLC
Created: Feb 20, 2013
Expires: Feb 20, 2034
Nameservers: ns6167.hostgator.comns6168.hostgator.com

125 malicious4 suspicious

Hashes & fingerprints

Page Hashd50ef78ba7739c037a0d69275b7cb85fda5a22f1154eaa1d17a3868d51f80bfe Favicon Hash406bc1aa52c9c1e14d60ad19c4f2a72308f3d0289d94269c5b78a892d71f3418 DOM Hash8084154a1413eaa8cd4620f811548d1cc56cf9f8b2b25609819195c5bd3cd3ba Screenshot pHashe626999966669999 JARM29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1 JA4Xa373a9f83c6b_7022c563de38_0321e8b32200 Cert ThumbprintFE525AD846C8607585E66DBA470F9BBA954C7202 Cert IssuerCN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB

Page capture

Live

Title “Zoom Client Update” · brand shown: Zoom (medium)

Visit Site

Engines

8 · time to verdict