Report - cdn.gilcdn.com/ContentMediaGenericFiles/b88fecb7839f3851932e0b00848e9bb8-Full.zip?w=1&h=1&Expires=1713338838&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvYjg4ZmVjYjc4MzlmMzg1MTkzMmUwYjAwODQ4ZTliYjgtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxMzMzODgzOH19fV19&Signature=VI32qBljBzHLgZFRafx8cHf1lh5~xhZ3-unNoekaF00Yxzs8y227kS8Ta~l4ZFHiU~2ddESLINj1dXY4MDPVIMSVIqHS4UelDnux55QPk~r5nFDty6Ts02A-a53yanukeuQDemWtwVWq00G4RtDVjXNgjTJz5JGKNKPw2ZpxnOZf~VGDpN7UlsbydPIQsbRSAE7jjesl~82lc1eglbTtTs6CBohgRWRmoRV9IQc1Hd6qUhn3jl0ra~QMw9ibnb8if1Y1nWn12U4etG7rWJKdSXemXnSrQDuqK6OuAahfjsWELywZRQdhIAl5sNL1Cdvpx40Px9IR7dlv52n0K3yfwA_

Report Overview

Submitted URL
cdn.gilcdn.com/ContentMediaGenericFiles/b88fecb7839f3851932e0b00848e9bb8-Full.zip?w=1&h=1&Expires=1713338838&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvYjg4ZmVjYjc4MzlmMzg1MTkzMmUwYjAwODQ4ZTliYjgtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxMzMzODgzOH19fV19&Signature=VI32qBljBzHLgZFRafx8cHf1lh5~xhZ3-unNoekaF00Yxzs8y227kS8Ta~l4ZFHiU~2ddESLINj1dXY4MDPVIMSVIqHS4UelDnux55QPk~r5nFDty6Ts02A-a53yanukeuQDemWtwVWq00G4RtDVjXNgjTJz5JGKNKPw2ZpxnOZf~VGDpN7UlsbydPIQsbRSAE7jjesl~82lc1eglbTtTs6CBohgRWRmoRV9IQc1Hd6qUhn3jl0ra~QMw9ibnb8if1Y1nWn12U4etG7rWJKdSXemXnSrQDuqK6OuAahfjsWELywZRQdhIAl5sNL1Cdvpx40Px9IR7dlv52n0K3yfwA__&Key-Pair-Id=K1FFKFZRWAZSB
IP
108.157.214.125
ASN
#16509 AMAZON-02
Submitted
2024-04-17 07:23:07
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
3

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.r2m03.amazontrust.com	unknown	2007-05-11	2023-02-21	2024-04-16	338 B	942 B	3.164.222.26
cdn.gilcdn.com	unknown	2023-12-13	2023-12-15	2024-04-16	1.2 kB	161 kB	108.157.214.66

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
cdn.gilcdn.com/ContentMediaGenericFiles/b88fecb7839f3851932e0b00848e9bb8-Full.zip?w=1&h=1&Expires=1713338838&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvYjg4ZmVjYjc4MzlmMzg1MTkzMmUwYjAwODQ4ZTliYjgtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxMzMzODgzOH19fV19&Signature=VI32qBljBzHLgZFRafx8cHf1lh5~xhZ3-unNoekaF00Yxzs8y227kS8Ta~l4ZFHiU~2ddESLINj1dXY4MDPVIMSVIqHS4UelDnux55QPk~r5nFDty6Ts02A-a53yanukeuQDemWtwVWq00G4RtDVjXNgjTJz5JGKNKPw2ZpxnOZf~VGDpN7UlsbydPIQsbRSAE7jjesl~82lc1eglbTtTs6CBohgRWRmoRV9IQc1Hd6qUhn3jl0ra~QMw9ibnb8if1Y1nWn12U4etG7rWJKdSXemXnSrQDuqK6OuAahfjsWELywZRQdhIAl5sNL1Cdvpx40Px9IR7dlv52n0K3yfwA__&Key-Pair-Id=K1FFKFZRWAZSB
IP
108.157.214.66
ASN
#16509 AMAZON-02

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
160 kB (160331 bytes)
Hash
b88fecb7839f3851932e0b00848e9bb8
5ee7a8a49a355323ab49a91139f8b2b4c22d4a0f
6fd6379a29472d51e19d15aab2d07010bb4810f7d2c5fe1a5b32c608583023e1

Archive (1)

Filename

Md5

File type

FPSCleaner.exe

ba640575cb1b15794aecf8762c0b9783

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detetcs the Nanocore RAT
Public Nextron YARA rules	malware	Detects Nanocore RAT
Elastic Security YARA Rules	malware	Windows.Trojan.Nanocore

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	ocsp.r2m03.amazontrust.com/	3.164.222.26		471 B
URL ocsp.r2m03.amazontrust.com/ IP 3.164.222.26:0 ASN #0 File type data Size 471 B (471 bytes) Hash c8d5e9501237ec3c7e0761f4f415d14f 3b4687c26a29c65617b176a077ae2e10a5c208c8 5c75c5db6f5b3c0ddec46e13bddeeedfb561c19c3566ec4fceea4a99c2fd40fc HTTP Headers `POST / HTTP/1.1 Host: ocsp.r2m03.amazontrust.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Accept-Ranges: bytes Cache-Control: max-age=7200 Date: Wed, 17 Apr 2024 07:22:42 GMT Last-Modified: Wed, 17 Apr 2024 06:17:01 GMT Server: ECAcc (ska/F6CC) X-Cache: Miss from cloudfront Via: 1.1 3ed36d9549564152ef96812502a86608.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ARN53-P1 X-Amz-Cf-Id: qaAzo7Rbm1X6beGSgxairfAnjizY2pZFE-tHvQyULnFQTDqFCdx1cw== Age: 3941`

	cdn.gilcdn.com/ContentMediaGenericFiles/b88fecb7839f3851932e0b00848e9bb8-Full.zip?w=1&h=1&Expires=1713338838&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvYjg4ZmVjYjc4MzlmMzg1MTkzMmUwYjAwODQ4ZTliYjgtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxMzMzODgzOH19fV19&Signature=VI32qBljBzHLgZFRafx8cHf1lh5~xhZ3-unNoekaF00Yxzs8y227kS8Ta~l4ZFHiU~2ddESLINj1dXY4MDPVIMSVIqHS4UelDnux55QPk~r5nFDty6Ts02A-a53yanukeuQDemWtwVWq00G4RtDVjXNgjTJz5JGKNKPw2ZpxnOZf~VGDpN7UlsbydPIQsbRSAE7jjesl~82lc1eglbTtTs6CBohgRWRmoRV9IQc1Hd6qUhn3jl0ra~QMw9ibnb8if1Y1nWn12U4etG7rWJKdSXemXnSrQDuqK6OuAahfjsWELywZRQdhIAl5sNL1Cdvpx40Px9IR7dlv52n0K3yfwA__&Key-Pair-Id=K1FFKFZRWAZSB	108.157.214.66	200 OK	160 kB
URL User Request GET HTTP/2 cdn.gilcdn.com/ContentMediaGenericFiles/b88fecb7839f3851932e0b00848e9bb8-Full.zip?w=1&h=1&Expires=1713338838&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvYjg4ZmVjYjc4MzlmMzg1MTkzMmUwYjAwODQ4ZTliYjgtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxMzMzODgzOH19fV19&Signature=VI32qBljBzHLgZFRafx8cHf1lh5~xhZ3-unNoekaF00Yxzs8y227kS8Ta~l4ZFHiU~2ddESLINj1dXY4MDPVIMSVIqHS4UelDnux55QPk~r5nFDty6Ts02A-a53yanukeuQDemWtwVWq00G4RtDVjXNgjTJz5JGKNKPw2ZpxnOZf~VGDpN7UlsbydPIQsbRSAE7jjesl~82lc1eglbTtTs6CBohgRWRmoRV9IQc1Hd6qUhn3jl0ra~QMw9ibnb8if1Y1nWn12U4etG7rWJKdSXemXnSrQDuqK6OuAahfjsWELywZRQdhIAl5sNL1Cdvpx40Px9IR7dlv52n0K3yfwA__&Key-Pair-Id=K1FFKFZRWAZSB IP 108.157.214.66:443 ASN #16509 AMAZON-02 Certificate IssuerAmazon Subject.gilcdn.com FingerprintB6:3B:AA:24:2D:F6:F2:2D:66:81:B5:0E:46:3F:D8:31:FD:D4:75:49 ValidityThu, 14 Dec 2023 00:00:00 GMT - Sat, 11 Jan 2025 23:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 160 kB (160331 bytes) Hash b88fecb7839f3851932e0b00848e9bb8 5ee7a8a49a355323ab49a91139f8b2b4c22d4a0f 6fd6379a29472d51e19d15aab2d07010bb4810f7d2c5fe1a5b32c608583023e1 HTTP Headers GET /ContentMediaGenericFiles/b88fecb7839f3851932e0b00848e9bb8-Full.zip?w=1&h=1&Expires=1713338838&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvYjg4ZmVjYjc4MzlmMzg1MTkzMmUwYjAwODQ4ZTliYjgtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxMzMzODgzOH19fV19&Signature=VI32qBljBzHLgZFRafx8cHf1lh5~xhZ3-unNoekaF00Yxzs8y227kS8Ta~l4ZFHiU~2ddESLINj1dXY4MDPVIMSVIqHS4UelDnux55QPk~r5nFDty6Ts02A-a53yanukeuQDemWtwVWq00G4RtDVjXNgjTJz5JGKNKPw2ZpxnOZf~VGDpN7UlsbydPIQsbRSAE7jjesl~82lc1eglbTtTs6CBohgRWRmoRV9IQc1Hd6qUhn3jl0ra~QMw9ibnb8if1Y1nWn12U4etG7rWJKdSXemXnSrQDuqK6OuAahfjsWELywZRQdhIAl5sNL1Cdvpx40Px9IR7dlv52n0K3yfwA__&Key-Pair-Id=K1FFKFZRWAZSB HTTP/1.1 Host: cdn.gilcdn.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 200 OK content-type: application/x-zip-compressed content-length: 160331 date: Wed, 17 Apr 2024 07:22:43 GMT last-modified: Wed, 17 Apr 2024 07:22:19 GMT etag: "b88fecb7839f3851932e0b00848e9bb8" x-amz-storage-class: INTELLIGENT_TIERING x-amz-server-side-encryption: AES256 cache-control: public,max-age=31536000,immutable content-disposition: attachment; filename=FPSCleaner.zip x-amz-meta-jsonsecure: 8c91686e7031f0aedf0569c6f9d05e0e5e39c502c89fbf6a88d921d8cd592d818f6dc036bb1acaec44c43b8d0f6c61d818fb140f723e63ef29d1cecc2e7297c679de603a9b2b53c289d8e8a62c4fc0adc47ccc3e8892e92fb3.178d211187f45f183af653fe183742c3.efb42620c114f7a1816c833611487ef9c21d0e9a9477fd7c86ae20c5ede6c194 x-amz-version-id: 2Sh5cbAPU.Xn5pJBTOQF7InITcEk1NTM accept-ranges: bytes server: AmazonS3 x-cache: Miss from cloudfront via: 1.1 419f3eb3d74bedebbef6fc91b3f54a36.cloudfront.net (CloudFront) x-amz-cf-pop: ARN56-P1 alt-svc: h3=":443"; ma=86400 x-amz-cf-id: RsI0u5bz3Y05McK_oSGWjyiI5-GpkuznYRl341J7gAFifB_LNbq-AQ== vary: Origin X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (1)

Detections

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers