| extractnow.com/extractnow.exe |  172.67.205.29 | 200 OK | 2.1 MB |
URL User Request GET HTTP/3extractnow.com/extractnow.exe IP172.67.205.29:443
CertificateIssuerGoogle Trust Services LLC Subjectextractnow.com Fingerprint90:20:3A:45:88:83:CD:3E:75:2C:17:B0:1B:45:4C:56:34:41:B6:2E ValidityFri, 29 Mar 2024 22:30:09 GMT - Thu, 27 Jun 2024 22:30:08 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections Size2.1 MB (2113075 bytes) Hash6f0de6999b636153b65ff67c2459bf6d 07c70e0d73b1f34effd5bb23b8e0287fd033ffd3 539c28b4fe59cf8969f2347463aa791e2cf434275084cdf9ff7084ebe3a4c232
| Analyzer | Verdict | Alert |
|---|
| YARAhub by abuse.ch | malware | Detect files is `SliverFox` malware |
GET /extractnow.exe HTTP/1.1
Host: extractnow.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 24 Apr 2024 09:45:06 GMT
content-type: application/octet-stream
content-length: 2113075
last-modified: Sat, 08 Oct 2022 22:16:48 GMT
access-control-allow-origin: *
etag: "6341f6d0-203e33"
expires: Wed, 24 Apr 2024 09:55:06 GMT
cache-control: max-age=14400
x-proxy-cache: MISS
x-github-request-id: 48F0:0E6C:18524E:18BB77:6628D49F
via: 1.1 varnish
x-served-by: cache-osl6532-OSL
x-cache: MISS
x-cache-hits: 0
x-timer: S1713951906.488242,VS0,VE199
vary: Accept-Encoding
x-fastly-request-id: b1b94518ed477e32aa8a974a7530c364b312b945
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rIiY4t%2FfiyhUlXQJllpuP7Jrd%2B0PnTjK6GeIutVI%2F5b7Etbpvatm1pCTF71LcUIm3IDIoJxXcSZLk9KArhXDSIIBIclYtDB8vbsldS5O0VR7TIENUBDqyd9e9QiQfHHoWA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879528973d22568f-OSL
alt-svc: h3=":443"; ma=86400
|
| www.extractnow.com/extractnow.exe | 172.67.205.29 | 301 Moved Permanently | 2.1 MB |
URL User Request GET HTTP/2www.extractnow.com/extractnow.exe IP172.67.205.29:443
CertificateIssuerGoogle Trust Services LLC Subjectextractnow.com Fingerprint90:20:3A:45:88:83:CD:3E:75:2C:17:B0:1B:45:4C:56:34:41:B6:2E ValidityFri, 29 Mar 2024 22:30:09 GMT - Thu, 27 Jun 2024 22:30:08 GMT
Size2.1 MB (2113075 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /extractnow.exe HTTP/1.1
Host: www.extractnow.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Wed, 24 Apr 2024 09:45:06 GMT
content-type: text/html
location: https://extractnow.com/extractnow.exe
x-github-request-id: 3440:219E53:46F99B2:48770BB:6628D49F
via: 1.1 varnish
x-served-by: cache-osl6534-OSL
x-cache: MISS
x-cache-hits: 0
x-timer: S1713951906.261428,VS0,VE113
vary: Accept-Encoding
x-fastly-request-id: 57e055806644ccdfcbc12f6cda365162c355e27c
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XY6E5SHuw%2Fbpg8g%2Bi5aU6FGOTHHQ4dQGJVdwZGccydainuxhhdRQgPGWQ32Ru%2F435jnlO0JeoiDI4mbezwW3Cla5jFbfb0wvGG1aGaNKgOp92LHL7YD02dr%2Fh1cd4VdK0Z18Cfw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879528960fd9568d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|