Report - cdn.discordapp.com/attachments/1212127890444132432/1223024170481487882/release.zip?ex=66185904&is=6605e404&hm=c30fddbf7567dbfb2de22c391a994676c3d326438969e4e179053769b6d4bbe4&

Report Overview

Submitted URL
cdn.discordapp.com/attachments/1212127890444132432/1223024170481487882/release.zip?ex=66185904&is=6605e404&hm=c30fddbf7567dbfb2de22c391a994676c3d326438969e4e179053769b6d4bbe4&
IP
162.159.129.233
ASN
#13335 CLOUDFLARENET
Submitted
2024-03-28 21:47:24
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
3

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cdn.discordapp.com	2474	2015-02-26	2015-08-24	2024-03-27	629 B	126 kB	162.159.130.233
aus5.mozilla.org	2548	1998-01-24	2015-10-27	2024-03-27	511 B	6.5 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
cdn.discordapp.com/attachments/1212127890444132432/1223024170481487882/release.zip?ex=66185904&is=6605e404&hm=c30fddbf7567dbfb2de22c391a994676c3d326438969e4e179053769b6d4bbe4&
IP
162.159.130.233
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
124 kB (123896 bytes)
Hash
07248bd2c2c1f4b6351d674847e3b69e
0cebdc6f9ad26c9b8f9b4b75468127debba696e1
ef353462f62b510483e6208c91c80fd489fc81cc4bf6362e2b611aefb5c4d56f

Archive (5)

Filename

Md5

File type

DwmLutGUI.exe

3b4757e1a391ad8afe84a433ea044335

PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections

dwm_lut.dll

487a50fb72b574969794f7bc26dde0a9

PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows, 11 sections

LICENSE

1ebbd3e34237af26da5dc08a4e440464

ASCII text

LICENSE-THIRD-PARTY

2bd014bf5c375beb4a55f9ed038f9c71

ASCII text

WindowsDisplayAPI.dll

42b33b211f83246d7ea53420869d1733

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect pe file that no import table

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	cdn.discordapp.com/attachments/1212127890444132432/1223024170481487882/release.zip?ex=66185904&is=6605e404&hm=c30fddbf7567dbfb2de22c391a994676c3d326438969e4e179053769b6d4bbe4&	162.159.130.233	200 OK	124 kB
URL User Request GET HTTP/2 cdn.discordapp.com/attachments/1212127890444132432/1223024170481487882/release.zip?ex=66185904&is=6605e404&hm=c30fddbf7567dbfb2de22c391a994676c3d326438969e4e179053769b6d4bbe4& IP 162.159.130.233:443 ASN #13335 CLOUDFLARENET Certificate IssuerCloudflare, Inc. Subjectdiscordapp.com Fingerprint97:8B:EE:AD:1E:BF:A1:69:E7:94:29:F7:55:7A:29:64:19:C7:81:39 ValidityFri, 20 Oct 2023 00:00:00 GMT - Sat, 19 Oct 2024 23:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 124 kB (123896 bytes) Hash 07248bd2c2c1f4b6351d674847e3b69e 0cebdc6f9ad26c9b8f9b4b75468127debba696e1 ef353462f62b510483e6208c91c80fd489fc81cc4bf6362e2b611aefb5c4d56f HTTP Headers GET /attachments/1212127890444132432/1223024170481487882/release.zip?ex=66185904&is=6605e404&hm=c30fddbf7567dbfb2de22c391a994676c3d326438969e4e179053769b6d4bbe4& HTTP/1.1 Host: cdn.discordapp.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 200 OK date: Thu, 28 Mar 2024 21:46:59 GMT content-type: application/zip content-length: 123896 cf-ray: 86bad0e80a64569c-OSL cf-cache-status: MISS accept-ranges: bytes, bytes cache-control: public, max-age=31536000 content-disposition: attachment; filename="release.zip" etag: "07248bd2c2c1f4b6351d674847e3b69e" expires: Fri, 28 Mar 2025 21:46:59 GMT last-modified: Thu, 28 Mar 2024 21:41:24 GMT vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-goog-generation: 1711662084992412 x-goog-hash: crc32c=nG7osw==, md5=BySL0sLB9LY1HWdIR+O2ng== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 123896 x-guploader-uploadid: ABPtcPqJaFxZY7z6ARkodN5PLT1FWii3fGj-3DGGngnxTnLkDqNcz4b91SemY0KyRnLB6r56Kmc x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0bgBJioPdiHRzAoVHNjNm7RTUDvRXCbVcfwIEIPOqyY3tfvxew1AHzxvp5yT4E%2BJZwB0Hb015aWTdnUFbSVYCJj%2FEJ8orMegIPpbJqk8SoKulU%2BPwVfnBnnm3Rcu8MWqayRvig%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} set-cookie: __cf_bm=go4FnZkwjWE0g4Vc44.tcD1S.brsuaFyUwjtCxhTrME-1711662419-1.0.1.1-UE.SnFTNYN5J7k_Ck5izQ.EXdqZs13C445LvzfcPsNXT0WoXtCu7j0K8W9c9yPPQBvY7dt1nZiU8BcrRKUzW4A; path=/; expires=Thu, 28-Mar-24 22:16:59 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None _cfuvid=_VxP9spt9ogoSnwaBarsJX86evHCOokmH0E3.RXK7Go-1711662419754-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None server: cloudflare X-Firefox-Spdy: h2

	aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-97-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml	35.244.181.201		5.8 kB
URL aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-97-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml IP 35.244.181.201:0 ASN #396982 GOOGLE-CLOUD-PLATFORM File type gzip compressed data, max speed, from Unix Size 5.8 kB (5759 bytes) Hash 4f9d064ed130f33c665f77eec7ecf535 166630ee21d6f9ea9be41eabefb4026796860d36 5d4ad4b241d28f5ae8f0ef5b2d1feb6337b27d51c09c9e87dcdc334ffcfc556f HTTP Headers `GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-97-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1 Host: aus5.mozilla.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Pragma: no-cache Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site` HTTP/2 200 OK server: nginx date: Thu, 28 Mar 2024 21:47:18 GMT content-type: text/xml; charset=utf-8 vary: Accept-Encoding rule-id: unknown rule-data-version: unknown content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-04-29-22-13-57.chain; p384ecdsa=wCO8-hFwQZFz3PdIf_kmi4vKvR_r-fkHT_JoFTI601s_kNBCw64aPJvMo83opp68jQoarwLpGc74zr_YcNo536yZK8PE-t01omk30tDH5QHBxn97b5wdYr9jOkyoxRpQ strict-transport-security: max-age=31536000; x-content-type-options: nosniff content-security-policy: default-src 'none'; frame-ancestors 'none' x-proxy-cache-status: EXPIRED content-encoding: gzip via: 1.1 google cache-control: public,max-age=90 alt-svc: clear X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (5)

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers