Report - cdn-usw004.manage.trellix.com/Software/Current/ENDP_AM_1070/Install/0000/setupTP.exe?hash=2FFEBFB3569B8A3C785AC1B90DCB5145E3F5CD96

Report Overview

Visitedpublic

2024-05-21 06:42:34

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
cdn-usw004.manage.trellix.com	unknown	1996-09-04	2022-12-06 06:11:54	2024-03-18 12:56:23	584 B	891 kB	54.230.111.128

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-05-21	medium	cdn-usw004.manage.trellix.com/Software/Current/ENDP_AM_1070/Install/0000/setupTP.exe?hash=2FFEBFB3569B8A3C785AC1B90DCB5145E3F5CD96	files - file ~tmp01925d3f.exe

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

cdn-usw004.manage.trellix.com/Software/Current/ENDP_AM_1070/Install/0000/setupTP.exe?hash=2FFEBFB3569B8A3C785AC1B90DCB5145E3F5CD96

IP / ASN

54.230.111.128

#16509 AMAZON-02

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 7 sections

Size890 kB (890136 bytes)

MD562097caefeb0170eba071c7d250f30ec

SHA12ffebfb3569b8a3c785ac1b90dcb5145e3f5cd96

SHA256e684745527cdb3776b081f4888de49c95d61326cd86a03c33310b9854e961ab7

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
VirusTotal	suspicious	VirusTotal - Scan result 1/73

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET cdn-usw004.manage.trellix.com/Software/Current/ENDP_AM_1070/Install/0000/setupTP.exe?hash=2FFEBFB3569B8A3C785AC1B90DCB5145E3F5CD96

54.230.111.128

200 OK

890 kB

URL User Request GET HTTPS

cdn-usw004.manage.trellix.com/Software/Current/ENDP_AM_1070/Install/0000/setupTP.exe?hash=2FFEBFB3569B8A3C785AC1B90DCB5145E3F5CD96

IP / ASN

54.230.111.128

#16509 AMAZON-02

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 7 sections

First Seen2024-05-10

Last Seen2025-01-08

Times Seen9

Size890 kB (890136 bytes)

MD562097caefeb0170eba071c7d250f30ec

SHA12ffebfb3569b8a3c785ac1b90dcb5145e3f5cd96

SHA256e684745527cdb3776b081f4888de49c95d61326cd86a03c33310b9854e961ab7

Certificate Info

IssuerSectigo Limited

Subjectmanage.trellix.com

Fingerprint9D:F9:FA:1F:4F:53:ED:05:A8:98:91:0D:4D:52:E2:3A:21:99:A3:69

ValidityFri, 26 Apr 2024 00:00:00 GMT - Sat, 26 Apr 2025 23:59:59 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
VirusTotal	suspicious	VirusTotal - Scan result 1/73

HTTP Headers

GET /Software/Current/ENDP_AM_1070/Install/0000/setupTP.exe?hash=2FFEBFB3569B8A3C785AC1B90DCB5145E3F5CD96 HTTP/1.1
Host: cdn-usw004.manage.trellix.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/x-msdownload
content-length: 890136
date: Tue, 21 May 2024 06:42:10 GMT
last-modified: Mon, 13 May 2024 05:39:30 GMT
etag: "62097caefeb0170eba071c7d250f30ec"
x-amz-server-side-encryption: AES256
x-amz-version-id: AvPN7zbARNL5kXlBWBblwQAwfAmIzf5B
accept-ranges: bytes
server: AmazonS3
x-cache: Miss from cloudfront
via: 1.1 c2b101e67ac25a2f0013450d56ecac38.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: dlKH8WCsraW_cjNZCfsiIaduam6vyVRUOLfoEBHOf-oCPxMCr204aw==
X-Firefox-Spdy: h2