Report - cdn.discordapp.com/attachments/1167152973995049051/1264251872584269836/WaveInstaller.exe?ex=669d31cf&is=669be04f&hm=1abbb2fbcbe758db56a0a8ef91dd2d2e8e6c409b509f9a52e2bce9d901c3a149&

Report Overview

Visited public
2024-07-20 16:07:06
Tags
Submit Tags
URL
cdn.discordapp.com/attachments/1167152973995049051/1264251872584269836/WaveInstaller.exe?ex=669d31cf&is=669be04f&hm=1abbb2fbcbe758db56a0a8ef91dd2d2e8e6c409b509f9a52e2bce9d901c3a149&
Finishing URL
about:privatebrowsing
IP / ASN
162.159.134.233
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-19 18:12:05	1.6 kB	4.4 kB	23.36.76.226
cdn.discordapp.com	2474	2015-02-26	2015-08-24 15:06:21	2024-07-19 18:12:16	635 B	2.4 MB	162.159.129.233

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (6)

URL IP Response Size

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
df89293c476ae09fa6ea5ee32b70224e
e684c88f3ffd36b50489c5391a3637218329e080
1a09f23c5518140b3792a6c0729e19f7cd9c728016840567f7068b7df5bccb81

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "1A09F23C5518140B3792A6C0729E19F7CD9C728016840567F7068B7DF5BCCB81"
Last-Modified: Thu, 18 Jul 2024 08:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7076
Expires: Sat, 20 Jul 2024 18:04:35 GMT
Date: Sat, 20 Jul 2024 16:06:39 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
2c174cd9de141b9f3330d869df450834
251c8d7aa8126bfb9fa4c164ebb067b8929486f8
e79c4bb4566914535b10c91563e36d1768f5fc8e1933392cf130e2f4d776e296

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "E79C4BB4566914535B10C91563E36D1768F5FC8E1933392CF130E2F4D776E296"
Last-Modified: Thu, 18 Jul 2024 08:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2964
Expires: Sat, 20 Jul 2024 16:56:03 GMT
Date: Sat, 20 Jul 2024 16:06:39 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
9242083e8854242dd63e09c963159384
d334a9ec53be29ce2d3bbc333205b970b84d63fc
927ae834d942951b3ea3f7199aca87d589dee465706a095bcf7131de85d37e1c

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "927AE834D942951B3EA3F7199ACA87D589DEE465706A095BCF7131DE85D37E1C"
Last-Modified: Thu, 18 Jul 2024 07:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3563
Expires: Sat, 20 Jul 2024 17:06:03 GMT
Date: Sat, 20 Jul 2024 16:06:40 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
42e531d59be85c09ecc215208470d19e
75ec72c8c8e1de19407837d46d2ad7119770cdb0
38125115e22a9a58bf2df205bb09ae6c6fef4948b9de15b2f15f37d19aedf6a9

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "38125115E22A9A58BF2DF205BB09AE6C6FEF4948B9DE15B2F15F37D19AEDF6A9"
Last-Modified: Thu, 18 Jul 2024 07:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9082
Expires: Sat, 20 Jul 2024 18:38:02 GMT
Date: Sat, 20 Jul 2024 16:06:40 GMT
Connection: keep-alive

GET cdn.discordapp.com/attachments/1167152973995049051/1264251872584269836/WaveInstaller.exe?ex=669d31cf&is=669be04f&hm=1abbb2fbcbe758db56a0a8ef91dd2d2e8e6c409b509f9a52e2bce9d901c3a149&

162.159.129.233

200 OK

2.4 MB

URL User Request GET HTTP/2
cdn.discordapp.com/attachments/1167152973995049051/1264251872584269836/WaveInstaller.exe?ex=669d31cf&is=669be04f&hm=1abbb2fbcbe758db56a0a8ef91dd2d2e8e6c409b509f9a52e2bce9d901c3a149&
IP
162.159.129.233:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerCloudflare, Inc.
Subjectdiscordapp.com
Fingerprint97:8B:EE:AD:1E:BF:A1:69:E7:94:29:F7:55:7A:29:64:19:C7:81:39
ValidityFri, 20 Oct 2023 00:00:00 GMT - Sat, 19 Oct 2024 23:59:59 GMT

File type
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
Size
2.4 MB (2378752 bytes)
Hash
8ad8b6593c91d7960dad476d6d4af34f
0a95f110c8264cde7768a3fd76db5687fda830ea
43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 11/74

HTTP Headers

GET /attachments/1167152973995049051/1264251872584269836/WaveInstaller.exe?ex=669d31cf&is=669be04f&hm=1abbb2fbcbe758db56a0a8ef91dd2d2e8e6c409b509f9a52e2bce9d901c3a149& HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 20 Jul 2024 16:06:40 GMT
content-type: application/x-msdos-program
content-length: 2378752
cf-ray: 8a643325ae98b511-OSL
cf-cache-status: MISS
accept-ranges: bytes, bytes
cache-control: public, max-age=31536000
content-disposition: attachment; filename="WaveInstaller.exe"
etag: "8ad8b6593c91d7960dad476d6d4af34f"
expires: Sun, 20 Jul 2025 16:06:40 GMT
last-modified: Sat, 20 Jul 2024 16:05:35 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
x-goog-generation: 1721491535178011
x-goog-hash: crc32c=hDWNrQ==, md5=iti2WTyR15YNrUdtbUrzTw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 2378752
x-guploader-uploadid: ACJd0Nqr8XS8gYosbbwLqJhSrpnxvA2AapGYght8auJARBf3cio_pNJZXOgKdbwT5JaknncPOeE
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F4QjqqO1OY4F10qTbVdjtw2YuxE4F2fMyvj25HCRsLgF0Obb5C99FtaggeBavMBfpVz3bTNFpEn0e8e5elTEV8xrCw%2BwyQT6aeByutrc1ltm4Lk%2FsXB%2FOXBdd9o5qn0MmNTXRw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
set-cookie: __cf_bm=gDcOAiNtDGTEjSTUjj0.Q1YVfIeT42zigQsMdY7H2Q8-1721491600-1.0.1.1-tsWb0VomRaSJEsPU4W4LWe_atsz3Z.CbwZZP4gdTF004Ed0QzabXGTt2tOChG4LqGWp7oRUeMa75uCoLymlqdA; path=/; expires=Sat, 20-Jul-24 16:36:40 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
_cfuvid=Pj7g0gCApA144h2crij3PSVK9qmKP7lG5TB7fHmIX28-1721491600832-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
X-Firefox-Spdy: h2

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
1543efa0b06a3c4484d059961f9cf2d0
1aef10797a9524ff91b70e87f41e935a2dbf1917
a8fc1fb00fc3ee458f9a31d619be4cc4a9e7263f980deb8323a5a6ba69c03f8d

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A8FC1FB00FC3EE458F9A31D619BE4CC4A9E7263F980DEB8323A5A6BA69C03F8D"
Last-Modified: Thu, 18 Jul 2024 07:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8105
Expires: Sat, 20 Jul 2024 18:21:47 GMT
Date: Sat, 20 Jul 2024 16:06:42 GMT
Connection: keep-alive

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (6)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers