Report - windows.clash.download/FlClash.exe

Report Overview

Visitedpublic

2025-05-17 18:19:13

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
windows.clash.download	unknown	2025-02-11	2025-04-03	2025-04-03	502 B	28 MB	104.18.15.143

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-05-17	medium	windows.clash.download/FlClash.exe	Detect pe file that no import table

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

windows.clash.download/FlClash.exe

IP / ASN

104.18.15.143

#13335 CLOUDFLARENET

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 11 sections

Size28 MB (27779907 bytes)

MD59d22d643c3e0a738a1a41453609f4705

SHA103f3ece3b73a04dc9f13f3b985e3105ee7135ea3

SHA256ebc6edfc71e257388ed2c6a957f74c8e423573695419c796e53072a04f1bbbfc

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect pe file that no import table

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET windows.clash.download/FlClash.exe

104.18.15.143

200 OK

28 MB

URL User Request GET HTTPS

windows.clash.download/FlClash.exe

IP / ASN

104.18.15.143

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 11 sections

First Seen2025-03-08

Last Seen2025-06-29

Times Seen3

Size28 MB (27779907 bytes)

MD59d22d643c3e0a738a1a41453609f4705

SHA103f3ece3b73a04dc9f13f3b985e3105ee7135ea3

SHA256ebc6edfc71e257388ed2c6a957f74c8e423573695419c796e53072a04f1bbbfc

Certificate Info

IssuerGoogle Trust Services

Subject757bc137.sni.cloudflaressl.com

Fingerprint18:E8:E3:7B:15:A7:6D:B6:F2:4A:07:FA:C1:6A:86:38:EE:37:D4:DD

ValiditySat, 12 Apr 2025 14:14:08 GMT - Fri, 11 Jul 2025 15:13:56 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect pe file that no import table

HTTP Headers

GET /FlClash.exe HTTP/1.1
Host: windows.clash.download
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 17 May 2025 18:18:43 GMT
content-type: application/x-ms-dos-executable
content-length: 27779907
cf-ray: 94151e6abcd10b55-OSL
cf-cache-status: HIT
accept-ranges: bytes
cache-control: public, max-age=16070400
etag: "449cf6b28a5bc474e602537307b7c4c8"
expires: Wed, 19 Nov 2025 18:18:42 GMT
last-modified: Thu, 01 May 2025 14:44:18 GMT
vary: Accept-Encoding
cf-apo-via: origin,host
server-timing: cfCacheStatus;desc="HIT"
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2