Report - files1.majorgeeks.com/3a52d9fb68de7e9e91bd75b095802a1f4a4f4894/input/gs-auto-clicker.exe

Report Overview

Visitedpublic

2025-01-08 14:22:41

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
files1.majorgeeks.com	unknown	2000-04-07	2012-06-02	2025-01-03	542 B	868 kB	51.81.2.249

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-01-08	medium	files1.majorgeeks.com/3a52d9fb68de7e9e91bd75b095802a1f4a4f4894/input/gs-auto-clicker.exe	Identifies compiled AutoIT script (as EXE).

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

files1.majorgeeks.com/3a52d9fb68de7e9e91bd75b095802a1f4a4f4894/input/gs-auto-clicker.exe

IP / ASN

51.81.2.249

#16276 OVH SAS

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

Size867 kB (867241 bytes)

MD56862f65be14fd3ce88086ec79777db6e

SHA17f0eb7535b59a926446a400ff93f48165b58ac95

SHA2567c90795c9b28fac978386626f5a54033dc9cba46ef6a3f742fc7d52b394590f2

Detections

Analyzer	Verdict	Alert
Public InfoSec YARA rules	malware	Identifies compiled AutoIT script (as EXE).
VirusTotal	suspicious	VirusTotal - Scan result 4/72

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET files1.majorgeeks.com/3a52d9fb68de7e9e91bd75b095802a1f4a4f4894/input/gs-auto-clicker.exe

51.81.2.249

200 OK

867 kB

URL

files1.majorgeeks.com/3a52d9fb68de7e9e91bd75b095802a1f4a4f4894/input/gs-auto-clicker.exe

IP / ASN

51.81.2.249

#16276 OVH SAS

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

First Seen2023-06-30

Last Seen2025-06-12

Times Seen170

Size867 kB (867241 bytes)

MD56862f65be14fd3ce88086ec79777db6e

SHA17f0eb7535b59a926446a400ff93f48165b58ac95

SHA2567c90795c9b28fac978386626f5a54033dc9cba46ef6a3f742fc7d52b394590f2

Certificate Info

IssuerLet's Encrypt

Subjectfiles1.majorgeeks.com

Fingerprint80:EF:8C:E9:A7:E5:8D:0D:68:11:4B:A0:6A:8F:6A:57:25:67:DF:4E

ValiditySat, 30 Nov 2024 18:54:24 GMT - Fri, 28 Feb 2025 18:54:23 GMT

Detections

Analyzer	Verdict	Alert
Public InfoSec YARA rules	malware	Identifies compiled AutoIT script (as EXE).
VirusTotal	suspicious	VirusTotal - Scan result 4/72

HTTP Headers

GET /3a52d9fb68de7e9e91bd75b095802a1f4a4f4894/input/gs-auto-clicker.exe HTTP/1.1
Host: files1.majorgeeks.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/x-msdos-program
accept-ranges: bytes
etag: "1180648580"
last-modified: Tue, 14 Sep 2021 16:35:03 GMT
content-length: 867241
date: Wed, 08 Jan 2025 14:22:16 GMT
server: lighttpd/1.4.59
X-Firefox-Spdy: h2