Report - download.copernic.com/dist/agent/updates/per03183/CopernicAgent-Build763-PERSO-ENG.exe?

Report Overview

Visited public
2023-09-14 00:32:43
Tags
URL
download.copernic.com/dist/agent/updates/per03183/CopernicAgent-Build763-PERSO-ENG.exe?
Finishing URL
about:privatebrowsing
IP / ASN
64.26.185.71
#812 ROGERS-COMMUNICATIONS
Title
about:privatebrowsing

Detections

urlquery

0

Network Intrusion Detection

1

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.godaddy.com	698	1999-03-02	2012-05-20 21:28:57	2023-09-13 18:20:54	330 B	2.6 kB	192.124.249.36
download.copernic.com	unknown	1997-08-08	2012-05-24 18:42:09	2023-07-26 13:26:21	543 B	4.8 MB	64.26.185.71

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-09-14 00:32:30	high	54.37.238.86	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
download.copernic.com/dist/agent/updates/per03183/CopernicAgent-Build763-PERSO-ENG.exe?
IP
64.26.185.71
ASN
#812 ROGERS-COMMUNICATIONS

File type
PE32 executable (GUI) Intel 80386, for MS Windows\012- data
Size
4.8 MB (4765128 bytes)
Hash
eacdfdb77a3e6ea19d4ef85274175460
d85a4d4cedf879d88c49de72c7b9c67bfddbc980
9337c710337ad17cf622ef24a37c3df8f6c74661f4d8046df12460a55a134e90

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	ocsp.godaddy.com/	192.124.249.36		2.1 kB
URL ocsp.godaddy.com/ IP 192.124.249.36:0 ASN #30148 SUCURI-SEC File type data Size 2.1 kB (2108 bytes) Hash 123f589fa1fc31390125666023071a64 d3ed97c33267af18e3e0db405ff74af1bf6d4e87 62ab666de3a4fc1fd2befb05821bdd2e8cb34c88b28d7a34fe8babd7ff3255ae HTTP Headers `POST / HTTP/1.1 Host: ocsp.godaddy.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 76 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Thu, 14 Sep 2023 00:32:25 GMT Content-Type: application/ocsp-response Content-Length: 2108 Connection: keep-alive X-Sucuri-ID: 19036 Content-Transfer-Encoding: Binary Cache-Control: public, no-transform, must-revalidate Last-Modified: Wed, 13 Sep 2023 03:31:55 GMT Expires: Thu, 14 Sep 2023 03:31:55 GMT ETag: "d3ed97c33267af18e3e0db405ff74af1bf6d4e87" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"`

	download.copernic.com/dist/agent/updates/per03183/CopernicAgent-Build763-PERSO-ENG.exe?	64.26.185.71	200 OK	4.8 MB
URL User Request GET HTTP/2 download.copernic.com/dist/agent/updates/per03183/CopernicAgent-Build763-PERSO-ENG.exe? IP 64.26.185.71:443 ASN #812 ROGERS-COMMUNICATIONS Certificate IssuerGoDaddy.com, Inc. Subjectregister.copernic.com Fingerprint83:DE:38:71:8B:E4:63:48:7E:E5:E3:35:46:0C:26:3E:5A:35:11:0C ValidityMon, 17 Apr 2023 19:34:00 GMT - Fri, 29 Mar 2024 14:17:21 GMT File type PE32 executable (GUI) Intel 80386, for MS Windows\012- data Size 4.8 MB (4765128 bytes) Hash eacdfdb77a3e6ea19d4ef85274175460 d85a4d4cedf879d88c49de72c7b9c67bfddbc980 9337c710337ad17cf622ef24a37c3df8f6c74661f4d8046df12460a55a134e90 HTTP Headers GET /dist/agent/updates/per03183/CopernicAgent-Build763-PERSO-ENG.exe? HTTP/1.1 Host: download.copernic.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/2 200 OK content-type: application/octet-stream last-modified: Tue, 03 May 2011 13:04:16 GMT accept-ranges: bytes etag: "f861379b929cc1:0" server: x-frame-options: SAMEORIGIN strict-transport-security: max-age=31536000 x-ua-compatible: IE=Edge date: Thu, 14 Sep 2023 00:33:48 GMT content-length: 4765128 X-Firefox-Spdy: h2`