Report - cdn.discordapp.com/attachments/1369505603097198614/1369505706977525760/AcesClumsy.zip?ex=681c1b14&is=681ac994&hm=ded8013ef0ad782ef8470e9e1f3aea56466be432a59026d89568269dd6574daa&

Report Overview

Visitedpublic

2025-05-07 02:51:43

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
cdn.discordapp.com	2474	unknown	No data	No data	646 B	704 kB	162.159.130.233

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

cdn.discordapp.com/attachments/1369505603097198614/1369505706977525760/AcesClumsy.zip?ex=681c1b14&is=681ac994&hm=ded8013ef0ad782ef8470e9e1f3aea56466be432a59026d89568269dd6574daa&

IP / ASN

162.159.130.233

#13335 CLOUDFLARENET

File Overview

File TypeZip archive data, at least v1.0 to extract, compression method=store

Size702 kB (702488 bytes)

MD5e416bbc563df4c7e5d4305954b91597f

SHA18736366d4a1c05f894de48d3b9de4a53f1077850

SHA256d2b351465f1f1fdef96210507a5af2a8d8c25960767c3f8d4df8322c9450beec

Archive (5)

Modified	Filename	Size	MD5	File type
2024-02-28 00:59	clumsy.exe	409 kB	569614d4af64441c56e2f4849a6d7888	PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
2025-02-08 13:57	config.txt	463 B	de814545f69e3d191204609cad6aa689	ASCII text, with CRLF line terminators
2024-02-28 00:59	iup.dll	1.4 MB	dec712fb581b7c129a6a07910eff6c55	PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections
2024-02-28 00:59	SexDivert64.sys	86 kB	e5e52e2863582ef9ce03b6d78cf6860f	PE32+ executable (native) x86-64, for MS Windows, 7 sections
2025-02-08 13:59	WinDivert.dll	47 kB	04e1bb1d8ee18c71f0a65c09868560c5	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows, 9 sections

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects WinDivert User-Mode packet capturing driver
VirusTotal	suspicious	VirusTotal - Scan result 1/68

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET cdn.discordapp.com/attachments/1369505603097198614/1369505706977525760/AcesClumsy.zip?ex=681c1b14&is=681ac994&hm=ded8013ef0ad782ef8470e9e1f3aea56466be432a59026d89568269dd6574daa&

162.159.130.233

200 OK

702 kB

URL

cdn.discordapp.com/attachments/1369505603097198614/1369505706977525760/AcesClumsy.zip?ex=681c1b14&is=681ac994&hm=ded8013ef0ad782ef8470e9e1f3aea56466be432a59026d89568269dd6574daa&

IP / ASN

162.159.130.233

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeZip archive data, at least v1.0 to extract, compression method=store

First Seen2025-04-27

Last Seen2025-05-07

Times Seen2

Size702 kB (702488 bytes)

MD5e416bbc563df4c7e5d4305954b91597f

SHA18736366d4a1c05f894de48d3b9de4a53f1077850

SHA256d2b351465f1f1fdef96210507a5af2a8d8c25960767c3f8d4df8322c9450beec

Certificate Info

IssuerGoogle Trust Services

Subjectdiscordapp.com

Fingerprint2F:5F:0F:47:D0:0D:C1:87:16:29:BB:8D:62:E7:94:21:38:2D:16:5F

ValiditySat, 15 Mar 2025 04:05:12 GMT - Fri, 13 Jun 2025 05:05:09 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/68

HTTP Headers

GET /attachments/1369505603097198614/1369505706977525760/AcesClumsy.zip?ex=681c1b14&is=681ac994&hm=ded8013ef0ad782ef8470e9e1f3aea56466be432a59026d89568269dd6574daa& HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 07 May 2025 02:51:10 GMT
content-type: application/zip
content-length: 702488
cf-ray: 93bd69fcd8ceb4ed-OSL
cf-cache-status: HIT
accept-ranges: bytes, bytes
cache-control: public, max-age=31536000
content-disposition: attachment; filename="AcesClumsy.zip"
etag: "e416bbc563df4c7e5d4305954b91597f"
expires: Thu, 07 May 2026 02:51:10 GMT
last-modified: Wed, 07 May 2025 02:46:44 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
x-goog-generation: 1746586004813267
x-goog-hash: crc32c=l6mpIQ==, md5=5Ba7xWPfTH5dQwWVS5FZfw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 702488
x-guploader-uploadid: AAO2Vwqx7MMB7eIqwBfMQCrsxCrqFMyZAax45l-C0VwrFxLBN4yDcVNx6xlJcZm8cQcUYKqp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nOZ0FFA%2F3dS38imgC8MqIWE%2F984JU9UaJdQSLfnGVPJObv%2BnvKJM%2Bt7MUdMLRxdYWsBERudtxR4TO%2BRss%2FelvxqxV%2BWLnVUQUXMyYYmvqxAFxP0fmZfOC%2FtKDz0hAUVQaNy06g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
set-cookie: __cf_bm=n1hhHK6Ws3H8CBEMlpkfaUPilnnZtfsSIlB_KP1BMpU-1746586270-1.0.1.1-YmJDl8ZNO4MqGC8eed.Lq.Anjv3LDtecOjwDggn2MrsyUOgN6EssMNN7VHEZaXZp.zoIydDUSa5dpcrPS4of03UtnTocBKjMZW2Vvc_lyOY; path=/; expires=Wed, 07-May-25 03:21:10 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
_cfuvid=ta1f7w4F5J3TrxFdAGhORzKdYssK_8uUQSPCPSU_g40-1746586270386-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
X-Firefox-Spdy: h2