Report - cdn.discordapp.com/attachments/1258166379819958384/1272335405701664891/TDPremium.exe?ex=66db8faf&is=66da3e2f&hm=2a5521995dd97fed56cf87a81d27de9c1039bf84a976a93312c207b7f599af20&/

Report Overview

Visitedpublic

2024-09-06 05:19:50

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-09-05 18:12:32	1.3 kB	3.6 kB	23.36.76.226
cdn.discordapp.com	2474	2015-02-26	2015-08-24 15:06:21	2024-09-05 18:14:06	632 B	1.2 MB	162.159.129.233
r11.o.lencr.org	unknown	2020-06-29	2024-06-07 07:43:57	2024-09-05 18:12:13	654 B	1.8 kB	23.36.76.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

cdn.discordapp.com/attachments/1258166379819958384/1272335405701664891/TDPremium.exe?ex=66db8faf&is=66da3e2f&hm=2a5521995dd97fed56cf87a81d27de9c1039bf84a976a93312c207b7f599af20&/

IP / ASN

162.159.129.233

#13335 CLOUDFLARENET

File Overview

File TypePE32+ executable (console) x86-64, for MS Windows, 6 sections

Size1.2 MB (1200640 bytes)

MD553f178ea0c14b901bc30cc22687d384d

SHA1b27c9ced6419575d18e0be9a79985a1937a0e8c9

SHA256f2b707c3cf25fd49571811650b22df7f568b5cdc0c83988094599d0ece04e6c2

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 60/75

JavaScript (0)

HTTP Transactions (7)

URL IP Response Size

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-06

Last Seen2024-09-19

Times Seen23697

Size504 B (504 bytes)

MD5dedd67c0946c5577f4afe8ce915d496e

SHA113c7575ca041681cc467ada3cbcc8ac16d02a005

SHA25652d626e12edd115d218ff4e43f4fb3e9690effc7caaa9cfb673cd52a8c33728c

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "52D626E12EDD115D218FF4E43F4FB3E9690EFFC7CAAA9CFB673CD52A8C33728C"
Last-Modified: Thu, 05 Sep 2024 21:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18178
Expires: Fri, 06 Sep 2024 10:22:22 GMT
Date: Fri, 06 Sep 2024 05:19:24 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-05

Last Seen2024-09-19

Times Seen28522

Size504 B (504 bytes)

MD560ab18bb1e8dadb29ada046753dbc185

SHA13d30d0b2ba9061fbd90500510f6f514476a1413f

SHA25650ed93ddadd4c6c89fbf4bfa5bc29814434ab19ed98c11f4b558b68b570d49f2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "50ED93DDADD4C6C89FBF4BFA5BC29814434AB19ED98C11F4B558B68B570D49F2"
Last-Modified: Thu, 05 Sep 2024 00:20:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14631
Expires: Fri, 06 Sep 2024 09:23:15 GMT
Date: Fri, 06 Sep 2024 05:19:24 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-05

Last Seen2024-09-19

Times Seen14402

Size504 B (504 bytes)

MD582ed4f353a1fcebb658989118dd4c1fd

SHA138d42f944ef791a35cc533c5ae1de179914fd2fb

SHA256bad9cc283cd0ba6e1667ea32a79c9f5249de21d9facf6d394b8e239763fbbd64

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "BAD9CC283CD0BA6E1667EA32A79C9F5249DE21D9FACF6D394B8E239763FBBD64"
Last-Modified: Thu, 05 Sep 2024 02:37:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20772
Expires: Fri, 06 Sep 2024 11:05:36 GMT
Date: Fri, 06 Sep 2024 05:19:24 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-05

Last Seen2024-09-19

Times Seen17878

Size504 B (504 bytes)

MD5671f1028acb179b5ebb80735bb2ebb67

SHA1c538067f2b5654ceaac8fa6139ce69a5593bfe7d

SHA2566b3a32b0876d605a30290830bd74e993b27d75769d77a52f927a04418461bf22

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "6B3A32B0876D605A30290830BD74E993B27D75769D77A52F927A04418461BF22"
Last-Modified: Thu, 05 Sep 2024 02:33:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14910
Expires: Fri, 06 Sep 2024 09:27:54 GMT
Date: Fri, 06 Sep 2024 05:19:24 GMT
Connection: keep-alive

GET cdn.discordapp.com/attachments/1258166379819958384/1272335405701664891/TDPremium.exe?ex=66db8faf&is=66da3e2f&hm=2a5521995dd97fed56cf87a81d27de9c1039bf84a976a93312c207b7f599af20&/

162.159.129.233

200 OK

1.2 MB

URL

cdn.discordapp.com/attachments/1258166379819958384/1272335405701664891/TDPremium.exe?ex=66db8faf&is=66da3e2f&hm=2a5521995dd97fed56cf87a81d27de9c1039bf84a976a93312c207b7f599af20&/

IP / ASN

162.159.129.233

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typePE32+ executable (console) x86-64, for MS Windows, 6 sections

First Seen2024-07-16

Last Seen2025-05-12

Times Seen445

Size1.2 MB (1200640 bytes)

MD553f178ea0c14b901bc30cc22687d384d

SHA1b27c9ced6419575d18e0be9a79985a1937a0e8c9

SHA256f2b707c3cf25fd49571811650b22df7f568b5cdc0c83988094599d0ece04e6c2

Certificate Info

IssuerCloudflare, Inc.

Subjectdiscordapp.com

Fingerprint97:8B:EE:AD:1E:BF:A1:69:E7:94:29:F7:55:7A:29:64:19:C7:81:39

ValidityFri, 20 Oct 2023 00:00:00 GMT - Sat, 19 Oct 2024 23:59:59 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 60/75

HTTP Headers

GET /attachments/1258166379819958384/1272335405701664891/TDPremium.exe?ex=66db8faf&is=66da3e2f&hm=2a5521995dd97fed56cf87a81d27de9c1039bf84a976a93312c207b7f599af20&/ HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 06 Sep 2024 05:19:24 GMT
content-type: application/x-msdos-program
content-length: 1200640
cf-ray: 8bec0102cb2d0b31-OSL
cf-cache-status: HIT
accept-ranges: bytes, bytes
age: 2178740
cache-control: public, max-age=31536000
content-disposition: attachment; filename="TDPremium.exe"
etag: "53f178ea0c14b901bc30cc22687d384d"
expires: Sat, 06 Sep 2025 05:19:24 GMT
last-modified: Sun, 11 Aug 2024 23:26:39 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
x-goog-generation: 1723418799655421
x-goog-hash: crc32c=XaTeRw==, md5=U/F46gwUuQG8MMwiaH04TQ==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1200640
x-guploader-uploadid: AHxI1nNvVzRDKPHSU8F69E6q8eY8eaEydPBnOp7qSDDu4DSC42LIcLcoxVgrSNgw-HK3v9OC8CQ
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iEVRdQ3Aq%2BAtGrrDTfrJmrGrrUdbvO319NNO27wXyUs7Cd%2BuhrwGoppjbNCZ09b%2Fh9tju%2BmCGffDyRWULWJN5smiN0tY98XGztzqm3JmbjOv5S4%2FAWu0eRHhIwhOfKAoOm3%2BaA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
set-cookie: __cf_bm=vm0G4NCMApEQI2hRmtU8fsSmuW590.ZvoiWZ7EbJ0.4-1725599964-1.0.1.1-UKsxdZW9RU5XQVbVmDTXXy4AQlnMUsxf.XWor0pEOM4A5y5mmFnwFqH4w2ByuVfXUQnjKbBYj_nnVlc8OHHwyA; path=/; expires=Fri, 06-Sep-24 05:49:24 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
_cfuvid=HAR7nmh5szwsMlYghnnCDEvgTO_UMEB4ZEjOSywNv.k-1725599964641-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
X-Firefox-Spdy: h2

r11.o.lencr.org/

23.36.76.226

504 B

URL

r11.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-05

Last Seen2024-09-19

Times Seen12109

Size504 B (504 bytes)

MD5c3a113eae66e496e579294e612088a0e

SHA16fcb69472a3079365e84897cb649f1fd07d100bc

SHA2564da10a7cccf3dec0fc3b37fd97e0b5c7ee1eba3362f75c558c11a6bdb159a4e8

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "4DA10A7CCCF3DEC0FC3B37FD97E0B5C7EE1EBA3362F75C558C11A6BDB159A4E8"
Last-Modified: Thu, 05 Sep 2024 02:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3841
Expires: Fri, 06 Sep 2024 06:23:27 GMT
Date: Fri, 06 Sep 2024 05:19:26 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL

r11.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-05

Last Seen2024-09-19

Times Seen12109

Size504 B (504 bytes)

MD5c3a113eae66e496e579294e612088a0e

SHA16fcb69472a3079365e84897cb649f1fd07d100bc

SHA2564da10a7cccf3dec0fc3b37fd97e0b5c7ee1eba3362f75c558c11a6bdb159a4e8

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "4DA10A7CCCF3DEC0FC3B37FD97E0B5C7EE1EBA3362F75C558C11A6BDB159A4E8"
Last-Modified: Thu, 05 Sep 2024 02:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3841
Expires: Fri, 06 Sep 2024 06:23:27 GMT
Date: Fri, 06 Sep 2024 05:19:26 GMT
Connection: keep-alive