Report - cdn.gomlab.com/gretech/promotion_sw/gomplayer/fastping_silent

Report Overview

Visitedpublic

2025-05-19 09:37:48

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
cdn.gomlab.com	unknown	2008-01-22	2017-02-03	2025-05-11	536 B	5.3 MB	163.171.128.100

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-05-19	medium	cdn.gomlab.com/gretech/promotion_sw/gomplayer/fastping_silent_v2.exe	Detect files is `SliverFox` malware

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

cdn.gomlab.com/gretech/promotion_sw/gomplayer/fastping_silent_v2.exe

IP / ASN

163.171.128.100

#54994 ML-1432-54994

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

Size5.3 MB (5295792 bytes)

MD5fbec5331fe536a064423a1f18b5707a2

SHA15e8d41bfc25c08afe66113b1cca8fec68d39a1d4

SHA2568c161cacf167c1e62e93ec3fcd45abfdaacde90f6aed4073ff7fc4c771dab98c

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware
VirusTotal	suspicious	VirusTotal - Scan result 1/72

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET cdn.gomlab.com/gretech/promotion_sw/gomplayer/fastping_silent_v2.exe

163.171.128.100

200 OK

5.3 MB

URL

cdn.gomlab.com/gretech/promotion_sw/gomplayer/fastping_silent_v2.exe

IP / ASN

163.171.128.100

#54994 ML-1432-54994

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

First Seen2025-05-19

Last Seen2025-05-20

Times Seen2

Size5.3 MB (5295792 bytes)

MD5fbec5331fe536a064423a1f18b5707a2

SHA15e8d41bfc25c08afe66113b1cca8fec68d39a1d4

SHA2568c161cacf167c1e62e93ec3fcd45abfdaacde90f6aed4073ff7fc4c771dab98c

Certificate Info

IssuerGlobalSign nv-sa

Subjectsupport18.cdnetworks.net

Fingerprint0E:6F:B4:89:A8:9D:11:70:E8:73:3A:98:1B:42:E4:BC:43:99:5E:E4

ValidityFri, 13 Sep 2024 01:32:05 GMT - Sat, 06 Sep 2025 02:17:29 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware
VirusTotal	suspicious	VirusTotal - Scan result 1/72

HTTP Headers

GET /gretech/promotion_sw/gomplayer/fastping_silent_v2.exe HTTP/1.1
Host: cdn.gomlab.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Mon, 19 May 2025 09:37:16 GMT
Content-Type: application/octet-stream
Content-Length: 5295792
Connection: keep-alive
Accept-Ranges: bytes
Last-Modified: Mon, 12 May 2025 07:10:10 GMT
Server: PWS/8.3.1.0.8
Cache-Control: max-age=300
Via: 1.1 PShgseSEL5gw137:7 (W), 1.1 PSdgflkfFRA1pa237:0 (W)
X-Px: ht PSdgflkfFRA1pa237FRA
x-ws-request-id: 682afbcb_kf104_28767-59492