Report - down.goldensoft.org/GSAutoClicker.exe

Report Overview

Visitedpublic

2024-01-30 19:40:57

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
down.goldensoft.org	unknown	2008-04-03	2013-01-11 04:45:10	2023-07-01 02:38:44	491 B	868 kB	188.114.96.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-01-30	medium	down.goldensoft.org/GSAutoClicker.exe	meth_get_eip
2024-01-30	medium	down.goldensoft.org/GSAutoClicker.exe	Identifies compiled AutoIT script (as EXE).

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

down.goldensoft.org/GSAutoClicker.exe

IP / ASN

188.114.96.1

#13335 CLOUDFLARENET

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

Size867 kB (867241 bytes)

MD56862f65be14fd3ce88086ec79777db6e

SHA17f0eb7535b59a926446a400ff93f48165b58ac95

SHA2567c90795c9b28fac978386626f5a54033dc9cba46ef6a3f742fc7d52b394590f2

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
Public InfoSec YARA rules	malware	Identifies compiled AutoIT script (as EXE).
VirusTotal	suspicious	VirusTotal - Scan result 4/71

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET down.goldensoft.org/GSAutoClicker.exe

188.114.96.1

200 OK

867 kB

URL

down.goldensoft.org/GSAutoClicker.exe

IP / ASN

188.114.96.1

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

First Seen2023-06-30

Last Seen2025-06-12

Times Seen170

Size867 kB (867241 bytes)

MD56862f65be14fd3ce88086ec79777db6e

SHA17f0eb7535b59a926446a400ff93f48165b58ac95

SHA2567c90795c9b28fac978386626f5a54033dc9cba46ef6a3f742fc7d52b394590f2

Certificate Info

IssuerLet's Encrypt

Subjectgoldensoft.org

Fingerprint61:CF:47:A7:11:D8:31:9E:BF:44:04:2D:A9:AC:64:56:58:B2:15:80

ValidityWed, 03 Jan 2024 14:10:07 GMT - Tue, 02 Apr 2024 14:10:06 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
Public InfoSec YARA rules	malware	Identifies compiled AutoIT script (as EXE).
VirusTotal	suspicious	VirusTotal - Scan result 4/71

HTTP Headers

GET /GSAutoClicker.exe HTTP/1.1
Host: down.goldensoft.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 30 Jan 2024 19:40:32 GMT
content-type: application/octet-stream
content-length: 867241
last-modified: Mon, 30 May 2016 14:33:34 GMT
etag: "574c4f3e-d3ba9"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BGjcgapDD6VWCdKSVkcHMzsP%2BARen5Qera1W0NvBGqddQDJAmanAdZkuLVDQ641GPOEHEExLDwYqxYkuazoVaC0RKDbZklJAXzA8AIzPsn%2FMllbQidQ83ZY%2FeRsHOKi8ub5LWF4R"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 84dc2fe9d8c0b4f1-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2