Report - s3.romstation.fr/romstation/application/downloads/2.9.2/romstation-windows-x64.exe

Report Overview

Visitedpublic

2024-10-30 20:12:32

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
s3.romstation.fr	unknown	2007-12-18	2023-03-29	2023-08-18	538 B	239 kB	51.159.19.127

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-10-30	medium	s3.romstation.fr/romstation/application/downloads/2.9.2/romstation-windows-x64.exe	pe_detect_tls_callbacks
2024-10-30	medium	s3.romstation.fr/romstation/application/downloads/2.9.2/romstation-windows-x64.exe	Detect pe file that no import table

OpenPhish

No alerts detected

PhishTank

No alerts detected

Mnemonic Secure DNS

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

s3.romstation.fr/romstation/application/downloads/2.9.2/romstation-windows-x64.exe

IP / ASN

51.159.19.127

#12876 Scaleway S.a.s.

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 10 sections

Size238 kB (238359 bytes)

MD5704d6ef50e9c46ae935ca9efb56952bc

SHA1a5f890b9418830924dd39bc2d361e2e273485209

SHA256d46c79a6f92ce45dec847e81198dcd8f60389ad40a4ec15231067c210b8aa220

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	pe_detect_tls_callbacks
YARAhub by abuse.ch	malware	Detect pe file that no import table

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET s3.romstation.fr/romstation/application/downloads/2.9.2/romstation-windows-x64.exe

51.159.19.127

200 OK

238 kB

URL

s3.romstation.fr/romstation/application/downloads/2.9.2/romstation-windows-x64.exe

IP / ASN

51.159.19.127

#12876 Scaleway S.a.s.

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 10 sections

First Seen2024-10-30

Last Seen2024-10-30

Times Seen1

Size238 kB (238359 bytes)

MD5704d6ef50e9c46ae935ca9efb56952bc

SHA1a5f890b9418830924dd39bc2d361e2e273485209

SHA256d46c79a6f92ce45dec847e81198dcd8f60389ad40a4ec15231067c210b8aa220

Certificate Info

IssuerLet's Encrypt

Subject*.romstation.fr

Fingerprint30:2E:5A:EB:63:4C:BB:62:1A:8B:A6:E4:ED:6E:35:19:7A:69:B6:AF

ValidityMon, 30 Sep 2024 12:39:13 GMT - Sun, 29 Dec 2024 12:39:12 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	pe_detect_tls_callbacks
YARAhub by abuse.ch	malware	Detect pe file that no import table

HTTP Headers

GET /romstation/application/downloads/2.9.2/romstation-windows-x64.exe HTTP/1.1
Host: s3.romstation.fr
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 30 Oct 2024 20:12:07 GMT
Server: Apache
Last-Modified: Tue, 28 Mar 2023 17:10:01 GMT
ETag: "f9309bb-5f7f8ee0a8e8b"
Accept-Ranges: bytes
Content-Length: 261294523
Content-Type: application/x-msdos-program