Report - cdn.discordapp.com/attachments/1243878395754844190/1244201500524281877/incognito.zip?ex=665591f1&is=66544071&hm=dc36cd1b10c4cfed0806b09d039a0a33c906070ec2c518ade680c323aa9e18a2&

Report Overview

Visited public
2024-05-27 20:00:58
Tags
URL
cdn.discordapp.com/attachments/1243878395754844190/1244201500524281877/incognito.zip?ex=665591f1&is=66544071&hm=dc36cd1b10c4cfed0806b09d039a0a33c906070ec2c518ade680c323aa9e18a2&
Finishing URL
about:privatebrowsing
IP / ASN
162.159.135.233
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

0

Network Intrusion Detection

0

Threat Detection Systems

3

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cdn.discordapp.com	2474	2015-02-26	2015-08-24 15:06:21	2024-05-27 18:12:26	631 B	20 MB	162.159.129.233

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
cdn.discordapp.com/attachments/1243878395754844190/1244201500524281877/incognito.zip?ex=665591f1&is=66544071&hm=dc36cd1b10c4cfed0806b09d039a0a33c906070ec2c518ade680c323aa9e18a2&
IP
162.159.129.233
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
20 MB (19682913 bytes)
Hash
f24aee225a6cea3616dd54cb23f52338
756e3e192ea0d8849fd293a22f5c4f8cfbb12ffd
4fd5453390d3915c066b008dfa65ffb47d3922c124b4d5c098324f95f8a934fa

Archive (16)

Filename

Md5

File type

test.txt

8117b088670ace343038cc9e404d5448

ASCII text

api-docs.json

19c541f355cad5fb427a38317479b698

JSON text data

incognito-luau.dll

157fd035b2a344a94166d7db3756df0e

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

save.json

877b13372acbf8bf740694d141d1aeb0

JSON text data

test.lua

45952b4f4540d4ea32b1a56b40dfcb54

ASCII text

thegreatestexploit.exe

985a7c5f0ee35a1984ed8b0c18847643

PE32+ executable (console) x86-64, for MS Windows, 7 sections

appendfile.txt

260ca9dd8a4577fc00b7bd5810298076

ASCII text, with no line terminators

getcustomasset.txt

260ca9dd8a4577fc00b7bd5810298076

ASCII text, with no line terminators

isfile.txt

260ca9dd8a4577fc00b7bd5810298076

ASCII text, with no line terminators

test_1.txt

260ca9dd8a4577fc00b7bd5810298076

ASCII text, with no line terminators

test_2.txt

260ca9dd8a4577fc00b7bd5810298076

ASCII text, with no line terminators

loadfile.txt

8fa14cdd754f91cc6554c9e71929cce7

very short file (no magic)

readfile.txt

260ca9dd8a4577fc00b7bd5810298076

ASCII text, with no line terminators

writefile

260ca9dd8a4577fc00b7bd5810298076

ASCII text, with no line terminators

writefile.txt

260ca9dd8a4577fc00b7bd5810298076

ASCII text, with no line terminators

test.txt

56cf8ffa2a808d7cf8a10beab3f69333

ASCII text, with no line terminators

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 25/68

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

cdn.discordapp.com/attachments/1243878395754844190/1244201500524281877/incognito.zip?ex=665591f1&is=66544071&hm=dc36cd1b10c4cfed0806b09d039a0a33c906070ec2c518ade680c323aa9e18a2&

162.159.129.233

200 OK

20 MB

URL User Request GET HTTP/2
cdn.discordapp.com/attachments/1243878395754844190/1244201500524281877/incognito.zip?ex=665591f1&is=66544071&hm=dc36cd1b10c4cfed0806b09d039a0a33c906070ec2c518ade680c323aa9e18a2&
IP
162.159.129.233:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerCloudflare, Inc.
Subjectdiscordapp.com
Fingerprint97:8B:EE:AD:1E:BF:A1:69:E7:94:29:F7:55:7A:29:64:19:C7:81:39
ValidityFri, 20 Oct 2023 00:00:00 GMT - Sat, 19 Oct 2024 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
20 MB (19682913 bytes)
Hash
f24aee225a6cea3616dd54cb23f52338
756e3e192ea0d8849fd293a22f5c4f8cfbb12ffd
4fd5453390d3915c066b008dfa65ffb47d3922c124b4d5c098324f95f8a934fa

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 25/68

HTTP Headers

GET /attachments/1243878395754844190/1244201500524281877/incognito.zip?ex=665591f1&is=66544071&hm=dc36cd1b10c4cfed0806b09d039a0a33c906070ec2c518ade680c323aa9e18a2& HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 27 May 2024 20:00:29 GMT
content-type: application/zip
content-length: 19682913
cf-ray: 88a897652eb856cb-OSL
cf-cache-status: HIT
accept-ranges: bytes, bytes
age: 127690
cache-control: public, max-age=31536000
content-disposition: attachment; filename="incognito.zip"
etag: "f24aee225a6cea3616dd54cb23f52338"
expires: Tue, 27 May 2025 20:00:29 GMT
last-modified: Sun, 26 May 2024 08:12:33 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
x-goog-generation: 1716711153939417
x-goog-hash: crc32c=sLtBFg==, md5=8kruIlps6jYW3VTLI/UjOA==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 19682913
x-guploader-uploadid: ABPtcPpFHncDqkKt8AS51iAGQnCfbQ8p7isas2lLxEDtUP4K1OlZ1rBqh70QNZEhUSVMdnaT3dFUpuaeVA
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JJBIBkEfMlU00Xh%2FAvyFVO65ENJ0q1ok%2FLqxZFOAbw0q0uWAHibV0N6lrl4JkETpVzItOacMIqE54UHNWLR8y0FhuxDQAXxRpuHYT4hJwvTRjjlGHyBnMFuaAeHrDwBOdZKBVA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
set-cookie: __cf_bm=mV6gMOXe3N0xok08kD1Lnulv.c_cynLM0.BZrWdpqhg-1716840029-1.0.1.1-Z3hQ19eyYFk9kkJD8Vgic4G89VukIo526r_5Nnl5AUDyjwBI0P2_QBqCaJswOVhCekDmOoY9C0NrDvE6IHVG2Q; path=/; expires=Mon, 27-May-24 20:30:29 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
_cfuvid=z4LH24TmYRDdAtOa08qkAX.pZhyxrTMywSkPgbt.CK8-1716840029022-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
X-Firefox-Spdy: h2