Report - downloads.nordcdn.com/apps/windows/NordVPN/latest/NordInstaller.exe

Report Overview

Visitedpublic

2025-02-22 14:54:58

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
downloads.nordcdn.com	21630	2016-09-20	2017-06-08	2025-02-15	533 B	676 B	104.16.155.111
downloads77-windows.nordcdn.com	unknown	2016-09-20	2024-06-26	2025-02-15	543 B	1.8 MB	95.173.205.15

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

downloads77-windows.nordcdn.com/apps/windows/NordVPN/latest/NordInstaller.exe

IP / ASN

95.173.205.15

#60068 Datacamp Limited

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 10 sections

Size1.8 MB (1752408 bytes)

MD593351749ff556cf106ddadce6daf9aea

SHA159c986051e3639a2eb4ca07dd5c555853de66b99

SHA25620c7bd657c6d318e4bee2526eeff396d8bca3788163f3819207214a19600dcaf

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/75

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET downloads.nordcdn.com/apps/windows/NordVPN/latest/NordInstaller.exe

104.16.155.111

302 Found

143 B

URL User Request GET HTTPS

downloads.nordcdn.com/apps/windows/NordVPN/latest/NordInstaller.exe

IP / ASN

104.16.155.111

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen0001-01-01

Last Seen2025-03-02

Times Seen9611

Size143 B (143 bytes)

MD5cb7b8f439b04c00f4a2d78160ddfee8d

SHA19aa44b5d68f6359f10de0dcd24ea3e12548d9bd4

SHA25612755429beb15d5eb57eafa45b8dba326343dd099bf0552038694c3856e8860e

Certificate Info

IssuerGlobalSign nv-sa

Subject*.nordcdn.com

FingerprintFC:BA:D7:60:54:5A:CD:38:1E:4A:BE:ED:23:D4:9B:E8:21:D5:12:F3

ValidityWed, 13 Mar 2024 07:15:41 GMT - Mon, 14 Apr 2025 07:15:40 GMT

HTTP Headers

GET /apps/windows/NordVPN/latest/NordInstaller.exe HTTP/1.1
Host: downloads.nordcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Sat, 22 Feb 2025 14:54:27 GMT
content-type: text/html
content-length: 143
location: https://downloads77-windows.nordcdn.com/apps/windows/NordVPN/latest/NordInstaller.exe
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
server: cloudflare
cf-ray: 915fcfc01ecc56ca-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET downloads77-windows.nordcdn.com/apps/windows/NordVPN/latest/NordInstaller.exe

95.173.205.15

200 OK

1.8 MB

URL User Request GET HTTPS

downloads77-windows.nordcdn.com/apps/windows/NordVPN/latest/NordInstaller.exe

IP / ASN

95.173.205.15

#60068 Datacamp Limited

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 10 sections

First Seen2024-10-13

Last Seen2025-02-22

Times Seen36

Size1.8 MB (1752408 bytes)

MD593351749ff556cf106ddadce6daf9aea

SHA159c986051e3639a2eb4ca07dd5c555853de66b99

SHA25620c7bd657c6d318e4bee2526eeff396d8bca3788163f3819207214a19600dcaf

Certificate Info

IssuerLet's Encrypt

Subject1241401331.rsc.cdn77.org

FingerprintA2:17:5D:07:DC:C6:93:C2:BE:9A:7B:3E:C3:7E:06:AD:CB:50:F8:1A

ValidityTue, 17 Dec 2024 12:53:00 GMT - Mon, 17 Mar 2025 12:52:59 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/75

HTTP Headers

GET /apps/windows/NordVPN/latest/NordInstaller.exe HTTP/1.1
Host: downloads77-windows.nordcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 22 Feb 2025 14:54:28 GMT
content-type: application/octet-stream
content-length: 1752408
last-modified: Tue, 28 Jan 2025 08:08:58 GMT
etag: 6798909a1abd58
x-authorization: key-id="rsa-key-1",algorithm="rsa-sha256"
x-digest: 20c7bd657c6d318e4bee2526eeff396d8bca3788163f3819207214a19600dcaf
x-accept-before: 1739928429
x-signature: YFpu/y1mrso+dnHdZRmJtNOWgmpeb6MEFvUkn/cc7k99hCuT2GqGPjlxVBJGc3HhS9gRMpg+VdPvSUKbCWGTGEDuYCYXw9/P83HyUoOkjPnPByyi171So472lS9TTsPlaqYlywhCfNTZVpM+wH/DIy0IKPi4yWtNqLJtTvSMWuBo2qDU9xYZB063o533J3Am4fqtIX55YuvFVvD3hMG9KKAwon7R28fQxrrXYGVlHd361Sy2Lehkcli69y1DYU/CvqVhv6a+fwgkWPeI4h9kt2kHudo0W7yEQe+cpyi4l+8kmJSMpQvN+ub9XNARbSmrIoen5nLilf7zGVRK6ZTLmH24EmBssdnIAusxLCNkKcTvyPmY6pZ1N+LBRJjBe0JRvc5TFsphGnu1bH+bh/6nOSuVAj0GfSHqacUqqSTjLTAhOkO9RySW42ERDFVaXhchQH7l+EBFMTiQz+wjWsc54Qtu9IdvqURCKu/w7OjsTlAdj3ziqiR2RyBYjOy9rvQtPMPMKGx9zegWSQDpPeoVt/gyQg6w+bjTNga/NH/wPuH0DXfltwxTSloWFwptB4ThaDF9CHCH1SiUiZT1A0EKQJRMCPAH8cTEGBpTZ+6J+I2Q3RJ2UClAFcWxcEMmJ2UZEs5ldUPgu7oMvsmeYZonE/yZh8CWYxlh20NTTJKJn6s=
x-frame-options: SAMEORIGIN
x-77-nzt: EwwBX63NDQH3ytEEAAwBuUwKEwH3fYgAAAwB1GY4EQG3LwAAAA
x-77-nzt-ray: 2a494a1514f1e9cc49e5b96767d69401
x-77-cache: HIT
x-77-age: 315850
server: CDN77-Turbo
x-77-pop: osloNO
accept-ranges: bytes
X-Firefox-Spdy: h2