| anonsharing.com/ee5a7f315c7dd5cf/viwkzrrc0rskzwi4.exe?download_token=5cc8276c6902b39eaf80e22021bb63e5971bdb63cbf736678d1e9354cd941fe6 |  104.21.96.1 | 302 Found | 503 kB |
URL User Request GET anonsharing.com/ee5a7f315c7dd5cf/viwkzrrc0rskzwi4.exe?download_token=5cc8276c6902b39eaf80e22021bb63e5971bdb63cbf736678d1e9354cd941fe6 IP104.21.96.1:443
CertificateIssuerGoogle Trust Services Subjectanonsharing.com FingerprintC0:EB:9E:89:46:3F:FE:FA:5D:CF:12:4D:D1:A1:DA:7E:A4:C0:62:7C ValidityFri, 21 Mar 2025 20:14:25 GMT - Thu, 19 Jun 2025 21:12:44 GMT
Size503 kB (503200 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ee5a7f315c7dd5cf/viwkzrrc0rskzwi4.exe?download_token=5cc8276c6902b39eaf80e22021bb63e5971bdb63cbf736678d1e9354cd941fe6 HTTP/1.1
Host: anonsharing.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Mon, 28 Apr 2025 08:09:09 GMT
content-type: application/x-msdownload
content-length: 510
location: https://s3.ca-central-1.wasabisys.com/anonsharing/00/008c46c5cfcc866af2c08c521952ea25?response-content-disposition=filename%3Dviwkzrrc0rskzwi4.exe&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=HSRJ9W5CR8WH0842044I%2F20250428%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250428T080909Z&X-Amz-SignedHeaders=host&X-Amz-Expires=10800&X-Amz-Signature=2bb70bc8d9ee1577daa04dca4e241b89fa928edd69aa6aece96ef9a8959429ed
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6VIircMbae3o8XcIlLBFLaywI%2BtV%2BAFDFU%2F13Z2I3q3iJqqms1nZMHKgGbWYbKZUXRL3%2F60Jj4a%2FmahauwgiLm6X9Skw1jiTO%2F4Z6YHMgxVBdAdaikmclR3mUrcJV4m5Ih8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
expires: 0
cache-control: must-revalidate, post-check=0, pre-check=0, no-cache, private
pragma: public
accept-ranges: bytes
access-control-allow-origin: https://anonsharing.com
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description
access-control-allow-credentials: true
cf-ray: 937513683f595c23-TLL
vary: Accept-Encoding,User-Agent
content-encoding: gzip
cf-cache-status: DYNAMIC
set-cookie: filehosting=bef2b643057e2a74432738182f0e0224; Path=/; Max-Age=86400; Expires=Tue, 29 Apr 2025 08:09:09 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfCacheStatus;desc="DYNAMIC", cfL4;desc="?proto=TCP&rtt=22086&min_rtt=14190&rtt_var=13687&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3210&recv_bytes=1209&delivery_rate=291426&cwnd=254&unsent_bytes=0&cid=add41e67dff831d4&ts=495&x=0"
X-Firefox-Spdy: h2
|
| s3.ca-central-1.wasabisys.com/anonsharing/00/008c46c5cfcc866af2c08c521952ea25?response-content-disposition=filename%3Dviwkzrrc0rskzwi4.exe&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=HSRJ9W5CR8WH0842044I%2F20250428%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250428T080909Z&X-Amz-SignedHeaders=host&X-Amz-Expires=10800&X-Amz-Signature=2bb70bc8d9ee1577daa04dca4e241b89fa928edd69aa6aece96ef9a8959429ed |  38.143.146.100 | 200 OK | 503 kB |
URL User Request GET s3.ca-central-1.wasabisys.com/anonsharing/00/008c46c5cfcc866af2c08c521952ea25?response-content-disposition=filename%3Dviwkzrrc0rskzwi4.exe&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=HSRJ9W5CR8WH0842044I%2F20250428%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250428T080909Z&X-Amz-SignedHeaders=host&X-Amz-Expires=10800&X-Amz-Signature=2bb70bc8d9ee1577daa04dca4e241b89fa928edd69aa6aece96ef9a8959429ed IP38.143.146.100:443 ASN#395717 BLUEARCHIVE-ZONE-1
CertificateIssuerDigiCert Inc Subject*.s3.ca-central-1.wasabisys.com Fingerprint08:34:10:62:16:89:4A:8A:4E:34:B0:19:0B:61:8D:1C:F7:7C:68:49 ValidityWed, 05 Feb 2025 00:00:00 GMT - Mon, 02 Mar 2026 23:59:59 GMT
File typePE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections Size503 kB (503200 bytes) Hashc5d7d8ca672f1e3698bd3c786514e4a8 e67d49d6c0debf580e884cd2931c27f973f4c9b2 cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955
| Analyzer | Verdict | Alert |
|---|
| YARAhub by abuse.ch | malware | Detect pe file that no import table | | VirusTotal | malicious | |
GET /anonsharing/00/008c46c5cfcc866af2c08c521952ea25?response-content-disposition=filename%3Dviwkzrrc0rskzwi4.exe&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=HSRJ9W5CR8WH0842044I%2F20250428%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250428T080909Z&X-Amz-SignedHeaders=host&X-Amz-Expires=10800&X-Amz-Signature=2bb70bc8d9ee1577daa04dca4e241b89fa928edd69aa6aece96ef9a8959429ed HTTP/1.1
Host: s3.ca-central-1.wasabisys.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Disposition: filename=viwkzrrc0rskzwi4.exe
Content-Length: 503200
Content-Type: application/octet-stream
Date: Mon, 28 Apr 2025 08:09:10 GMT
ETag: "c5d7d8ca672f1e3698bd3c786514e4a8"
Last-Modified: Sat, 19 Apr 2025 08:28:30 GMT
Server: WasabiS3/7.23.4324-2025-03-24-a70f722ec6
x-amz-id-2: z+M8z3StQ63WuW/NlPNB0zGV8IXhZYk+EPKACCe2imubplb/gjFm2pzgy654dqGdlMtzhS7jeF6J
x-amz-request-id: B2DBB39A7475E4C2:A
x-wasabi-cm-reference-id: 1745827749775 38.143.146.100 ConID:532741360/EngineConID:5086224/Core:94
|