Report - download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk

Report Overview

Visited public
2024-09-24 19:48:16
Tags
URL
download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk
Finishing URL
about:privatebrowsing
IP / ASN
188.114.96.1
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-09-24 14:07:48	327 B	888 B	23.36.77.32
download.all-instructions.com	unknown	2024-09-23	2024-09-24 21:46:32	2024-09-24 21:46:32	521 B	2.8 kB	188.114.97.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-09-24	medium	download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk	Identifies PowerShell artefacts in shortcut (LNK) files.
2024-09-24	medium	download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk	Identifies scripting artefacts in shortcut (LNK) files.
2024-09-24	medium	download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk	Identifies executable artefacts in shortcut (LNK) files.
2024-09-24	medium	download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk	Identifies download artefacts in shortcut (LNK) files.
2024-09-24	medium	download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk	Identifies shortcut (LNK) file with a long relative path. Might be used in an attempt to hide the path.

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
5b06c0ed62b87eb6bce48f14abc00f8b
c826750de15959bd917ef10429f33bbe029c8e2f
87c6305615145d6f27ee3d73b006e20eaaf5c839eb57de5e88efa3ab90ddd24c

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "87C6305615145D6F27EE3D73B006E20EAAF5C839EB57DE5E88EFA3AB90DDD24C"
Last-Modified: Tue, 24 Sep 2024 18:08:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20697
Expires: Wed, 25 Sep 2024 01:32:47 GMT
Date: Tue, 24 Sep 2024 19:47:50 GMT
Connection: keep-alive

download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk

188.114.97.1

200 OK

2.1 kB

URL User Request GET HTTP/2
download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectall-instructions.com
FingerprintA1:C0:B7:A9:08:4E:55:8A:77:DD:BB:28:83:B5:F7:3A:CD:B8:05:71
ValidityTue, 24 Sep 2024 08:29:46 GMT - Mon, 23 Dec 2024 08:29:45 GMT

File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=13, Archive, ctime=Sat May 7 05:20:19 2022, mtime=Sat May 7 05:20:19 2022, atime=Sat May 7 05:20:19 2022, length=41472, window=hidenormalshowminimized
Size
2.1 kB (2140 bytes)
Hash
1035ae736eb9f4ecde716b5ff4e86abd
ae1c4a1177cf771567ea770763c946d3aa5ea5bd
97551a7946e40d66828e05466d42731866253f9f6524ee76493b58cdb57f1ca7

Detections

Analyzer	Verdict	Alert
Public InfoSec YARA rules	malware	Identifies PowerShell artefacts in shortcut (LNK) files.
Public InfoSec YARA rules	malware	Identifies scripting artefacts in shortcut (LNK) files.
Public InfoSec YARA rules	malware	Identifies executable artefacts in shortcut (LNK) files.
Public InfoSec YARA rules	malware	Identifies download artefacts in shortcut (LNK) files.
Public InfoSec YARA rules	malware	Identifies shortcut (LNK) file with a long relative path. Might be used in an attempt to hide the path.

HTTP Headers

GET /Downloads/Instruction%2021921.pdf.lnk HTTP/1.1
Host: download.all-instructions.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 24 Sep 2024 19:47:51 GMT
content-type: application/octet-stream
content-length: 2140
accept-ranges: bytes
etag: "17f841fba712483785c"
last-modified: Tue, 24 Sep 2024 18:36:46 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z2leDL80F3ML2FxiIsBaYdAb5bqByE7xduaf%2B0uXLL0IFTw1u6M22khONFgsmQnTqr0HPafmb%2FNkK9Xpz7bF8a6D%2FKf0Tklp3myyG9GJaQ0Fl3b%2F%2Fl4nLx7egBrrZIBWHqXgadHBEvqMcioIPBAteA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8c8549e4dddcb9a1-BRU
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers