Report - cdn.discordapp.com/attachments/1271923659002482743/1369379689562374335/Better-CrewLink.lnk?ex=681ba5b7&is=681a5437&hm=077958bb0dafeaf3894b19c0954ca3d35d00bcedd07c2ced4599da14f4d66b9a&

Report Overview

Visited public
2025-05-06 18:31:24
Tags
URL
cdn.discordapp.com/attachments/1271923659002482743/1369379689562374335/Better-CrewLink.lnk?ex=681ba5b7&is=681a5437&hm=077958bb0dafeaf3894b19c0954ca3d35d00bcedd07c2ced4599da14f4d66b9a&
Finishing URL
about:privatebrowsing
IP / ASN
162.159.135.233
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cdn.discordapp.com	2474	unknown	No data	No data	651 B	4.2 kB	162.159.129.233

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-05-06	medium	cdn.discordapp.com/attachments/1271923659002482743/1369379689562374335/Better-CrewLink.lnk?ex=681ba5b7&is=681a5437&hm=077958bb0dafeaf3894b19c0954ca3d35d00bcedd07c2ced4599da14f4d66b9a&	Identifies executable artefacts in shortcut (LNK) files.

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Windows Shortcut detected

URL
cdn.discordapp.com/attachments/1271923659002482743/1369379689562374335/Better-CrewLink.lnk?ex=681ba5b7&is=681a5437&hm=077958bb0dafeaf3894b19c0954ca3d35d00bcedd07c2ced4599da14f4d66b9a&
IP / ASN
162.159.129.233
#13335 CLOUDFLARENET

File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Unicoded, HasExpIcon "%USERPROFILE%\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F, Archive, ctime=Sun Jan 19 16:53:51 2025, atime=Sun Jan 19 16:53:55 2025, mtime=Wed Mar 29 01:14:20 2023, length=126435840, window=normal, IDListSize 0x0242, Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE", LocalBasePath "C:\Users\axell\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"
Hash
MD5 f348e84de8e2cd3863afac9d62bc99cb
SHA1 5a36f52cc2d714f8a75d62478b67c9d9c0924cc6
SHA256 5d38c5b47cecebc3b9591154f5ca99c515e1d155514736b394777b69821237da

Timestamps
Created 2025-01-19 16:53:51
Access 2023-03-29 01:14:20
Write 2025-01-19 16:53:55
Command-line data
Working Directory
C:\Users\axell\AppData\Local\Programs\bettercrewlink
Relative Path
..\..\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe
Command Line Arguments

Detections

Analyzer	Verdict	Alert
Public InfoSec YARA rules	malware	Identifies executable artefacts in shortcut (LNK) files.

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

cdn.discordapp.com/attachments/1271923659002482743/1369379689562374335/Better-CrewLink.lnk?ex=681ba5b7&is=681a5437&hm=077958bb0dafeaf3894b19c0954ca3d35d00bcedd07c2ced4599da14f4d66b9a&

162.159.129.233

200 OK

2.5 kB

URL User Request GET
cdn.discordapp.com/attachments/1271923659002482743/1369379689562374335/Better-CrewLink.lnk?ex=681ba5b7&is=681a5437&hm=077958bb0dafeaf3894b19c0954ca3d35d00bcedd07c2ced4599da14f4d66b9a&
IP
162.159.129.233:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectdiscordapp.com
Fingerprint2F:5F:0F:47:D0:0D:C1:87:16:29:BB:8D:62:E7:94:21:38:2D:16:5F
ValiditySat, 15 Mar 2025 04:05:12 GMT - Fri, 13 Jun 2025 05:05:09 GMT

File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Unicoded, HasExpIcon "%USERPROFILE%\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe" KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F, Archive, ctime=Sun Jan 19 16:53:51 2025, atime=Sun Jan 19 16:53:55 2025, mtime=Wed Mar 29 01:14:20 2023, length=126435840, window=normal, IDListSize 0x0242, Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE", LocalBasePath "C:\Users\axell\AppData\Local\Programs\bettercrewlink\Better-CrewLink.exe"
Size
2.5 kB (2470 bytes)
Hash
f348e84de8e2cd3863afac9d62bc99cb
5a36f52cc2d714f8a75d62478b67c9d9c0924cc6
5d38c5b47cecebc3b9591154f5ca99c515e1d155514736b394777b69821237da

Detections

Analyzer	Verdict	Alert
Public InfoSec YARA rules	malware	Identifies executable artefacts in shortcut (LNK) files.

HTTP Headers

GET /attachments/1271923659002482743/1369379689562374335/Better-CrewLink.lnk?ex=681ba5b7&is=681a5437&hm=077958bb0dafeaf3894b19c0954ca3d35d00bcedd07c2ced4599da14f4d66b9a& HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 06 May 2025 18:30:52 GMT
content-type: application/octet-stream
content-length: 2470
cf-ray: 93ba8d2009c4b4ed-OSL
cf-cache-status: MISS
accept-ranges: bytes, bytes
cache-control: public, max-age=31536000
content-disposition: attachment; filename="Better-CrewLink.lnk"
etag: "f348e84de8e2cd3863afac9d62bc99cb"
expires: Wed, 06 May 2026 18:30:52 GMT
last-modified: Tue, 06 May 2025 18:25:59 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
x-goog-generation: 1746555959922341
x-goog-hash: crc32c=LbC4fQ==, md5=80joTejizThjr6ydYryZyw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 2470
x-guploader-uploadid: AAO2VwpVEBIHytZ8J3a9X5ftykH1ojg69byBR--kEjQ1g4nuK40Zds--8i9NzPClP0GWYwla
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kpUsWded1KKET5oFBAThLfK7sx7eCa8MhSygsfpX1u8kfjyjfNQ8DuruibPb0nnW%2F6x6MnWlpMYTfUBjgAMuK9rRFPXdreEDpF4vvtZdVrS18h2DD1NLoKQb0fxTJSqaMjGunQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
set-cookie: __cf_bm=PV4xGF13Up1OXest1VXA22h_b1zaejrorGHNFjvz3C0-1746556252-1.0.1.1-GkvVNOIUwm2auYio9Qku4tn7iacUKEnt8NnADLvd1Jd19GA0LwrQn615apRp5iTOkCrIclUyZLjxB1iJ0dA9vB.79l0a0klPWN8ZRE4RcX0; path=/; expires=Tue, 06-May-25 19:00:52 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
_cfuvid=C45uiLoH.Nndf31keQhnDy060eAVlNHdoncgqEPjpOU-1746556252478-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

Windows Shortcut detected

File type

Hash

Timestamps

Command-line data

JavaScript (0)

HTTP Transactions (1)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers