Report - nightly.link/SourMesen/Mesen2/workflows/build/master/Mesen%20(Windows).zip

Report Overview

Submitted URL
nightly.link/SourMesen/Mesen2/workflows/build/master/Mesen%20(Windows).zip
IP
45.32.185.199
ASN
#20473 AS-CHOOPA
Submitted
2024-04-17 19:01:31
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
pipelinesghubeus9.actions.githubusercontent.com	unknown	2014-02-06	2023-08-22	2024-03-10	773 B	16 MB	40.88.239.133
nightly.link	unknown	2020-11-23	2020-11-23	2024-04-15	528 B	486 B	45.32.185.199

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
pipelinesghubeus9.actions.githubusercontent.com/OTxo8A2LzQ1l7uA1pd2UzoSHTWRAULi5gCC9bAxKH67QS8rsnX/_apis/pipelines/1/runs/329/signedartifactscontent?artifactName=Mesen%20%28Windows%29&urlExpires=2024-04-17T19%3A01%3A41.7847199Z&urlSigningMethod=HMACV2&urlSignature=XUT1bj%2FQ2V158h%2BAUB%2FfrB3%2FsbxPzOtK86VzGwty30o%3D
IP
40.88.239.133
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
16 MB (16127664 bytes)
Hash
cde54e7a03047d064d3157e460f828db
6e87281f09245983f365c6539c234af379d1ac5c
478e857f0992f2754c6830b40ca559c597b7b8b2050539499bf5c996aa1f9c1f

Archive (1)

Filename

Md5

File type

Mesen.exe

91bf6b135a728dd61459770e655f53df

PE32+ executable (GUI) x86-64, for MS Windows, 7 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	nightly.link/SourMesen/Mesen2/workflows/build/master/Mesen%20(Windows).zip	45.32.185.199		0 B
URL nightly.link/SourMesen/Mesen2/workflows/build/master/Mesen%20(Windows).zip IP 45.32.185.199:0 ASN #20473 AS-CHOOPA File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers GET /SourMesen/Mesen2/workflows/build/master/Mesen%20(Windows).zip HTTP/1.1 Host: nightly.link User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 302 Found Server: nginx/1.22.1 Date: Wed, 17 Apr 2024 19:01:01 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: https://pipelinesghubeus9.actions.githubusercontent.com/OTxo8A2LzQ1l7uA1pd2UzoSHTWRAULi5gCC9bAxKH67QS8rsnX/_apis/pipelines/1/runs/329/signedartifactscontent?artifactName=Mesen%20%28Windows%29&urlExpires=2024-04-17T19%3A01%3A41.7847199Z&urlSigningMethod=HMACV2&urlSignature=XUT1bj%2FQ2V158h%2BAUB%2FfrB3%2FsbxPzOtK86VzGwty30o%3D`

	pipelinesghubeus9.actions.githubusercontent.com/OTxo8A2LzQ1l7uA1pd2UzoSHTWRAULi5gCC9bAxKH67QS8rsnX/_apis/pipelines/1/runs/329/signedartifactscontent?artifactName=Mesen%20%28Windows%29&urlExpires=2024-04-17T19%3A01%3A41.7847199Z&urlSigningMethod=HMACV2&urlSignature=XUT1bj%2FQ2V158h%2BAUB%2FfrB3%2FsbxPzOtK86VzGwty30o%3D	40.88.239.133	200 OK	16 MB
URL User Request GET HTTP/1.1 pipelinesghubeus9.actions.githubusercontent.com/OTxo8A2LzQ1l7uA1pd2UzoSHTWRAULi5gCC9bAxKH67QS8rsnX/_apis/pipelines/1/runs/329/signedartifactscontent?artifactName=Mesen%20%28Windows%29&urlExpires=2024-04-17T19%3A01%3A41.7847199Z&urlSigningMethod=HMACV2&urlSignature=XUT1bj%2FQ2V158h%2BAUB%2FfrB3%2FsbxPzOtK86VzGwty30o%3D IP 40.88.239.133:443 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK Certificate IssuerDigiCert Inc Subject.actions.githubusercontent.com Fingerprint3E:A8:0E:90:2F:C3:85:F3:6B:C0:81:93:FB:C6:78:20:2D:57:29:94 ValidityWed, 20 Sep 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 16 MB (16127664 bytes) Hash cde54e7a03047d064d3157e460f828db 6e87281f09245983f365c6539c234af379d1ac5c 478e857f0992f2754c6830b40ca559c597b7b8b2050539499bf5c996aa1f9c1f HTTP Headers GET /OTxo8A2LzQ1l7uA1pd2UzoSHTWRAULi5gCC9bAxKH67QS8rsnX/_apis/pipelines/1/runs/329/signedartifactscontent?artifactName=Mesen%20%28Windows%29&urlExpires=2024-04-17T19%3A01%3A41.7847199Z&urlSigningMethod=HMACV2&urlSignature=XUT1bj%2FQ2V158h%2BAUB%2FfrB3%2FsbxPzOtK86VzGwty30o%3D HTTP/1.1 Host: pipelinesghubeus9.actions.githubusercontent.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/1.1 200 OK Content-Type: application/zip Date: Wed, 17 Apr 2024 19:01:00 GMT Server: Kestrel Cache-Control: no-store,no-cache Pragma: no-cache Transfer-Encoding: chunked Strict-Transport-Security: max-age=2592000 X-TFS-ProcessId: 0130968e-f0af-4348-9024-b3cbbc7a9416 ActivityId: 0825ff25-5747-44d5-acff-4488fb5e90c9 X-TFS-Session: 0825ff25-5747-44d5-acff-4488fb5e90c9 X-VSS-E2EID: 0825ff25-5747-44d5-acff-4488fb5e90c9 X-VSS-SenderDeploymentId: 80a0d4a1-4b02-aa13-a606-f3d476158d51 Content-Disposition: attachment; filename="Mesen (Windows).zip"; filename=UTF-8''Mesen%20%28Windows%29.zip