Report - cdn.discordapp.com/attachments/1170623125092839424/1235643925650341970/KIDDIONS_v1.0.0-UPDATED-SCRIPTS.zip?ex=663faa95&is=663e5915&hm=25f321082e1137bd0975c6476d63ada928f006933d5476d24f58adf6697ba977&

Report Overview

Submitted URL
cdn.discordapp.com/attachments/1170623125092839424/1235643925650341970/KIDDIONS_v1.0.0-UPDATED-SCRIPTS.zip?ex=663faa95&is=663e5915&hm=25f321082e1137bd0975c6476d63ada928f006933d5476d24f58adf6697ba977&
IP
162.159.130.233
ASN
#13335 CLOUDFLARENET
Submitted
2024-05-11 02:14:30
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cdn.discordapp.com	2474	unknown	No data	No data	653 B	18 MB	162.159.134.233
aus5.mozilla.org	2548	unknown	No data	No data	512 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
cdn.discordapp.com/attachments/1170623125092839424/1235643925650341970/KIDDIONS_v1.0.0-UPDATED-SCRIPTS.zip?ex=663faa95&is=663e5915&hm=25f321082e1137bd0975c6476d63ada928f006933d5476d24f58adf6697ba977&
IP
162.159.134.233
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
18 MB (17955162 bytes)
Hash
259ab3bb591a47d9b19469cfad5ed899
bef17fb1f59849851b208951705de0c29840cdde
116a7dabee3b405e670cdb8ed98e66e963e362215cb4a6bf6b1f1cd87ec6187e

Archive (12)

Filename

Md5

File type

config.json

3bea77ef233e2e32636ba889ceb489e3

JSON text data

modest-menu.exe

ce03d8db32b901caba01fa8b1beefe54

PE32+ executable (GUI) x86-64, for MS Windows, 9 sections

demo.lua

a0cdff1f4eaf5af121513b9885295341

ASCII text, with CRLF line terminators

menu.lua

9596bef3ecd38e99364eb58e56cd49be

ASCII text, with CRLF line terminators

Readme.api

36754844e4b9d76b810066b529af0e5b

ASCII text, with CRLF line terminators

Silent_Night_v1.68.lua

37daeda5d7bd9883ea1b7629da7cf401

Unicode text, UTF-8 text, with CRLF line terminators

sirius.lua.example

1fdd7bce4f24c51ec8267d7fe65b265e

ASCII text, with CRLF line terminators

Ultimate_Menu_V2.1_1.68.lua

7ac0ff45867ed37a1355ca5ffb10f18e

Unicode text, UTF-8 text, with very long lines (372)

vehicle.lua

1eceb52600b875b85a169687fb62ed1e

ASCII text, with CRLF line terminators

weapon.lua

402a9279c76afb2c5977cf97d270c3d1

ASCII text, with CRLF line terminators

Silent_Night_v1.68.lua

4cfd9490ba2892a7fdf1b5b21bfdbc20

Unicode text, UTF-8 text, with CRLF line terminators

themes.json

ecc97a512f2bee4c4344a7a4126b5a5b

JSON text data

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 12/69

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

cdn.discordapp.com/attachments/1170623125092839424/1235643925650341970/KIDDIONS_v1.0.0-UPDATED-SCRIPTS.zip?ex=663faa95&is=663e5915&hm=25f321082e1137bd0975c6476d63ada928f006933d5476d24f58adf6697ba977&

162.159.134.233

200 OK

18 MB

URL User Request GET HTTP/2
cdn.discordapp.com/attachments/1170623125092839424/1235643925650341970/KIDDIONS_v1.0.0-UPDATED-SCRIPTS.zip?ex=663faa95&is=663e5915&hm=25f321082e1137bd0975c6476d63ada928f006933d5476d24f58adf6697ba977&
IP
162.159.134.233:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerCloudflare, Inc.
Subjectdiscordapp.com
Fingerprint97:8B:EE:AD:1E:BF:A1:69:E7:94:29:F7:55:7A:29:64:19:C7:81:39
ValidityFri, 20 Oct 2023 00:00:00 GMT - Sat, 19 Oct 2024 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
18 MB (17955162 bytes)
Hash
259ab3bb591a47d9b19469cfad5ed899
bef17fb1f59849851b208951705de0c29840cdde
116a7dabee3b405e670cdb8ed98e66e963e362215cb4a6bf6b1f1cd87ec6187e

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 12/69

HTTP Headers

GET /attachments/1170623125092839424/1235643925650341970/KIDDIONS_v1.0.0-UPDATED-SCRIPTS.zip?ex=663faa95&is=663e5915&hm=25f321082e1137bd0975c6476d63ada928f006933d5476d24f58adf6697ba977& HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 11 May 2024 01:15:19 GMT
content-type: application/zip
content-length: 17955162
cf-ray: 881e51333b68b51e-OSL
cf-cache-status: MISS
accept-ranges: bytes, bytes
cache-control: public, max-age=31536000
content-disposition: attachment; filename="KIDDIONS_v1.0.0-UPDATED-SCRIPTS.zip"
etag: "259ab3bb591a47d9b19469cfad5ed899"
expires: Sun, 11 May 2025 01:15:19 GMT
last-modified: Thu, 02 May 2024 17:27:49 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
x-goog-generation: 1714670869120980
x-goog-hash: crc32c=ALd+GA==, md5=JZqzu1kaR9mxlGnPrV7YmQ==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 17955162
x-guploader-uploadid: ABPtcPqUvTiu_gfo8t60YXKXtJJLxMHaQT99GM_ZwTIusJVH1_8z-qLrINhXQwMySJHI38A0ExI
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oUphcg6KM%2Fia2IBIeFbRDffHh%2FhIbEM6ZbbqDqQD%2BsDLkA9%2FRNfxqiS30dt5cse2Zkp9T1JBLISzHXgbXwQrWR8A%2BVW0sfqzORtse%2FMurw1oeXdMSux%2F7X4zgnmtc1juidvFBg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
set-cookie: __cf_bm=ycLQeXj1HfDB0g.ZUqmVaYNFiXFlWg7cYghjD6s12lk-1715390119-1.0.1.1-HKg2sZJPK9YZd.7FQXqZZXYDSI_sEMDyyfiZ6KMegm8kF00Csc4BVwvYNAXvxFW2.7DlrvuA1oUo76M_pmqtcg; path=/; expires=Sat, 11-May-24 01:45:19 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
_cfuvid=Qg7JWWfY4GHmfxl4Grn2N6gluclAx55yALtDUzAo71I-1715390119594-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
X-Firefox-Spdy: h2

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL
aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml
IP
35.244.181.201:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
XML 1.0 document, ASCII text, with very long lines (332)
Size
444 B (444 bytes)
Hash
3b324dec137a87ef7e24a30a65b13dd0
c0faa95b2f1018e264b3a14aaf50d1003e6c27b3
6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-06-29-17-33-45.chain; p384ecdsa=VVSy94XBHN3oLgMHfxgLvCuoSV0k6gwPKkbjV-ir01xY2eaIystFGL1piQsH20v4_tjLrniZpEzuHoEi_8f-xTmiyWwj7_8gh-Y2hzwFIq5vfx8A_NHvU5tEm-1t39Zb
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Sat, 11 May 2024 01:14:06 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 92
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2