Report - getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe

Report Overview

Submitted URL
getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
IP
88.198.116.82
ASN
#24940 Hetzner Online GmbH
Submitted
2024-04-16 22:23:59
Access
public
Website Title
Just a moment...
Final URL
getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
getdstudioapp.net	unknown	2023-08-09	2023-08-09	2024-04-08	3.1 kB	1.1 MB	88.198.116.82
js.hcaptcha.com	23463	2018-01-12	2021-07-30	2024-04-16	408 B	388 kB	104.18.125.91

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
IP
88.198.116.82
ASN
#24940 Hetzner Online GmbH

File type
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
Size
532 kB (532312 bytes)
Hash
3e0514bf298c9f5f03bd570799bb5da7
9b5297aa7cefd32fccf0c64292068586cc74c735
a8dbc3aee62133e5735442327351d27a316f5d4bc529973e0120d2e6a500abf7

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 45/70

JavaScript (3)

	URL	Size	First Seen	Last Seen
	getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe	86 B	2024-04-16	2024-04-17
Pretty URL getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe IP 88.198.116.82 ASN #24940 Hetzner Online GmbH Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-16 17:27:32 Last Seen2024-04-17 00:24:00 Times Seen2 Hash 339e459ca7e83da5166a749d980264f7 2edd680f2f455708f008ee90e63cb87a221ab8dd 6317abe2da9c96897f7ad7e6e74149fd426861730b9c58763b1ad64b1915538b Loading...

	getdstudioapp.net/botd/api.js	1.5 kB	2023-08-28	2024-05-17
Pretty URL getdstudioapp.net/botd/api.js IP 88.198.116.82 ASN #24940 Hetzner Online GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-28 18:45:10 Last Seen2024-05-17 22:00:34 Times Seen343 Hash 7b35596261a9d27e54d260fc658dc830 7420f34409318da20e8a5038f7a758314f922725 bf131ac051c1bb377d78421e95a101b596044c0b0cce8c925aaa9ef6df772feb Loading...

	js.hcaptcha.com/1/api.js?hl=en	387 kB	2024-04-04	2024-04-30
Pretty URL js.hcaptcha.com/1/api.js?hl=en IP 104.18.125.91 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-04 18:06:19 Last Seen2024-04-30 11:09:09 Times Seen1327 Hash 052bf4abb4128ef78b68c418f7d94678 2b6c44a8cc009017a2909c7afd71e371e82b7d27 01908359050da30c842f89d13af0447be961b00b67b46eb61114d1fa48f1bdc9 Loading...

HTTP Transactions (7)

URL IP Response Size

getdstudioapp.net/favicon.ico

88.198.116.82

200 OK

540 kB

URL GET HTTP/2
getdstudioapp.net/favicon.ico
IP
88.198.116.82:443
ASN
#24940 Hetzner Online GmbH

Requested by
https://getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
Certificate
IssuerLet's Encrypt
Subjectgetdstudioapp.net
Fingerprint9E:89:F7:5E:48:98:84:FC:D8:C7:28:CA:27:C5:14:39:EE:08:EE:97
ValidityTue, 02 Apr 2024 03:22:30 GMT - Mon, 01 Jul 2024 03:22:29 GMT

File type
MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Size
540 kB (540115 bytes)
Hash
757db4de13a26a547433bfa48d69d31f
d5b8a5e18d6b9f8727f93f9f7249815b81e6b752
6da14f8a185f27867be8f406256cd1c7e80d3708a36cd702c34dc482e0214826

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: getdstudioapp.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 16 Apr 2024 22:23:34 GMT
content-type: image/x-icon
last-modified: Wed, 26 Apr 2023 08:25:21 GMT
vary: Accept-Encoding
etag: W/"6448dff1-3aee"
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-encoding: br
X-Firefox-Spdy: h2

getdstudioapp.net/botd/post.php

88.198.116.82

200 OK

11 kB

URL POST HTTP/2
getdstudioapp.net/botd/post.php
IP
88.198.116.82:443
ASN
#24940 Hetzner Online GmbH

Requested by
https://getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
Certificate
IssuerLet's Encrypt
Subjectgetdstudioapp.net
Fingerprint9E:89:F7:5E:48:98:84:FC:D8:C7:28:CA:27:C5:14:39:EE:08:EE:97
ValidityTue, 02 Apr 2024 03:22:30 GMT - Mon, 01 Jul 2024 03:22:29 GMT

File type
JSON text data
Size
11 kB (10829 bytes)
Hash
42638a92de0e67db207b867e5936e4d5
6d58dd038c5cb223eaca756f0577338a49e0d418
efecb21f0dd44b7f2904ad5ac4b3907556104625e2cc01e73164d80009ed3307

HTTP Headers

POST /botd/post.php HTTP/1.1
Host: getdstudioapp.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded;
Content-Length: 74
Origin: https://getdstudioapp.net
DNT: 1
Connection: keep-alive
Referer: https://getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 16 Apr 2024 22:23:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-encoding: br
X-Firefox-Spdy: h2

getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe

88.198.116.82

200 OK

532 kB

URL User Request GET HTTP/2
getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
IP
88.198.116.82:443
ASN
#24940 Hetzner Online GmbH

Certificate
IssuerLet's Encrypt
Subjectgetdstudioapp.net
Fingerprint9E:89:F7:5E:48:98:84:FC:D8:C7:28:CA:27:C5:14:39:EE:08:EE:97
ValidityTue, 02 Apr 2024 03:22:30 GMT - Mon, 01 Jul 2024 03:22:29 GMT

File type
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
Size
532 kB (532312 bytes)
Hash
3e0514bf298c9f5f03bd570799bb5da7
9b5297aa7cefd32fccf0c64292068586cc74c735
a8dbc3aee62133e5735442327351d27a316f5d4bc529973e0120d2e6a500abf7

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 45/70

HTTP Headers

GET /dl/DS-Setup[q6VTQN4WNZ].exe HTTP/1.1
Host: getdstudioapp.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
Cookie: __h_clearance=34b922e278f51320f81572ee920808aadae3916071978bcfacec2e2d7bbe0b63.1713306216
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Tue, 16 Apr 2024 22:23:38 GMT
content-type: application/x-msdownload
content-length: 532312
last-modified: Thu, 17 Aug 2023 16:59:32 GMT
vary: Accept-Encoding
etag: "64de51f4-81f58"
x-xss-protection: 1; mode=block
x-frame-options: DENY
X-Firefox-Spdy: h2

getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe

88.198.116.82

200 OK

3.7 kB

URL User Request GET HTTP/2
getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
IP
88.198.116.82:443
ASN
#24940 Hetzner Online GmbH

Certificate
IssuerLet's Encrypt
Subjectgetdstudioapp.net
Fingerprint9E:89:F7:5E:48:98:84:FC:D8:C7:28:CA:27:C5:14:39:EE:08:EE:97
ValidityTue, 02 Apr 2024 03:22:30 GMT - Mon, 01 Jul 2024 03:22:29 GMT

File type
HTML document, ASCII text, with very long lines (3854), with no line terminators
Size
3.7 kB (3678 bytes)
Hash
28886fa4fa0f9a41cb091a1be31be336
723b9f00f01cd8e53433912b33484e4602a9f073
fee9d7f6accd0b6c056afcd418e37727bb8115bdb2ede489e00ea2297ef0f58c

HTTP Headers

GET /dl/DS-Setup[q6VTQN4WNZ].exe HTTP/1.1
Host: getdstudioapp.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Tue, 16 Apr 2024 22:23:34 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-encoding: br
X-Firefox-Spdy: h2

getdstudioapp.net/botd/static/challenges.css

88.198.116.82

200 OK

6.6 kB

URL GET HTTP/2
getdstudioapp.net/botd/static/challenges.css
IP
88.198.116.82:443
ASN
#24940 Hetzner Online GmbH

Requested by
https://getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
Certificate
IssuerLet's Encrypt
Subjectgetdstudioapp.net
Fingerprint9E:89:F7:5E:48:98:84:FC:D8:C7:28:CA:27:C5:14:39:EE:08:EE:97
ValidityTue, 02 Apr 2024 03:22:30 GMT - Mon, 01 Jul 2024 03:22:29 GMT

File type
ASCII text, with very long lines (6608), with no line terminators
Size
6.6 kB (6600 bytes)
Hash
f0fd80732479959c893cfd7380f594bd
04111102f46bc02c195561743b3f41b4d5a349ca
704e70fc0fd54cb83a1100d48093680b73e0d3c45a32dc326c38355185aaf37f

HTTP Headers

GET /botd/static/challenges.css HTTP/1.1
Host: getdstudioapp.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Tue, 16 Apr 2024 22:23:34 GMT
content-type: text/css
last-modified: Sun, 27 Aug 2023 10:50:10 GMT
vary: Accept-Encoding
etag: W/"64eb2a62-19c8"
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-encoding: br
X-Firefox-Spdy: h2

js.hcaptcha.com/1/api.js?hl=en

104.18.125.91

200 OK

387 kB

URL GET HTTP/2
js.hcaptcha.com/1/api.js?hl=en
IP
104.18.125.91:443
ASN
#13335 CLOUDFLARENET

Requested by
https://getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
Certificate
IssuerLet's Encrypt
Subjecthcaptcha.com
Fingerprint8F:BD:51:60:5C:FC:EA:F0:74:47:AB:AC:1B:84:1A:7E:3C:68:A7:E5
ValidityFri, 15 Mar 2024 00:09:38 GMT - Thu, 13 Jun 2024 00:09:37 GMT

File type

Size
387 kB (387091 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /1/api.js?hl=en HTTP/1.1
Host: js.hcaptcha.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://getdstudioapp.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Apr 2024 22:23:34 GMT
content-type: application/javascript
etag: W/"5a68efa2b964d5c167fde3b130af8e94"
cache-control: max-age=300
alt-svc: h3=":443"; ma=86400
vary: Origin, Accept-Encoding
cf-cache-status: HIT
expires: Tue, 30 Apr 2024 22:23:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
server: cloudflare
cf-ray: 875794a14c9156b9-OSL
content-encoding: br
X-Firefox-Spdy: h2

getdstudioapp.net/botd/api.js

88.198.116.82

200 OK

1.5 kB

URL GET HTTP/2
getdstudioapp.net/botd/api.js
IP
88.198.116.82:443
ASN
#24940 Hetzner Online GmbH

Requested by
https://getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
Certificate
IssuerLet's Encrypt
Subjectgetdstudioapp.net
Fingerprint9E:89:F7:5E:48:98:84:FC:D8:C7:28:CA:27:C5:14:39:EE:08:EE:97
ValidityTue, 02 Apr 2024 03:22:30 GMT - Mon, 01 Jul 2024 03:22:29 GMT

File type
JavaScript source, ASCII text, with very long lines (1584), with no line terminators
Size
1.5 kB (1512 bytes)
Hash
a078461c82578febece04ec869fb9f2a
f93824bc49262acd3c511b1e870bf7d8bdebc950
04d420a46f9d3ef43ef21e847ceeb803370c3c57aa1d11aa99fd8a205f9b16a3

HTTP Headers

GET /botd/api.js HTTP/1.1
Host: getdstudioapp.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://getdstudioapp.net/dl/DS-Setup[q6VTQN4WNZ].exe
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Tue, 16 Apr 2024 22:23:34 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sun, 27 Aug 2023 13:09:16 GMT
vary: Accept-Encoding
etag: W/"64eb4afc-5e8"
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-encoding: br
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (7)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL POST HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size