Report - cdn.discordapp.com/attachments/1211008921624510596/1219875628740907019/ClanQuestMacroPublic_Release.zip?ex=66161f36&is=6603aa36&hm=0792d25b10d93ff55645e3c777bd018b5175c5187c28b44b69030ddbeec0c693&/

Report Overview

Submitted URL
cdn.discordapp.com/attachments/1211008921624510596/1219875628740907019/ClanQuestMacroPublic_Release.zip?ex=66161f36&is=6603aa36&hm=0792d25b10d93ff55645e3c777bd018b5175c5187c28b44b69030ddbeec0c693&/
IP
162.159.135.233
ASN
#13335 CLOUDFLARENET
Submitted
2024-03-28 10:43:52
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cdn.discordapp.com	2474	2015-02-26	2015-08-24	2024-03-27	651 B	640 kB	162.159.130.233

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
cdn.discordapp.com/attachments/1211008921624510596/1219875628740907019/ClanQuestMacroPublic_Release.zip?ex=66161f36&is=6603aa36&hm=0792d25b10d93ff55645e3c777bd018b5175c5187c28b44b69030ddbeec0c693&/
IP
162.159.130.233
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
638 kB (637940 bytes)
Hash
6c2866084cfc5ac0ad0cda2d7bac50f5
62e9e0942e63e532f792d2d67299672883bad308
726a98ef514d3da651da7313ac1b0de0fb92aa80529eea4fbc18d2491a9b5d1a

Archive (5)

Filename

Md5

File type

CQMSettings.ini

a07c8d5bad91c8fbe5581d30f955fc97

Unicode text, UTF-16, little-endian text, with CRLF line terminators

MainScript.exe

dc755e3bc08a153e978d42ede555b678

PE32+ executable (GUI) x86-64, for MS Windows, 6 sections

Temp.ahk

6aae5b9f3168d6d59fd57e47d5839b11

ASCII text, with no line terminators

UWBOCRLib.ahk

f221f9638a57d807e21e72dcc289951a

ASCII text, with CRLF line terminators

VersionSettings.ini

e1dc52664da3967811dba18aa4f4f3cc

Windows setup INFormation

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 4/64

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

cdn.discordapp.com/attachments/1211008921624510596/1219875628740907019/ClanQuestMacroPublic_Release.zip?ex=66161f36&is=6603aa36&hm=0792d25b10d93ff55645e3c777bd018b5175c5187c28b44b69030ddbeec0c693&/

162.159.130.233

200 OK

638 kB

URL User Request GET HTTP/2
cdn.discordapp.com/attachments/1211008921624510596/1219875628740907019/ClanQuestMacroPublic_Release.zip?ex=66161f36&is=6603aa36&hm=0792d25b10d93ff55645e3c777bd018b5175c5187c28b44b69030ddbeec0c693&/
IP
162.159.130.233:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerCloudflare, Inc.
Subjectdiscordapp.com
Fingerprint97:8B:EE:AD:1E:BF:A1:69:E7:94:29:F7:55:7A:29:64:19:C7:81:39
ValidityFri, 20 Oct 2023 00:00:00 GMT - Sat, 19 Oct 2024 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
638 kB (637940 bytes)
Hash
6c2866084cfc5ac0ad0cda2d7bac50f5
62e9e0942e63e532f792d2d67299672883bad308
726a98ef514d3da651da7313ac1b0de0fb92aa80529eea4fbc18d2491a9b5d1a

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 4/64

HTTP Headers

GET /attachments/1211008921624510596/1219875628740907019/ClanQuestMacroPublic_Release.zip?ex=66161f36&is=6603aa36&hm=0792d25b10d93ff55645e3c777bd018b5175c5187c28b44b69030ddbeec0c693&/ HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 28 Mar 2024 10:43:26 GMT
content-type: application/zip
content-length: 637940
cf-ray: 86b704eabb8f568a-OSL
cf-cache-status: HIT
accept-ranges: bytes, bytes
age: 287210
cache-control: public, max-age=31536000
content-disposition: attachment; filename="ClanQuestMacroPublic_Release.zip"
etag: "6c2866084cfc5ac0ad0cda2d7bac50f5"
expires: Fri, 28 Mar 2025 10:43:26 GMT
last-modified: Wed, 20 Mar 2024 05:10:14 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
x-goog-generation: 1710911414158525
x-goog-hash: crc32c=zls0tw==, md5=bChmCEz8WsCtDNote6xQ9Q==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 637940
x-guploader-uploadid: ABPtcPoIF5W2Kq01HmtwY1-baIk-newHiSy8W0yEW5Vt8xef_B-t9QMrgvTRG9B2uwscpC5JWO19_EHIrA
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZWmBEaJ421jr0C56om46fxToCEffEgy5cvbp8GvWiLctyxeVjXpl1gd9EM0DpUptSEUD37YksIgTwsnY2VzuhLNlLHXK3GV07Kpyf9rzCo8IDbwXggf%2BkPAF%2BUNPe2Vry%2BGTzw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
set-cookie: __cf_bm=Z7hn2hb6SldhtN1AHwgaa4qC3bmEDzUpIO64hXaKX9g-1711622606-1.0.1.1-bKjwx7ujJN3dm5TZmdR5VOpTcQyUuEYBxwZFbpaiy0mfvoa4gWWkZUFodhs5w6JrHq9h0_Uy6kkTCiYvaeo.AQ; path=/; expires=Thu, 28-Mar-24 11:13:26 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
_cfuvid=dK0qNBKH2Da5XRtut05VVA3f26Kws09r_lyxWA5lcTg-1711622606539-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (5)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers