Report - 3dsignal.com/download/lonely

Report Overview

Submitted URL
3dsignal.com/download/lonely_tree.exe
IP
54.164.132.226
ASN
#14618 AMAZON-AES
Submitted
2024-05-07 08:38:16
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
3dsignal.com	unknown	2007-11-06	2012-05-30	2024-01-23	491 B	390 B	54.164.132.226
download.3dsignal.com	unknown	2007-11-06	2012-05-29	2024-02-15	411 B	5.8 MB	54.164.132.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
download.3dsignal.com/win/lonely_tree.exe
IP
54.164.132.226
ASN
#14618 AMAZON-AES

File type
PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
Size
5.8 MB (5836913 bytes)
Hash
3b9de6da0d81a66200055dde70887168
1cb975dec63896a77d8ea22436930e57a6df91f6
cabdf48cc39e8baafa23a3a99eba15fa9375ce86899fdcec974aaed5739bb620

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/72

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

3dsignal.com/download/lonely_tree.exe

54.164.132.226

169 B

URL
3dsignal.com/download/lonely_tree.exe
IP
54.164.132.226:0
ASN
#14618 AMAZON-AES

File type
HTML document, ASCII text, with CRLF line terminators
Size
169 B (169 bytes)
Hash
09b3bd776c8c2a6364ed91b7667603f7
8c30d1df04b2aa30a3dc6e1cf6cc4fb9d7652982
284d85a14bd67316a4e5ce5c04d72abc266ead81b2e407f27b5b230e32c60e1a

HTTP Headers

GET /download/lonely_tree.exe HTTP/1.1
Host: 3dsignal.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: nginx/1.26.0
Date: Tue, 07 May 2024 08:37:51 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: http://download.3dsignal.com/win/lonely_tree.exe

download.3dsignal.com/win/lonely_tree.exe

54.164.132.226

200 OK

5.8 MB

URL User Request GET HTTP/1.1
download.3dsignal.com/win/lonely_tree.exe
IP
54.164.132.226:80
ASN
#14618 AMAZON-AES

File type
PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
Size
5.8 MB (5836913 bytes)
Hash
3b9de6da0d81a66200055dde70887168
1cb975dec63896a77d8ea22436930e57a6df91f6
cabdf48cc39e8baafa23a3a99eba15fa9375ce86899fdcec974aaed5739bb620

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/72

HTTP Headers

GET /win/lonely_tree.exe HTTP/1.1
Host: download.3dsignal.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.26.0
Date: Tue, 07 May 2024 08:37:51 GMT
Content-Type: application/octet-stream
Content-Length: 5836913
Last-Modified: Wed, 24 Apr 2024 15:09:09 GMT
Connection: keep-alive
ETag: "66292095-591071"
Expires: Tue, 14 May 2024 08:37:51 GMT
Cache-Control: max-age=604800, public
Accept-Ranges: bytes

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers