{"report_id":"153a4377-0a10-4036-8a34-0e6bbb8abf37","version":6,"status":"done","tags":[],"date":"2024-12-13T14:09:47Z","url":{"schema":"http","addr":"update.bitsum.com/files/auto/64/beta/pl4sfx.exe","fqdn":"update.bitsum.com","domain":"bitsum.com","tld":"com"},"ip":{"addr":"104.26.5.102","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"","expires_at":"2027-02-21T14:09:47Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"update.bitsum.com","ip":{"addr":"104.26.4.102","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2002-08-03","domain_rank":336582,"first_seen":"2017-01-21T08:03:43Z","last_seen":"2024-12-12T16:51:54.273901Z","alert_count":1,"request_count":1,"received_data":3018939,"sent_data":501,"comment":"","tags":null,"fingerprints":null}],"files":[{"md5":"77646b83086bff14f2775e62b9f6c62b","sha1":"51438117269650a84dd06d6d488208d1f71fcf03","sha256":"2c9bb10c54baeb498007636e6fcac9acd5266312e3527dbaf08e11f66247df7a","sha512":"a8fb9d6f7ff2417eb99fccdbb3d3c379606446a13b853bf14441184cbdf0ad7fcd1757790364668eee77888970c408e88d4c1dd9f00953b3896df1dc22a2aa22","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","size":3017840,"url":{"schema":"http","addr":"update.bitsum.com/files/auto/64/beta/pl4sfx.exe","fqdn":"update.bitsum.com","domain":"bitsum.com","tld":"com"},"ip":{"addr":"104.26.4.102","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"YARAhub by abuse.ch","scan_date":"2024-12-13","alert":"Detects an SFX archive with automatic script execution","trigger":"update.bitsum.com/files/auto/64/beta/pl4sfx.exe","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"Xavier Mertens","date":"2023-05-17","description":"Detects an SFX archive with automatic script execution","rule":"SelfExtractingRAR","yarahub_author_email":"xmertens@isc.sans.edu","yarahub_author_twitter":"@xme","yarahub_license":"CC0 1.0","yarahub_reference_link":"https://isc.sans.edu/diary/rss/29852","yarahub_reference_md5":"7792250c87624329163817277531a5ef","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"bcc4ceab-0249-43af-8d2a-8a04d5c65c70"}}]}}],"artifacts":{"windows_shortcuts":null,"files":[{"md5":"77646b83086bff14f2775e62b9f6c62b","sha1":"51438117269650a84dd06d6d488208d1f71fcf03","sha256":"2c9bb10c54baeb498007636e6fcac9acd5266312e3527dbaf08e11f66247df7a","sha512":"a8fb9d6f7ff2417eb99fccdbb3d3c379606446a13b853bf14441184cbdf0ad7fcd1757790364668eee77888970c408e88d4c1dd9f00953b3896df1dc22a2aa22","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","size":3017840,"url":{"schema":"http","addr":"update.bitsum.com/files/auto/64/beta/pl4sfx.exe","fqdn":"update.bitsum.com","domain":"bitsum.com","tld":"com"},"ip":{"addr":"104.26.4.102","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"YARAhub by abuse.ch","scan_date":"2024-12-13","alert":"Detects an SFX archive with automatic script execution","trigger":"update.bitsum.com/files/auto/64/beta/pl4sfx.exe","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"Xavier Mertens","date":"2023-05-17","description":"Detects an SFX archive with automatic script execution","rule":"SelfExtractingRAR","yarahub_author_email":"xmertens@isc.sans.edu","yarahub_author_twitter":"@xme","yarahub_license":"CC0 1.0","yarahub_reference_link":"https://isc.sans.edu/diary/rss/29852","yarahub_reference_md5":"7792250c87624329163817277531a5ef","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"bcc4ceab-0249-43af-8d2a-8a04d5c65c70"}}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"YARAhub by abuse.ch","scan_date":"2024-12-13","alert":"Detects an SFX archive with automatic script execution","trigger":"update.bitsum.com/files/auto/64/beta/pl4sfx.exe","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"Xavier Mertens","date":"2023-05-17","description":"Detects an SFX archive with automatic script execution","rule":"SelfExtractingRAR","yarahub_author_email":"xmertens@isc.sans.edu","yarahub_author_twitter":"@xme","yarahub_license":"CC0 1.0","yarahub_reference_link":"https://isc.sans.edu/diary/rss/29852","yarahub_reference_md5":"7792250c87624329163817277531a5ef","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"bcc4ceab-0249-43af-8d2a-8a04d5c65c70"}}]},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"update.bitsum.com/files/auto/64/beta/pl4sfx.exe","fqdn":"update.bitsum.com","domain":"bitsum.com","tld":"com"},"ip":{"addr":"104.26.4.102","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-12-13T14:09:23.519155637Z","timestamp":1734098963519,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /files/auto/64/beta/pl4sfx.exe HTTP/1.1\r\nHost: update.bitsum.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 13 Dec 2024 14:09:22 GMT\r\ncontent-type: application/x-msdos-program\r\ncontent-length: 3017840\r\nstrict-transport-security: max-age=2592000; includeSubDomains; preload\r\nlast-modified: Wed, 11 Dec 2024 16:05:17 GMT\r\netag: \"7e2ea-2e0c70-62900c3881f4e\"\r\ncache-control: max-age=86400\r\nexpires: Thu, 12 Dec 2024 16:19:48 GMT\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: HIT\r\nage: 164973\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=wPMT5LUSnzqbWIG0LjijCbTWLuFI8F3eBu5JX38vUOJzWbYXAEmOsLnki5QSJy%2BoPKb%2FRukcxSTeh8YOjm8yN%2FW%2FZL6AJYRO0%2BaiLYs4kz%2FY%2FANNIqV25SWpFnCvkao7MLSW\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 8f168814999fb4f7-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=501\u0026min_rtt=470\u0026rtt_var=152\u0026sent=6\u0026recv=9\u0026lost=0\u0026retrans=0\u0026sent_bytes=2846\u0026recv_bytes=1269\u0026delivery_rate=5474480\u0026cwnd=235\u0026unsent_bytes=0\u0026cid=7feef009564877ac\u0026ts=36\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3017840,"size_decoded":3017840,"mime_type":"application/octet-stream","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","md5":"77646b83086bff14f2775e62b9f6c62b","sha1":"51438117269650a84dd06d6d488208d1f71fcf03","sha256":"2c9bb10c54baeb498007636e6fcac9acd5266312e3527dbaf08e11f66247df7a","sha512":"a8fb9d6f7ff2417eb99fccdbb3d3c379606446a13b853bf14441184cbdf0ad7fcd1757790364668eee77888970c408e88d4c1dd9f00953b3896df1dc22a2aa22","ssdeep":"49152:bILad3IzL/vt0z3RpKwCuUqPRXeDhL+N/VGWRxT2VmJ49C6wZzlAmg:bMP/lg+wpUwqCN/VXxT2E4w6wzAmg","tlshash":"27d5231277c44a72e47218322b356725e9397c302f794deba384996dde321c19632ffa","first_seen":"2024-12-11T16:20:16.403008Z","last_seen":"2024-12-16T09:44:37.573025Z","times_seen":8,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"YARAhub by abuse.ch","scan_date":"2024-12-13","alert":"Detects an SFX archive with automatic script execution","trigger":"update.bitsum.com/files/auto/64/beta/pl4sfx.exe","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"Xavier Mertens","date":"2023-05-17","description":"Detects an SFX archive with automatic script execution","rule":"SelfExtractingRAR","yarahub_author_email":"xmertens@isc.sans.edu","yarahub_author_twitter":"@xme","yarahub_license":"CC0 1.0","yarahub_reference_link":"https://isc.sans.edu/diary/rss/29852","yarahub_reference_md5":"7792250c87624329163817277531a5ef","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"bcc4ceab-0249-43af-8d2a-8a04d5c65c70"}}],"urlquery":null}}]}