{"report_id":"195d6f4e-f7a5-4610-b81c-6e221ff1c671","version":6,"status":"done","tags":[],"date":"2025-01-05T14:34:27Z","url":{"schema":"http","addr":"setup.pekora.zip/ProjectXPlayerLauncher.exe","fqdn":"setup.pekora.zip","domain":"pekora.zip","tld":"zip"},"ip":{"addr":"172.67.144.192","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"","expires_at":"2027-03-16T14:34:27Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"setup.pekora.zip","ip":{"addr":"172.67.144.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"domain_registered":"2024-12-16","domain_rank":0,"first_seen":"2024-12-21T05:30:22.11876Z","last_seen":"2025-01-04T23:06:57.647696Z","alert_count":2,"request_count":1,"received_data":706485,"sent_data":497,"comment":"","tags":null,"fingerprints":null}],"files":[{"md5":"073f1916542ee2817c9760f0c0367334","sha1":"ef41394d8ebcc6f157b2a5835236dfc4cdfff927","sha256":"6a51fd09f20a918cb416a84716f91219d0af5d2d3b1ffe7d4075d97f4cac89cf","sha512":"a70f87eef56911b8fef0f1bcd1dc99cae1d3ff4db34d86baf5e4afec51e1eb09bdf29ea2ca3ad03a5c5916d9e6e313d5194ab8864692454433c7d019a345df03","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","size":705536,"url":{"schema":"https","addr":"setup.pekora.zip/ProjectXPlayerLauncher.exe","fqdn":"setup.pekora.zip","domain":"pekora.zip","tld":"zip"},"ip":{"addr":"172.67.144.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-12-24","alert":"Scan result 27/72","trigger":"6a51fd09f20a918cb416a84716f91219d0af5d2d3b1ffe7d4075d97f4cac89cf","verdict":"malicious","severity":"","comment":"malicious - 27/72","link":"https://www.virustotal.com/gui/file/6a51fd09f20a918cb416a84716f91219d0af5d2d3b1ffe7d4075d97f4cac89cf","meta":null}]}}],"artifacts":{"windows_shortcuts":null,"files":[{"md5":"073f1916542ee2817c9760f0c0367334","sha1":"ef41394d8ebcc6f157b2a5835236dfc4cdfff927","sha256":"6a51fd09f20a918cb416a84716f91219d0af5d2d3b1ffe7d4075d97f4cac89cf","sha512":"a70f87eef56911b8fef0f1bcd1dc99cae1d3ff4db34d86baf5e4afec51e1eb09bdf29ea2ca3ad03a5c5916d9e6e313d5194ab8864692454433c7d019a345df03","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","size":705536,"url":{"schema":"https","addr":"setup.pekora.zip/ProjectXPlayerLauncher.exe","fqdn":"setup.pekora.zip","domain":"pekora.zip","tld":"zip"},"ip":{"addr":"172.67.144.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-12-24","alert":"Scan result 27/72","trigger":"6a51fd09f20a918cb416a84716f91219d0af5d2d3b1ffe7d4075d97f4cac89cf","verdict":"malicious","severity":"","comment":"malicious - 27/72","link":"https://www.virustotal.com/gui/file/6a51fd09f20a918cb416a84716f91219d0af5d2d3b1ffe7d4075d97f4cac89cf","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-01-05","alert":"Sinkholed","trigger":"pekora.zip","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}]},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"setup.pekora.zip/ProjectXPlayerLauncher.exe","fqdn":"setup.pekora.zip","domain":"pekora.zip","tld":"zip"},"ip":{"addr":"172.67.144.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-01-05T14:34:01.921Z","timestamp":1736087641921,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"deb1fe9d.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Dec 2024 17:03:41 GMT","end":"Tue, 18 Mar 2025 18:03:32 GMT"},"fingerprint":{"sha1":"3F:AE:A7:D1:1F:78:61:A6:6B:3F:88:59:3D:1F:C9:59:11:75:72:9F","sha256":"A4:36:7B:C3:C6:58:EE:45:02:D9:3A:62:90:32:6A:19:C0:C1:D6:B1:8A:48:C6:0D:8C:1B:5C:F3:A3:61:2A:47"}}},"request":{"raw":"GET /ProjectXPlayerLauncher.exe HTTP/1.1\r\nHost: setup.pekora.zip\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 05 Jan 2025 14:34:01 GMT\r\ncontent-type: application/x-msdownload\r\ncontent-length: 705536\r\netag: \"073f1916542ee2817c9760f0c0367334\"\r\nlast-modified: Wed, 18 Dec 2024 23:02:20 GMT\r\nvary: Accept-Encoding\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nage: 4203\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=CkndmnELTKqpPdKR1i%2Bk%2BHFbecIAOIVVxlLrLMCI1mk8u1xGt6brg9PomTinqXIOMS%2BaGEBY6uYsdXdiccCQzXFq3BIXYgr9cJ%2FbMs1uNevvX11iZjfO5wGCLeFhHfM4oHwH\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 8fd42fd2382fb521-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=709\u0026min_rtt=482\u0026rtt_var=300\u0026sent=6\u0026recv=10\u0026lost=0\u0026retrans=0\u0026sent_bytes=3241\u0026recv_bytes=1137\u0026delivery_rate=7661375\u0026cwnd=253\u0026unsent_bytes=0\u0026cid=6965829da9c04d16\u0026ts=46\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":705536,"size_decoded":705536,"mime_type":"application/x-msdownload","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","md5":"073f1916542ee2817c9760f0c0367334","sha1":"ef41394d8ebcc6f157b2a5835236dfc4cdfff927","sha256":"6a51fd09f20a918cb416a84716f91219d0af5d2d3b1ffe7d4075d97f4cac89cf","sha512":"a70f87eef56911b8fef0f1bcd1dc99cae1d3ff4db34d86baf5e4afec51e1eb09bdf29ea2ca3ad03a5c5916d9e6e313d5194ab8864692454433c7d019a345df03","ssdeep":"6144:jghqvXBNmS42ufwckYOUEpNnK1uQwEMWIZLA5EWTBU7J+Ju+qNuhienWBBjN4J7a:jhYO8XE7ZQRSkyWTG7JGkeH4D","tlshash":"e1e42a92af0f98e1e05111f2d955814c72af6cb17a2286c3a28677ccca75dc7b331e5e","first_seen":"2024-12-21T16:03:18.006246Z","last_seen":"2025-05-16T14:56:55.722872Z","times_seen":12,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":37,"dns":1,"connect":1,"send":0,"wait":15,"receive":46,"ssl":32},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-01-05","alert":"Sinkholed","trigger":"pekora.zip","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-12-24","alert":"Scan result 27/72","trigger":"6a51fd09f20a918cb416a84716f91219d0af5d2d3b1ffe7d4075d97f4cac89cf","verdict":"malicious","severity":"","comment":"malicious - 27/72","link":"https://www.virustotal.com/gui/file/6a51fd09f20a918cb416a84716f91219d0af5d2d3b1ffe7d4075d97f4cac89cf","meta":null}],"urlquery":null}}]}