{"report_id":"1c5c2667-4b67-411b-8d93-d90d69147086","version":6,"status":"done","tags":[],"date":"2025-02-09T10:28:46Z","url":{"schema":"http","addr":"jjsploit-org.translate.goog/jjsploit_8.12.1_x64_en-US.msi","fqdn":"jjsploit-org.translate.goog","domain":"jjsploit-org.translate.goog","tld":"translate.goog"},"ip":{"addr":"142.250.74.33","port":0,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"","expires_at":"2027-04-20T10:28:46Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"jjsploit-org.translate.goog","ip":{"addr":"142.250.74.65","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2017-12-05","domain_rank":0,"first_seen":"2025-02-09T10:28:46.676647Z","last_seen":"2025-02-09T10:28:46.676647Z","alert_count":0,"request_count":1,"received_data":520,"sent_data":523,"comment":"","tags":null,"fingerprints":null},{"fqdn":"jjsploit.org","ip":{"addr":"104.21.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-09-15","domain_rank":0,"first_seen":"2021-04-13T08:38:56Z","last_seen":"2025-02-08T13:13:37.711682Z","alert_count":1,"request_count":1,"received_data":6587368,"sent_data":508,"comment":"","tags":null,"fingerprints":null}],"files":[{"md5":"5fa470597b91b91c6916fbc5222692ec","sha1":"0e517e6499e90924cfdf1728a3e397f0dff60165","sha256":"0d87eca05fe03f70a09a5234b6b14df90df6cffcfd43fa62d2e89603de017025","sha512":"feefffec81e06c677cc384ca5f63d5dd4f6ba800ae1972c5c87859ffb52e7d6b61c01d931576b044f4a527bbaa1483203c0780b3ed044125c97daff75e32daa0","magic":"Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: jjsploit, Author: wearedevs, Keywords: Installer, Comments: This installer database contains the logic and data required to install jjsploit., Template: x64;0, Revision Number: {1D7E31CC-B089-4B94-A178-D0FE61B227B9}, Create Time/Date: Thu Feb  6 02:47:48 2025, Last Saved Time/Date: Thu Feb  6 02:47:48 2025, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2","size":6586368,"url":{"schema":"https","addr":"jjsploit.org/jjsploit_8.12.1_x64_en-US.msi","fqdn":"jjsploit.org","domain":"jjsploit.org","tld":"org"},"ip":{"addr":"104.21.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2025-02-09","alert":"Scan result 2/60","trigger":"0d87eca05fe03f70a09a5234b6b14df90df6cffcfd43fa62d2e89603de017025","verdict":"suspicious","severity":"","comment":"suspicious - 2/60","link":"https://www.virustotal.com/gui/file/0d87eca05fe03f70a09a5234b6b14df90df6cffcfd43fa62d2e89603de017025","meta":null}]}}],"artifacts":{"windows_shortcuts":null,"files":[{"md5":"5fa470597b91b91c6916fbc5222692ec","sha1":"0e517e6499e90924cfdf1728a3e397f0dff60165","sha256":"0d87eca05fe03f70a09a5234b6b14df90df6cffcfd43fa62d2e89603de017025","sha512":"feefffec81e06c677cc384ca5f63d5dd4f6ba800ae1972c5c87859ffb52e7d6b61c01d931576b044f4a527bbaa1483203c0780b3ed044125c97daff75e32daa0","magic":"Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: jjsploit, Author: wearedevs, Keywords: Installer, Comments: This installer database contains the logic and data required to install jjsploit., Template: x64;0, Revision Number: {1D7E31CC-B089-4B94-A178-D0FE61B227B9}, Create Time/Date: Thu Feb  6 02:47:48 2025, Last Saved Time/Date: Thu Feb  6 02:47:48 2025, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2","size":6586368,"url":{"schema":"https","addr":"jjsploit.org/jjsploit_8.12.1_x64_en-US.msi","fqdn":"jjsploit.org","domain":"jjsploit.org","tld":"org"},"ip":{"addr":"104.21.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2025-02-09","alert":"Scan result 2/60","trigger":"0d87eca05fe03f70a09a5234b6b14df90df6cffcfd43fa62d2e89603de017025","verdict":"suspicious","severity":"","comment":"suspicious - 2/60","link":"https://www.virustotal.com/gui/file/0d87eca05fe03f70a09a5234b6b14df90df6cffcfd43fa62d2e89603de017025","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"jjsploit-org.translate.goog/jjsploit_8.12.1_x64_en-US.msi","fqdn":"jjsploit-org.translate.goog","domain":"jjsploit-org.translate.goog","tld":"translate.goog"},"ip":{"addr":"142.250.74.65","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-02-09T10:28:15.333Z","timestamp":1739096895333,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.googleusercontent.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jan 2025 08:37:02 GMT","end":"Mon, 14 Apr 2025 08:37:01 GMT"},"fingerprint":{"sha1":"C8:CC:73:3C:09:B6:EA:83:B3:FA:9E:8C:00:A3:C5:10:94:1A:0A:E7","sha256":"22:C7:41:B4:B4:B3:92:CB:F4:E8:99:DB:2B:4F:23:83:C0:D4:75:10:B6:CE:A1:2A:56:07:31:B6:84:3C:EE:79"}}},"request":{"raw":"GET /jjsploit_8.12.1_x64_en-US.msi HTTP/1.1\r\nHost: jjsploit-org.translate.goog\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ncontent-type: application/binary\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: Mon, 01 Jan 1990 00:00:00 GMT\r\ndate: Sun, 09 Feb 2025 10:28:16 GMT\r\nlocation: https://jjsploit.org/jjsploit_8.12.1_x64_en-US.msi\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: unsafe-none\r\nserver: ESF\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"application/x-msdownload","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-19T09:23:21.870352Z","times_seen":13929305,"resource_available":true,"data":null}},"time_used":1002,"timings":{"blocked":109,"dns":25,"connect":20,"send":0,"wait":783,"receive":0,"ssl":63},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jjsploit.org/jjsploit_8.12.1_x64_en-US.msi","fqdn":"jjsploit.org","domain":"jjsploit.org","tld":"org"},"ip":{"addr":"104.21.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-02-09T10:28:16.234Z","timestamp":1739096896234,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jjsploit.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 13 Jan 2025 19:49:46 GMT","end":"Sun, 13 Apr 2025 20:47:14 GMT"},"fingerprint":{"sha1":"D6:2D:01:8A:07:7A:E2:4F:3B:00:B8:1E:2D:39:1B:9A:3F:0C:FB:20","sha256":"92:3D:40:2A:47:88:BB:E6:8E:5C:F8:F2:8A:E6:82:DB:13:59:9A:56:D0:5E:F0:75:64:0F:95:A4:38:5D:A0:83"}}},"request":{"raw":"GET /jjsploit_8.12.1_x64_en-US.msi HTTP/1.1\r\nHost: jjsploit.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 09 Feb 2025 10:28:16 GMT\r\ncontent-type: application/x-msdownload\r\ncontent-length: 6586368\r\ncache-control: public, max-age=2592000\r\nexpires: Tue, 11 Mar 2025 10:28:16 GMT\r\nlast-modified: Thu, 06 Feb 2025 14:14:32 GMT\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=unV%2FzJXZ25lrCcZwHuIqFZiskC7OVEKwyGoTPbUXs7IbVVWFWS%2Fr%2Fxzp1N54znu%2FSl2OwI%2FVP9BPU1wsHt%2BZooii7%2B%2FMtu%2FrD5iwE%2B%2BJ4FzQYAmwsb%2FW5X7LaXbfNAw%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 90f32bf1ccec56bb-OSL\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=5544\u0026min_rtt=480\u0026rtt_var=10148\u0026sent=8\u0026recv=11\u0026lost=0\u0026retrans=0\u0026sent_bytes=3274\u0026recv_bytes=1269\u0026delivery_rate=8568047\u0026cwnd=254\u0026unsent_bytes=0\u0026cid=918c88bd2ebd5168\u0026ts=258\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6586368,"size_decoded":6586368,"mime_type":"application/x-msdownload","magic":"Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: jjsploit, Author: wearedevs, Keywords: Installer, Comments: This installer database contains the logic and data required to install jjsploit., Template: x64;0, Revision Number: {1D7E31CC-B089-4B94-A178-D0FE61B227B9}, Create Time/Date: Thu Feb  6 02:47:48 2025, Last Saved Time/Date: Thu Feb  6 02:47:48 2025, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2","md5":"5fa470597b91b91c6916fbc5222692ec","sha1":"0e517e6499e90924cfdf1728a3e397f0dff60165","sha256":"0d87eca05fe03f70a09a5234b6b14df90df6cffcfd43fa62d2e89603de017025","sha512":"feefffec81e06c677cc384ca5f63d5dd4f6ba800ae1972c5c87859ffb52e7d6b61c01d931576b044f4a527bbaa1483203c0780b3ed044125c97daff75e32daa0","ssdeep":"196608:4ECk0/NjzuaSazEtvA2LHM9lHFfv51yMReftfgic:4EC3pCazEFs9llXz9ReftYic","tlshash":"2566335bfe90d426c5670e77563793a09bbebc204a96c94b3795b219ddf02c08b708e3","first_seen":"2025-02-07T20:13:32.736829Z","last_seen":"2025-03-28T12:38:06.462929Z","times_seen":18,"resource_available":false,"data":null}},"time_used":1191,"timings":{"blocked":57,"dns":41,"connect":1,"send":0,"wait":244,"receive":831,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2025-02-09","alert":"Scan result 2/60","trigger":"0d87eca05fe03f70a09a5234b6b14df90df6cffcfd43fa62d2e89603de017025","verdict":"suspicious","severity":"","comment":"suspicious - 2/60","link":"https://www.virustotal.com/gui/file/0d87eca05fe03f70a09a5234b6b14df90df6cffcfd43fa62d2e89603de017025","meta":null}],"urlquery":null}}]}