{"report_id":"2cc52b4e-4d30-41a8-8bb8-d4759c7ef29a","version":6,"status":"done","tags":[],"date":"2023-09-19T05:21:44Z","url":{"schema":"http","addr":"download.spacial.com/download/firebird-setup.exe","fqdn":"download.spacial.com","domain":"spacial.com","tld":"com"},"ip":{"addr":"54.230.111.40","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-26T23:12:49Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"default"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"ocsp.godaddy.com","ip":{"addr":"192.124.249.22","port":0,"asn":30148,"as":"SUCURI-SEC","country":"United States","country_code":"US"},"domain_registered":"1999-03-02","domain_rank":698,"first_seen":"2012-05-20 21:28:57","last_seen":"2023-09-18 18:17:47","alert_count":0,"request_count":1,"received_data":2615,"sent_data":330,"comment":"","tags":null,"fingerprints":null},{"fqdn":"download.spacial.com","ip":{"addr":"54.230.111.17","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"1996-02-25","domain_rank":0,"first_seen":"2012-05-23 04:07:53","last_seen":"2023-09-17 05:00:34","alert_count":1,"request_count":1,"received_data":6763324,"sent_data":504,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":[{"md5":"716ea28943f4d63edcb5e2c7461aff32","sha1":"af7b38446beb26f3d3358e2bca2cb6babcc0e648","sha256":"b53e1c79fe586829f66619dcf19afbe4286a008b7ae8bca00f6a5126924fbfa0","sha512":"dcb1fc137421d415ab60f5848158a01c94017f3777002061438570de57aa705f3f35e8d3ca85d6b6d09fe4fbd3850b4b7aca7b939acc9bb8d469e3f675233a0e","magic":"PE32 executable (GUI) Intel 80386, for MS Windows\\012- data","size":6762852,"url":{"schema":"https","addr":"download.spacial.com/download/firebird-setup.exe","fqdn":"download.spacial.com","domain":"spacial.com","tld":"com"},"ip":{"addr":"54.230.111.17","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2023-07-05","alert":"Scan result 1/69","trigger":"b53e1c79fe586829f66619dcf19afbe4286a008b7ae8bca00f6a5126924fbfa0","verdict":"suspicious","severity":"","comment":"suspicious - 1/69","link":"https://www.virustotal.com/gui/file/b53e1c79fe586829f66619dcf19afbe4286a008b7ae8bca00f6a5126924fbfa0","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"ocsp.godaddy.com/","fqdn":"ocsp.godaddy.com","domain":"godaddy.com","tld":"com"},"ip":{"addr":"192.124.249.22","port":0,"asn":30148,"as":"SUCURI-SEC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2023-09-19T05:21:26.883720541Z","timestamp":1695100886883,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: ocsp.godaddy.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 75\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: Sucuri/Cloudproxy\r\nDate: Tue, 19 Sep 2023 05:21:26 GMT\r\nContent-Type: application/ocsp-response\r\nContent-Length: 2107\r\nConnection: keep-alive\r\nX-Sucuri-ID: 19022\r\nContent-Transfer-Encoding: Binary\r\nCache-Control: public, no-transform, must-revalidate\r\nLast-Modified: Mon, 18 Sep 2023 12:20:14 GMT\r\nExpires: Tue, 19 Sep 2023 12:20:14 GMT\r\nETag: \"e7c7b8ae91d27eb3ac2e5e36e9f50ae4986be9f1\"\r\nP3P: CP=\"IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA\"\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":2107,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"61809e644aa831f3b59b2cfd7ed7310c","sha1":"e7c7b8ae91d27eb3ac2e5e36e9f50ae4986be9f1","sha256":"60e71ef3ea96dee298bb13c09a5bce5794bc8cff524fe12448ff5c29b352dd9f","sha512":"de4d11716bec4a51330ddbfc01f0c6be5b7a4815431c6d2eaf2bfe009cccc7171bf53b3e69c5f03e511b4bf49af378504742c7bbaa0ca29c30b2e671335a348d","ssdeep":"","tlshash":"dd413ceb8f5f2999bd410f80fef8c6364c7c00e116c04ac13472c463189e78c2e9949c","first_seen":"2023-09-19T07:21:47Z","last_seen":"2023-09-19T07:21:47Z","times_seen":1,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"download.spacial.com/download/firebird-setup.exe","fqdn":"download.spacial.com","domain":"spacial.com","tld":"com"},"ip":{"addr":"54.230.111.17","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2023-09-19T05:21:26.744Z","timestamp":1695100886744,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.spacial.com","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Fri, 02 Dec 2022 23:31:57 GMT","end":"Wed, 03 Jan 2024 23:31:57 GMT"},"fingerprint":{"sha1":"24:63:B8:99:FD:C3:37:CF:C2:00:8B:F4:16:79:FB:4F:19:7B:3C:A6","sha256":"C3:26:5D:C6:D0:59:B5:58:CF:48:6A:EC:8B:6E:C3:41:C9:C6:CA:12:7E:D5:80:91:C2:6A:FB:D0:18:7E:87:E3"}}},"request":{"raw":"GET /download/firebird-setup.exe HTTP/1.1\r\nHost: download.spacial.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/octet-stream\r\ncontent-length: 6762852\r\ndate: Tue, 19 Sep 2023 02:58:21 GMT\r\nlast-modified: Thu, 30 Jun 2011 07:42:28 GMT\r\netag: \"716ea28943f4d63edcb5e2c7461aff32\"\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 07d5d44815808d5d5a6f43984a987698.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P1\r\nx-amz-cf-id: ZYBLXati8U9Knz64UThcmm-l1HdAa-eS2wD2kGTPMyx-JgirlwdCAA==\r\nage: 8586\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6762852,"size_decoded":0,"mime_type":"application/octet-stream","magic":"PE32 executable (GUI) Intel 80386, for MS Windows\\012- data","md5":"716ea28943f4d63edcb5e2c7461aff32","sha1":"af7b38446beb26f3d3358e2bca2cb6babcc0e648","sha256":"b53e1c79fe586829f66619dcf19afbe4286a008b7ae8bca00f6a5126924fbfa0","sha512":"dcb1fc137421d415ab60f5848158a01c94017f3777002061438570de57aa705f3f35e8d3ca85d6b6d09fe4fbd3850b4b7aca7b939acc9bb8d469e3f675233a0e","ssdeep":"98304:mgVfdYhBDhSSmX62DHf7ctq0RMeRj6XcfVZs/EjcdtXfRBNtpaxqzKB:ffdYDEHChGeRl6/EjcdtpBNjnO","tlshash":"94663330a8f8903bdd26ddb45cb2e666065b2e422a34c8d070dc5daf5f6b4121c9fdda","first_seen":"2023-06-18T02:42:33Z","last_seen":"2025-05-10T03:24:04.314046Z","times_seen":155,"resource_available":false,"data":null}},"time_used":1038,"timings":{"blocked":203,"dns":0,"connect":1,"send":0,"wait":97,"receive":514,"ssl":220},"alerts":{"ids":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2023-07-05","alert":"Scan result 1/69","trigger":"b53e1c79fe586829f66619dcf19afbe4286a008b7ae8bca00f6a5126924fbfa0","verdict":"suspicious","severity":"","comment":"suspicious - 1/69","link":"https://www.virustotal.com/gui/file/b53e1c79fe586829f66619dcf19afbe4286a008b7ae8bca00f6a5126924fbfa0","meta":null}],"urlquery":null}}]}