{"report_id":"3b0b241d-0b2c-4c35-a4fe-550e3bfb1be0","version":6,"status":"done","tags":[],"date":"2024-11-29T22:28:04Z","url":{"schema":"http","addr":"gitlab.com/gameripper/gameripper/raw/main/gameripper-windows.zip","fqdn":"gitlab.com","domain":"gitlab.com","tld":"com"},"ip":{"addr":"172.65.251.78","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"","expires_at":"2027-02-07T22:28:04Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"gitlab.com","ip":{"addr":"172.65.251.78","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"domain_registered":"2004-01-15","domain_rank":17719,"first_seen":"2014-06-06T22:31:24Z","last_seen":"2024-11-27T18:39:05.579356Z","alert_count":1,"request_count":1,"received_data":2167496,"sent_data":518,"comment":"","tags":null,"fingerprints":null}],"files":[{"md5":"5630c7fa87f57451f9ab1df9d36155bb","sha1":"89185f7a63879c2d65627ad9b51f1da543429a39","sha256":"c2bfa5070033d99c5db14a75a2d90f3a99cde0cf99ad7210262de0007a6cf563","sha512":"b910625f18d23ff9e3e0e9c6a6affffaff9af02ade75f262b6563ac3b8a9bf05eab262d13018048b7bdd096945cb1b9ed586683952c6af2f6b61e6d7967395b7","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate","size":2164397,"url":{"schema":"https","addr":"gitlab.com/gameripper/gameripper/raw/main/gameripper-windows.zip","fqdn":"gitlab.com","domain":"gitlab.com","tld":"com"},"ip":{"addr":"172.65.251.78","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"archive":[{"path":"README.md","filename":"README.md","modified":"","Modified":"2024-11-29T21:38:45+01:00","magic":"ASCII text","size":7581,"md5":"4d93cda4fcddb8670e56801c6c2e6574","sha1":"1318f75b123c16bbdee2d6f5ba7987def9e990b4","sha256":"252d8486eeaf76ed03583654d97cc6ae17bd8fa8e2591b42c8f8ca0f69c77ad4","sha512":"f24a73dae2b875d9b296e7c70a486098e30359fbe2c7e8d090372a267747247f7e2a1216db14da3e3740cd200dda3f20bd06b35110e6c7728d5ca9ae9bdd9229","alerts":{"urlquery":null,"analyzer":null}},{"path":"gameripper.exe","filename":"gameripper.exe","modified":"","Modified":"2024-11-29T21:49:00+01:00","magic":"PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 11 sections","size":3802112,"md5":"9edb1243352dcc13e4273e7405d33689","sha1":"4e5629b0f25c1634e768a19d67c4369f1a0a4fb5","sha256":"424437e68a9ecd28971268d842bd2718c1cab4bf855a18e5525d1d943fd05a63","sha512":"421470bac98abab47ae4fcb957d195505ffe6f9b79461c3562d965db829aeb3c1ea4ef7b72713b4b422525aaf80e5f3a1f53b8d9ef247d54c7da687bfcf61ebe","alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-11-29","alert":"Scan result 4/72","trigger":"424437e68a9ecd28971268d842bd2718c1cab4bf855a18e5525d1d943fd05a63","verdict":"suspicious","severity":"","comment":"suspicious - 4/72","link":"https://www.virustotal.com/gui/file/424437e68a9ecd28971268d842bd2718c1cab4bf855a18e5525d1d943fd05a63","meta":null}]}}],"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-11-29","alert":"Scan result 2/66","trigger":"c2bfa5070033d99c5db14a75a2d90f3a99cde0cf99ad7210262de0007a6cf563","verdict":"suspicious","severity":"","comment":"suspicious - 2/66","link":"https://www.virustotal.com/gui/file/c2bfa5070033d99c5db14a75a2d90f3a99cde0cf99ad7210262de0007a6cf563","meta":null}]}}],"artifacts":{"windows_shortcuts":null,"files":[{"md5":"5630c7fa87f57451f9ab1df9d36155bb","sha1":"89185f7a63879c2d65627ad9b51f1da543429a39","sha256":"c2bfa5070033d99c5db14a75a2d90f3a99cde0cf99ad7210262de0007a6cf563","sha512":"b910625f18d23ff9e3e0e9c6a6affffaff9af02ade75f262b6563ac3b8a9bf05eab262d13018048b7bdd096945cb1b9ed586683952c6af2f6b61e6d7967395b7","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate","size":2164397,"url":{"schema":"https","addr":"gitlab.com/gameripper/gameripper/raw/main/gameripper-windows.zip","fqdn":"gitlab.com","domain":"gitlab.com","tld":"com"},"ip":{"addr":"172.65.251.78","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"archive":[{"path":"README.md","filename":"README.md","modified":"","Modified":"2024-11-29T21:38:45+01:00","magic":"ASCII text","size":7581,"md5":"4d93cda4fcddb8670e56801c6c2e6574","sha1":"1318f75b123c16bbdee2d6f5ba7987def9e990b4","sha256":"252d8486eeaf76ed03583654d97cc6ae17bd8fa8e2591b42c8f8ca0f69c77ad4","sha512":"f24a73dae2b875d9b296e7c70a486098e30359fbe2c7e8d090372a267747247f7e2a1216db14da3e3740cd200dda3f20bd06b35110e6c7728d5ca9ae9bdd9229","alerts":{"urlquery":null,"analyzer":null}},{"path":"gameripper.exe","filename":"gameripper.exe","modified":"","Modified":"2024-11-29T21:49:00+01:00","magic":"PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 11 sections","size":3802112,"md5":"9edb1243352dcc13e4273e7405d33689","sha1":"4e5629b0f25c1634e768a19d67c4369f1a0a4fb5","sha256":"424437e68a9ecd28971268d842bd2718c1cab4bf855a18e5525d1d943fd05a63","sha512":"421470bac98abab47ae4fcb957d195505ffe6f9b79461c3562d965db829aeb3c1ea4ef7b72713b4b422525aaf80e5f3a1f53b8d9ef247d54c7da687bfcf61ebe","alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-11-29","alert":"Scan result 4/72","trigger":"424437e68a9ecd28971268d842bd2718c1cab4bf855a18e5525d1d943fd05a63","verdict":"suspicious","severity":"","comment":"suspicious - 4/72","link":"https://www.virustotal.com/gui/file/424437e68a9ecd28971268d842bd2718c1cab4bf855a18e5525d1d943fd05a63","meta":null}]}}],"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-11-29","alert":"Scan result 2/66","trigger":"c2bfa5070033d99c5db14a75a2d90f3a99cde0cf99ad7210262de0007a6cf563","verdict":"suspicious","severity":"","comment":"suspicious - 2/66","link":"https://www.virustotal.com/gui/file/c2bfa5070033d99c5db14a75a2d90f3a99cde0cf99ad7210262de0007a6cf563","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"Mnemonic Secure DNS","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"gitlab.com/gameripper/gameripper/raw/main/gameripper-windows.zip","fqdn":"gitlab.com","domain":"gitlab.com","tld":"com"},"ip":{"addr":"172.65.251.78","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2024-11-29T22:27:38.915Z","timestamp":1732919258915,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gitlab.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 12 Apr 2024 00:00:00 GMT","end":"Sun, 11 May 2025 23:59:59 GMT"},"fingerprint":{"sha1":"F7:4E:F9:4C:4E:B4:FF:39:A2:19:F7:5D:40:CF:10:26:D7:E7:F2:99","sha256":"A7:2B:29:21:4B:15:3C:88:4B:74:2F:8A:58:10:69:53:4D:55:B0:E2:11:CB:65:D6:94:91:6B:4B:F5:E3:37:9D"}}},"request":{"raw":"GET /gameripper/gameripper/raw/main/gameripper-windows.zip HTTP/1.1\r\nHost: gitlab.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 29 Nov 2024 22:27:39 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 2164397\r\ncf-ray: 8ea606b87b690b59-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\ncache-control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60\r\ncontent-disposition: attachment\r\netag: \"e011850042a5ee81004b346ba9230ad3\"\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\ncontent-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com snowplow.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e\u0026sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-f/2j8wAO8qSHo3IwYwX/ug=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data:\r\ngitlab-lb: haproxy-main-47-lb-gprd\r\ngitlab-sv: web-gke-us-east1-d\r\npermissions-policy: interest-cohort=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-gitlab-meta: {\"correlation_id\":\"01JDX0J7HD58C54B36QGHEV0WT\",\"version\":\"1\"}\r\nx-permitted-cross-domain-policies: none\r\nx-request-id: 01JDX0J7HD58C54B36QGHEV0WT\r\nx-runtime: 0.101685\r\nx-ua-compatible: IE=edge\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=u7dQDbGC74jgOxlOgsIANIqUJChrdC0lqZtn4nm%2BG5y%2BmpRuRaUh8vx8abgaNAGldzvallDpo%2FnRJf8Mn6AMwjIkoEtBIx1ijyKku%2BSpuzTq66VctKmjkI%2Fc28w%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nset-cookie: _cfuvid=sNGzO7xZA5Jm_jAa3AZehY5dmQnZ_DXMCVQPGzaIFR4-1732919259137-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2164397,"size_decoded":2164397,"mime_type":"application/octet-stream","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate","md5":"5630c7fa87f57451f9ab1df9d36155bb","sha1":"89185f7a63879c2d65627ad9b51f1da543429a39","sha256":"c2bfa5070033d99c5db14a75a2d90f3a99cde0cf99ad7210262de0007a6cf563","sha512":"b910625f18d23ff9e3e0e9c6a6affffaff9af02ade75f262b6563ac3b8a9bf05eab262d13018048b7bdd096945cb1b9ed586683952c6af2f6b61e6d7967395b7","ssdeep":"49152:0EtlhaK9FW5cc0qspqcvWpCv4RyaAn9oIZ245XDnEDWNC:NlhaqqspStsoIXhDE","tlshash":"eaa5332e9d34ab3cbe55f8f58ba1864334c13c48a780577b1275e712d1d9f1b0a67e0a","first_seen":"2024-11-29T22:28:05.69313Z","last_seen":"2024-11-29T22:28:05.69313Z","times_seen":1,"resource_available":false,"data":null}},"time_used":822,"timings":{"blocked":35,"dns":1,"connect":17,"send":0,"wait":208,"receive":536,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-11-29","alert":"Scan result 2/66","trigger":"c2bfa5070033d99c5db14a75a2d90f3a99cde0cf99ad7210262de0007a6cf563","verdict":"suspicious","severity":"","comment":"suspicious - 2/66","link":"https://www.virustotal.com/gui/file/c2bfa5070033d99c5db14a75a2d90f3a99cde0cf99ad7210262de0007a6cf563","meta":null}],"urlquery":null}}]}