Report - download-2.ggdlcdn.com/portal/static/prod/global/updates/iron/launcher/win/x64/GGPCOM/0.0.0.276/launcher_GGPCOM_live_full_0_0_0_276

Report Overview

Submitted URL
download-2.ggdlcdn.com/portal/static/prod/global/updates/iron/launcher/win/x64/GGPCOM/0.0.0.276/launcher_GGPCOM_live_full_0_0_0_276_202404181342.zip
IP
163.171.134.109
ASN
#54994 ML-1432-54994
Submitted
2024-04-23 13:37:46
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
download-2.ggdlcdn.com	unknown	2020-05-28	2022-08-21	2024-04-17	602 B	1.9 MB	163.171.134.109

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

Files detected

URL
download-2.ggdlcdn.com/portal/static/prod/global/updates/iron/launcher/win/x64/GGPCOM/0.0.0.276/launcher_GGPCOM_live_full_0_0_0_276_202404181342.zip
IP
163.171.134.109
ASN
#54994 ML-1432-54994

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.9 MB (1901403 bytes)
Hash
0836fe2ecb8177a33590ffde1dab72f8
cc3a65d992f27b8ea4cb11faf2758336f4441f79
98db101a587b82954225f38d365c5f087333287dbbc81470cd9080ed37634a87

Archive (4)

Filename

Md5

File type

expapply.dll

792881a692daed94031a10327776d298

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

favicon.ico

86ebeab3e0dd43701c7e9bf1b465b7f0

MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 48x48, 32 bits/pixel

Launcher_bg.bmp

75a0eaf629971dafe8d416fdab93147c

PC bitmap, Windows 3.x format, 416 x 250 x 32, resolution 3780 x 3780 px/m, cbSize 416054, bits offset 54

launcher.exe

0e211be9e49e127d001ada33860c71e2

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

	URL	IP	Response	Size
	download-2.ggdlcdn.com/portal/static/prod/global/updates/iron/launcher/win/x64/GGPCOM/0.0.0.276/launcher_GGPCOM_live_full_0_0_0_276_202404181342.zip	163.171.134.109	200 OK	1.9 MB
URL User Request GET HTTP/1.1 download-2.ggdlcdn.com/portal/static/prod/global/updates/iron/launcher/win/x64/GGPCOM/0.0.0.276/launcher_GGPCOM_live_full_0_0_0_276_202404181342.zip IP 163.171.134.109:443 ASN #54994 ML-1432-54994 Certificate IssuerGlobalSign nv-sa Subjectsupport9.cdnetworks.net Fingerprint03:DA:00:F6:FC:74:49:7E:68:57:F3:B2:42:83:08:0C:95:63:0A:2F ValidityWed, 29 Nov 2023 07:38:10 GMT - Mon, 11 Nov 2024 09:16:12 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 1.9 MB (1901403 bytes) Hash 0836fe2ecb8177a33590ffde1dab72f8 cc3a65d992f27b8ea4cb11faf2758336f4441f79 98db101a587b82954225f38d365c5f087333287dbbc81470cd9080ed37634a87 HTTP Headers GET /portal/static/prod/global/updates/iron/launcher/win/x64/GGPCOM/0.0.0.276/launcher_GGPCOM_live_full_0_0_0_276_202404181342.zip HTTP/1.1 Host: download-2.ggdlcdn.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 13:37:20 GMT Content-Type: application/zip;charset=UTF-8 Content-Length: 1901403 Connection: keep-alive Accept-Ranges: bytes ETag: "0836fe2ecb8177a33590ffde1dab72f8" Last-Modified: Thu, 18 Apr 2024 13:56:14 GMT Server: PWS/8.3.1.0.8 X-Reqid: 205524922423414520240418220546t3KKzGqNsampled Age: 429882 Via: 1.1 PShgseSEL3ek160:6 (W), 1.1 PS-ARN-01C8L93:11 (W) X-Px: ht PS-ARN-01C8L93ARN X-Ws-Request-Id: 6627b990_PSrdsdgemSTO1sw92_40250-23903 Access-Control-Allow-Origin: * Cache-Control: max-age=604800

download-2.ggdlcdn.com/portal/static/prod/global/updates/iron/launcher/win/x64/GGPCOM/0.0.0.276/launcher_GGPCOM_live_full_0_0_0_276_202404181342.zip

163.171.134.109

200 OK

1.9 MB

URL User Request GET HTTP/1.1
download-2.ggdlcdn.com/portal/static/prod/global/updates/iron/launcher/win/x64/GGPCOM/0.0.0.276/launcher_GGPCOM_live_full_0_0_0_276_202404181342.zip
IP
163.171.134.109:443
ASN
#54994 ML-1432-54994

Certificate
IssuerGlobalSign nv-sa
Subjectsupport9.cdnetworks.net
Fingerprint03:DA:00:F6:FC:74:49:7E:68:57:F3:B2:42:83:08:0C:95:63:0A:2F
ValidityWed, 29 Nov 2023 07:38:10 GMT - Mon, 11 Nov 2024 09:16:12 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.9 MB (1901403 bytes)
Hash
0836fe2ecb8177a33590ffde1dab72f8
cc3a65d992f27b8ea4cb11faf2758336f4441f79
98db101a587b82954225f38d365c5f087333287dbbc81470cd9080ed37634a87

HTTP Headers

GET /portal/static/prod/global/updates/iron/launcher/win/x64/GGPCOM/0.0.0.276/launcher_GGPCOM_live_full_0_0_0_276_202404181342.zip HTTP/1.1
Host: download-2.ggdlcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 13:37:20 GMT
Content-Type: application/zip;charset=UTF-8
Content-Length: 1901403
Connection: keep-alive
Accept-Ranges: bytes
ETag: "0836fe2ecb8177a33590ffde1dab72f8"
Last-Modified: Thu, 18 Apr 2024 13:56:14 GMT
Server: PWS/8.3.1.0.8
X-Reqid: 205524922423414520240418220546t3KKzGqNsampled
Age: 429882
Via: 1.1 PShgseSEL3ek160:6 (W), 1.1 PS-ARN-01C8L93:11 (W)
X-Px: ht PS-ARN-01C8L93ARN
X-Ws-Request-Id: 6627b990_PSrdsdgemSTO1sw92_40250-23903
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (4)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers