{"report_id":"57607efc-0b8e-4b48-81dc-981069f20111","version":6,"status":"done","tags":[],"date":"2025-04-15T13:23:42Z","url":{"schema":"http","addr":"rossware.net/FontInstaller.zip","fqdn":"rossware.net","domain":"rossware.net","tld":"net"},"ip":{"addr":"52.26.197.232","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-24T13:23:42Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"rossware.net","ip":{"addr":"54.203.186.90","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2000-06-02","domain_rank":0,"first_seen":"2014-08-14T17:46:16Z","last_seen":"2025-04-13T23:49:05.38156Z","alert_count":0,"request_count":1,"received_data":1403701,"sent_data":498,"comment":"","tags":null,"fingerprints":null}],"files":[{"md5":"2d32e7c57705254ffbe240ccc4857ffa","sha1":"241e493fcd4be159614af8afd694ba59afb64742","sha256":"e6935f9fee714bfdc545d4243d5bb25b301ba7f73c81d58237eda6e611eccde8","sha512":"ddd34c20ef163c629477f9fa9e6b3032e74f3364b461fa2f2111dfc1ad75ae4a742c661f93503a473fadfc7c2005c0fa66fdbc14a5d69dbe5f38c927654067f3","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate","size":1403435,"url":{"schema":"https","addr":"rossware.net/FontInstaller.zip","fqdn":"rossware.net","domain":"rossware.net","tld":"net"},"ip":{"addr":"54.203.186.90","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"archive":[{"path":"setup.exe","filename":"setup.exe","modified":"2004-02-22T23:00:00Z","Modified":"","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","size":139776,"md5":"a77a5e80020273ff0f6eea3990c76cb6","sha1":"8eefea2d1bb7d93037976429340793c1bcce0d84","sha256":"3d0041832e8b6f5b95cb33d286c24c53ccc9341549589ae8822c6084e8d2aa5c","sha512":"ab296892cb314914c9c04a37441a2f9a41cf5b5e1eafdaee6b576338f2be9501170587eb13bdbb715cf0d79e3beef0f57e3e472b187c51196e1d2d38a3be2cb6","alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2025-04-09","alert":"Scan result 1/72","trigger":"3d0041832e8b6f5b95cb33d286c24c53ccc9341549589ae8822c6084e8d2aa5c","verdict":"suspicious","severity":"","comment":"suspicious - 1/72","link":"https://www.virustotal.com/gui/file/3d0041832e8b6f5b95cb33d286c24c53ccc9341549589ae8822c6084e8d2aa5c","meta":null}]}},{"path":"SETUP.LST","filename":"SETUP.LST","modified":"2009-01-01T16:03:18Z","Modified":"","magic":"Generic INItialization configuration [Bootstrap Files]","size":3494,"md5":"f8d0019673a6a2fc8d285970162260ec","sha1":"7873ac1657ef7347388ad5bac41f13a6ddbf46a4","sha256":"2f61f1806edf3b75945c3bdcb64b8885fc5af2f88fb684da72202905e5dc20c5","sha512":"c32a7f33e649731b3eb349e998076ea04bb30dbf86ddef3d8520b8b1e51d8d90e319c91b82641b5ff73263c09957542f814f307249e64c37136a8a9179e7b106","alerts":{"urlquery":null,"analyzer":null}},{"path":"FontInstaller.CAB","filename":"FontInstaller.CAB","modified":"2009-01-01T16:03:22Z","Modified":"","magic":"Microsoft Cabinet archive data, many, 1343658 bytes, 11 files, at 0x1830 last modified Sun, Jan 01 2009 15:51:22 +A \"FontInstaller.exe\" last modified Sun, Apr 13 2008 16:12:00 +A \"msvbvm60.dll\", flags 0x4, ID 11941, number 1, extra bytes 6144 in head, 85 datablocks, 0x1 compression","size":1343658,"md5":"1a63314824b0499641a8449ba524dba9","sha1":"c797c5416281861f9f2e9e84515e1d914e8becb3","sha256":"2ae74d60ea400065027d17f82e5e6f52bf5fa64571a86aaefec4d9d94536e182","sha512":"4b8ef7a592dfb32dac7ca463435ff69a93134c55b552344a261b47ff540fa97843a4aade203b9c5d568de99756d67bb2a37201dec97ab7f264a427b6be5942c8","alerts":{"urlquery":null,"analyzer":null}}],"alerts":{"urlquery":null,"analyzer":null}}],"artifacts":{"windows_shortcuts":null,"files":[{"md5":"2d32e7c57705254ffbe240ccc4857ffa","sha1":"241e493fcd4be159614af8afd694ba59afb64742","sha256":"e6935f9fee714bfdc545d4243d5bb25b301ba7f73c81d58237eda6e611eccde8","sha512":"ddd34c20ef163c629477f9fa9e6b3032e74f3364b461fa2f2111dfc1ad75ae4a742c661f93503a473fadfc7c2005c0fa66fdbc14a5d69dbe5f38c927654067f3","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate","size":1403435,"url":{"schema":"https","addr":"rossware.net/FontInstaller.zip","fqdn":"rossware.net","domain":"rossware.net","tld":"net"},"ip":{"addr":"54.203.186.90","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"archive":[{"path":"setup.exe","filename":"setup.exe","modified":"2004-02-22T23:00:00Z","Modified":"","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","size":139776,"md5":"a77a5e80020273ff0f6eea3990c76cb6","sha1":"8eefea2d1bb7d93037976429340793c1bcce0d84","sha256":"3d0041832e8b6f5b95cb33d286c24c53ccc9341549589ae8822c6084e8d2aa5c","sha512":"ab296892cb314914c9c04a37441a2f9a41cf5b5e1eafdaee6b576338f2be9501170587eb13bdbb715cf0d79e3beef0f57e3e472b187c51196e1d2d38a3be2cb6","alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2025-04-09","alert":"Scan result 1/72","trigger":"3d0041832e8b6f5b95cb33d286c24c53ccc9341549589ae8822c6084e8d2aa5c","verdict":"suspicious","severity":"","comment":"suspicious - 1/72","link":"https://www.virustotal.com/gui/file/3d0041832e8b6f5b95cb33d286c24c53ccc9341549589ae8822c6084e8d2aa5c","meta":null}]}},{"path":"SETUP.LST","filename":"SETUP.LST","modified":"2009-01-01T16:03:18Z","Modified":"","magic":"Generic INItialization configuration [Bootstrap Files]","size":3494,"md5":"f8d0019673a6a2fc8d285970162260ec","sha1":"7873ac1657ef7347388ad5bac41f13a6ddbf46a4","sha256":"2f61f1806edf3b75945c3bdcb64b8885fc5af2f88fb684da72202905e5dc20c5","sha512":"c32a7f33e649731b3eb349e998076ea04bb30dbf86ddef3d8520b8b1e51d8d90e319c91b82641b5ff73263c09957542f814f307249e64c37136a8a9179e7b106","alerts":{"urlquery":null,"analyzer":null}},{"path":"FontInstaller.CAB","filename":"FontInstaller.CAB","modified":"2009-01-01T16:03:22Z","Modified":"","magic":"Microsoft Cabinet archive data, many, 1343658 bytes, 11 files, at 0x1830 last modified Sun, Jan 01 2009 15:51:22 +A \"FontInstaller.exe\" last modified Sun, Apr 13 2008 16:12:00 +A \"msvbvm60.dll\", flags 0x4, ID 11941, number 1, extra bytes 6144 in head, 85 datablocks, 0x1 compression","size":1343658,"md5":"1a63314824b0499641a8449ba524dba9","sha1":"c797c5416281861f9f2e9e84515e1d914e8becb3","sha256":"2ae74d60ea400065027d17f82e5e6f52bf5fa64571a86aaefec4d9d94536e182","sha512":"4b8ef7a592dfb32dac7ca463435ff69a93134c55b552344a261b47ff540fa97843a4aade203b9c5d568de99756d67bb2a37201dec97ab7f264a427b6be5942c8","alerts":{"urlquery":null,"analyzer":null}}],"alerts":{"urlquery":null,"analyzer":null}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rossware.net/FontInstaller.zip","fqdn":"rossware.net","domain":"rossware.net","tld":"net"},"ip":{"addr":"54.203.186.90","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"","requested_by":"","date":"2025-04-15T13:23:19.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"rossware.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Sun, 26 Jan 2025 00:00:00 GMT","end":"Tue, 24 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"89:EE:B3:53:45:A9:A5:6B:87:BB:DD:86:B8:7A:EA:93:96:93:FC:32","sha256":"6E:AE:C5:B2:82:68:C8:78:C8:1F:F7:AC:C2:80:5D:A1:93:D4:48:44:AF:72:62:42:66:8C:42:9A:DA:0E:9B:14"}}},"request":{"raw":"GET /FontInstaller.zip HTTP/1.1\r\nHost: rossware.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 15 Apr 2025 13:23:20 GMT\r\ncontent-type: application/zip\r\ncontent-length: 1403435\r\nserver: Apache/2.4.58 (Amazon Linux)\r\nlast-modified: Mon, 11 Mar 2024 16:37:28 GMT\r\netag: \"156a2b-61365283d6200\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1403435,"size_decoded":0,"mime_type":"application/zip","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate","md5":"2d32e7c57705254ffbe240ccc4857ffa","sha1":"241e493fcd4be159614af8afd694ba59afb64742","sha256":"e6935f9fee714bfdc545d4243d5bb25b301ba7f73c81d58237eda6e611eccde8","sha512":"ddd34c20ef163c629477f9fa9e6b3032e74f3364b461fa2f2111dfc1ad75ae4a742c661f93503a473fadfc7c2005c0fa66fdbc14a5d69dbe5f38c927654067f3","ssdeep":"24576:ZEFDf9IEHXzhHAcruz09SXbHt3HvDG32VvysKRrY/uE9BrXqQPWG/hTW7S+0NrxA:ZiDfzzecazU4pHvDGmVvysKRKuE9B+Qm","tlshash":"9a5533cc4e413a27a8361b72f65e3152ea0cd4f6239c4aac85e47d161bdfa65f473b20","first_seen":"2024-02-10T06:31:28Z","last_seen":"2025-04-15T13:23:43.653466Z","times_seen":19,"resource_available":false,"data":null}},"time_used":2339,"timings":{"blocked":530,"dns":1,"connect":172,"send":0,"wait":347,"receive":931,"ssl":354},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}