Report - cdn.gilcdn.com/ContentMediaGenericFiles/f815c1a5842babb1faf1036d07650d64-Full.zip?w=1&h=1&Expires=1715375580&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvZjgxNWMxYTU4NDJiYWJiMWZhZjEwMzZkMDc2NTBkNjQtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxNTM3NTU4MH19fV19&Signature=nbRbIQEXgk~rZc9AuLnrqvVYVxhdZz~fOkl9vOO8uth53z-wWblAJbtcYfF-32LmjSzdy~RTQlIkRSuiMUAIpXjC2bKVTioNhnWEI4YIlaFuALqGKGyUj79yxAuJHG5ZBQS6Cgcv99D9QRyud6X-4cNSeC2qcnyxYFdBE3LasPqSz0Wcang0harJrx3KHSRAfDUJphV0xOcW1q3JtBD9fKN3fvSJyGifoD1hAjuNtkWCzHpljk51OliIa6sGBsWaJt6aqcQZCIrXHMsqi3GC3TJHt5w85WurEPkSXkY06xgEUe88te29e-uxKFYQic~1ttzi3USH8Yr7uucIh~AKpA_

Report Overview

Submitted URL
cdn.gilcdn.com/ContentMediaGenericFiles/f815c1a5842babb1faf1036d07650d64-Full.zip?w=1&h=1&Expires=1715375580&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvZjgxNWMxYTU4NDJiYWJiMWZhZjEwMzZkMDc2NTBkNjQtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxNTM3NTU4MH19fV19&Signature=nbRbIQEXgk~rZc9AuLnrqvVYVxhdZz~fOkl9vOO8uth53z-wWblAJbtcYfF-32LmjSzdy~RTQlIkRSuiMUAIpXjC2bKVTioNhnWEI4YIlaFuALqGKGyUj79yxAuJHG5ZBQS6Cgcv99D9QRyud6X-4cNSeC2qcnyxYFdBE3LasPqSz0Wcang0harJrx3KHSRAfDUJphV0xOcW1q3JtBD9fKN3fvSJyGifoD1hAjuNtkWCzHpljk51OliIa6sGBsWaJt6aqcQZCIrXHMsqi3GC3TJHt5w85WurEPkSXkY06xgEUe88te29e-uxKFYQic~1ttzi3USH8Yr7uucIh~AKpA__&Key-Pair-Id=K1FFKFZRWAZSB
IP
54.230.111.37
ASN
#16509 AMAZON-02
Submitted
2024-05-10 21:08:31
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.r2m03.amazontrust.com	unknown	2007-05-11	2023-02-21	2024-05-09	338 B	942 B	3.164.222.26
cdn.gilcdn.com	unknown	2023-12-13	2023-12-15	2024-05-05	1.2 kB	117 kB	54.230.111.31

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
cdn.gilcdn.com/ContentMediaGenericFiles/f815c1a5842babb1faf1036d07650d64-Full.zip?w=1&h=1&Expires=1715375580&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvZjgxNWMxYTU4NDJiYWJiMWZhZjEwMzZkMDc2NTBkNjQtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxNTM3NTU4MH19fV19&Signature=nbRbIQEXgk~rZc9AuLnrqvVYVxhdZz~fOkl9vOO8uth53z-wWblAJbtcYfF-32LmjSzdy~RTQlIkRSuiMUAIpXjC2bKVTioNhnWEI4YIlaFuALqGKGyUj79yxAuJHG5ZBQS6Cgcv99D9QRyud6X-4cNSeC2qcnyxYFdBE3LasPqSz0Wcang0harJrx3KHSRAfDUJphV0xOcW1q3JtBD9fKN3fvSJyGifoD1hAjuNtkWCzHpljk51OliIa6sGBsWaJt6aqcQZCIrXHMsqi3GC3TJHt5w85WurEPkSXkY06xgEUe88te29e-uxKFYQic~1ttzi3USH8Yr7uucIh~AKpA__&Key-Pair-Id=K1FFKFZRWAZSB
IP
54.230.111.31
ASN
#16509 AMAZON-02

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
116 kB (115540 bytes)
Hash
f815c1a5842babb1faf1036d07650d64
9487c92d632eecad720d84a20c51bf1aa15fea05
a7f8ca3d265305a6e42e80e29f5a072fd2c26446414042497a5d2d4c4a5f2524

Archive (2)

Filename

Md5

File type

HeapAdjuster.asi

7ed737a5cd0488896465688d09d8197c

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

HeapAdjuster.ini

faed60321a9f812bc5fd57f8d94a3954

ASCII text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	ocsp.r2m03.amazontrust.com/	3.164.222.26		471 B
URL ocsp.r2m03.amazontrust.com/ IP 3.164.222.26:0 ASN #0 File type data Size 471 B (471 bytes) Hash 8c29ceabf6e16cb3d7ca23eda0f049c3 591ff461f1bfda7259a45465f3acfbb86f88f3b3 1b7b2de830909956fb001b4e7c512899c5e5134fef4f6d024b1f4a37b9b42410 HTTP Headers `POST / HTTP/1.1 Host: ocsp.r2m03.amazontrust.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Accept-Ranges: bytes Cache-Control: max-age=7200 Date: Fri, 10 May 2024 21:08:07 GMT Last-Modified: Fri, 10 May 2024 19:25:34 GMT Server: ECAcc (amb/6AC3) X-Cache: Miss from cloudfront Via: 1.1 ab37fc2d73bd6e477f5652b6cb140162.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ARN53-P1 X-Amz-Cf-Id: 6NCi78phDbfOH-kSoQUevvQCPYjStG02LUvZGc704Dbd_NqypVLrbw== Age: 6153`

	cdn.gilcdn.com/ContentMediaGenericFiles/f815c1a5842babb1faf1036d07650d64-Full.zip?w=1&h=1&Expires=1715375580&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvZjgxNWMxYTU4NDJiYWJiMWZhZjEwMzZkMDc2NTBkNjQtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxNTM3NTU4MH19fV19&Signature=nbRbIQEXgk~rZc9AuLnrqvVYVxhdZz~fOkl9vOO8uth53z-wWblAJbtcYfF-32LmjSzdy~RTQlIkRSuiMUAIpXjC2bKVTioNhnWEI4YIlaFuALqGKGyUj79yxAuJHG5ZBQS6Cgcv99D9QRyud6X-4cNSeC2qcnyxYFdBE3LasPqSz0Wcang0harJrx3KHSRAfDUJphV0xOcW1q3JtBD9fKN3fvSJyGifoD1hAjuNtkWCzHpljk51OliIa6sGBsWaJt6aqcQZCIrXHMsqi3GC3TJHt5w85WurEPkSXkY06xgEUe88te29e-uxKFYQic~1ttzi3USH8Yr7uucIh~AKpA__&Key-Pair-Id=K1FFKFZRWAZSB	54.230.111.31	200 OK	116 kB
URL User Request GET HTTP/2 cdn.gilcdn.com/ContentMediaGenericFiles/f815c1a5842babb1faf1036d07650d64-Full.zip?w=1&h=1&Expires=1715375580&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvZjgxNWMxYTU4NDJiYWJiMWZhZjEwMzZkMDc2NTBkNjQtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxNTM3NTU4MH19fV19&Signature=nbRbIQEXgk~rZc9AuLnrqvVYVxhdZz~fOkl9vOO8uth53z-wWblAJbtcYfF-32LmjSzdy~RTQlIkRSuiMUAIpXjC2bKVTioNhnWEI4YIlaFuALqGKGyUj79yxAuJHG5ZBQS6Cgcv99D9QRyud6X-4cNSeC2qcnyxYFdBE3LasPqSz0Wcang0harJrx3KHSRAfDUJphV0xOcW1q3JtBD9fKN3fvSJyGifoD1hAjuNtkWCzHpljk51OliIa6sGBsWaJt6aqcQZCIrXHMsqi3GC3TJHt5w85WurEPkSXkY06xgEUe88te29e-uxKFYQic~1ttzi3USH8Yr7uucIh~AKpA__&Key-Pair-Id=K1FFKFZRWAZSB IP 54.230.111.31:443 ASN #16509 AMAZON-02 Certificate IssuerAmazon Subject.gilcdn.com FingerprintB6:3B:AA:24:2D:F6:F2:2D:66:81:B5:0E:46:3F:D8:31:FD:D4:75:49 ValidityThu, 14 Dec 2023 00:00:00 GMT - Sat, 11 Jan 2025 23:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 116 kB (115540 bytes) Hash f815c1a5842babb1faf1036d07650d64 9487c92d632eecad720d84a20c51bf1aa15fea05 a7f8ca3d265305a6e42e80e29f5a072fd2c26446414042497a5d2d4c4a5f2524 HTTP Headers GET /ContentMediaGenericFiles/f815c1a5842babb1faf1036d07650d64-Full.zip?w=1&h=1&Expires=1715375580&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9jZG4uZ2lsY2RuLmNvbS9Db250ZW50TWVkaWFHZW5lcmljRmlsZXMvZjgxNWMxYTU4NDJiYWJiMWZhZjEwMzZkMDc2NTBkNjQtRnVsbC56aXA~dz0xJmg9MSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxNTM3NTU4MH19fV19&Signature=nbRbIQEXgk~rZc9AuLnrqvVYVxhdZz~fOkl9vOO8uth53z-wWblAJbtcYfF-32LmjSzdy~RTQlIkRSuiMUAIpXjC2bKVTioNhnWEI4YIlaFuALqGKGyUj79yxAuJHG5ZBQS6Cgcv99D9QRyud6X-4cNSeC2qcnyxYFdBE3LasPqSz0Wcang0harJrx3KHSRAfDUJphV0xOcW1q3JtBD9fKN3fvSJyGifoD1hAjuNtkWCzHpljk51OliIa6sGBsWaJt6aqcQZCIrXHMsqi3GC3TJHt5w85WurEPkSXkY06xgEUe88te29e-uxKFYQic~1ttzi3USH8Yr7uucIh~AKpA__&Key-Pair-Id=K1FFKFZRWAZSB HTTP/1.1 Host: cdn.gilcdn.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 200 OK content-type: application/zip content-length: 115540 date: Fri, 10 May 2024 21:08:08 GMT last-modified: Fri, 10 May 2024 21:08:01 GMT etag: "f815c1a5842babb1faf1036d07650d64" x-amz-storage-class: INTELLIGENT_TIERING x-amz-server-side-encryption: AES256 cache-control: public,max-age=31536000,immutable content-disposition: attachment; filename=225d5d-HeapAdjuster-ini.zip x-amz-meta-jsonsecure: 8790d126a92c78bb3c13373ff3606ca827fa3be8e5641bef96eb77a7af1c525769ee73bba99ff8dfd775d735abf82c46855683039ea48ddc5a7ee110353a77cd5e893af8b74519a2e44302a49b4b702bc7bd9d071b1dc25092.6734669df6fb9f27cfbd57d646847a50.9873b1f23125f65ae634e06f93f94e47816c3245464536f4c80896c084ed32f2 x-amz-version-id: TcBn7Wn2C6wkQUtmyWKDkZvZis08cRxw accept-ranges: bytes server: AmazonS3 x-cache: Miss from cloudfront via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-P1 alt-svc: h3=":443"; ma=86400 x-amz-cf-id: tt6I6oc59219r55I6j24JY1zJ86S3WaM95OjApfSNs2PNQliznzDLg== vary: Origin X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (2)

Detections

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers