{"report_id":"7b350a6b-ebc4-42fd-9c75-6a42263e30cc","version":6,"status":"done","tags":[],"date":"2025-04-07T09:07:38Z","url":{"schema":"http","addr":"api.metaskins.gg/storage/dGw9I3TvMfryOEGSQ5HYi1DZzLGzGLKJ2KNMr0Kb.exe","fqdn":"api.metaskins.gg","domain":"metaskins.gg","tld":"gg"},"ip":{"addr":"104.21.2.85","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-16T09:07:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"api.metaskins.gg","ip":{"addr":"104.21.2.85","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-03-25","domain_rank":0,"first_seen":"2025-04-05T21:18:01.050674Z","last_seen":"2025-04-05T21:18:01.050674Z","alert_count":1,"request_count":1,"received_data":7330728,"sent_data":537,"comment":"","tags":null,"fingerprints":null}],"files":[{"md5":"4238d55d43bed69641d9a24b0fe1e2d4","sha1":"314f1ff3c30746f0db518ef02654c238d9ecd22f","sha256":"e75c64d6d5ab4ba338236ad8b264c82e3b65e767ca1e2b7403beb3fbeb64b600","sha512":"9dd18fe447c6e936566ae9dd7492af68420224a4840049846800922a1a01c5636490418e5730b183ccab0b7df56e46dde72b4e9b5e7aca31f2dc51c30a5e2b67","magic":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 13 sections","size":7329808,"url":{"schema":"https","addr":"api.metaskins.gg/storage/dGw9I3TvMfryOEGSQ5HYi1DZzLGzGLKJ2KNMr0Kb.exe","fqdn":"api.metaskins.gg","domain":"metaskins.gg","tld":"gg"},"ip":{"addr":"104.21.2.85","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2025-04-07","alert":"Scan result 13/71","trigger":"e75c64d6d5ab4ba338236ad8b264c82e3b65e767ca1e2b7403beb3fbeb64b600","verdict":"malicious","severity":"","comment":"malicious - 13/71","link":"https://www.virustotal.com/gui/file/e75c64d6d5ab4ba338236ad8b264c82e3b65e767ca1e2b7403beb3fbeb64b600","meta":null}]}}],"artifacts":{"windows_shortcuts":null,"files":[{"md5":"4238d55d43bed69641d9a24b0fe1e2d4","sha1":"314f1ff3c30746f0db518ef02654c238d9ecd22f","sha256":"e75c64d6d5ab4ba338236ad8b264c82e3b65e767ca1e2b7403beb3fbeb64b600","sha512":"9dd18fe447c6e936566ae9dd7492af68420224a4840049846800922a1a01c5636490418e5730b183ccab0b7df56e46dde72b4e9b5e7aca31f2dc51c30a5e2b67","magic":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 13 sections","size":7329808,"url":{"schema":"https","addr":"api.metaskins.gg/storage/dGw9I3TvMfryOEGSQ5HYi1DZzLGzGLKJ2KNMr0Kb.exe","fqdn":"api.metaskins.gg","domain":"metaskins.gg","tld":"gg"},"ip":{"addr":"104.21.2.85","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2025-04-07","alert":"Scan result 13/71","trigger":"e75c64d6d5ab4ba338236ad8b264c82e3b65e767ca1e2b7403beb3fbeb64b600","verdict":"malicious","severity":"","comment":"malicious - 13/71","link":"https://www.virustotal.com/gui/file/e75c64d6d5ab4ba338236ad8b264c82e3b65e767ca1e2b7403beb3fbeb64b600","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"api.metaskins.gg/storage/dGw9I3TvMfryOEGSQ5HYi1DZzLGzGLKJ2KNMr0Kb.exe","fqdn":"api.metaskins.gg","domain":"metaskins.gg","tld":"gg"},"ip":{"addr":"104.21.2.85","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"","requested_by":"","date":"2025-04-07T09:07:15.114Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaskins.gg","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Mar 2025 19:30:36 GMT","end":"Mon, 23 Jun 2025 20:28:58 GMT"},"fingerprint":{"sha1":"47:C2:EC:E8:3E:5D:76:59:E8:55:98:8B:AC:4C:03:05:D5:22:57:0E","sha256":"BB:F6:FD:BD:7B:E4:5A:42:3E:84:86:BE:47:2D:2E:49:E1:78:E8:10:EA:AB:C5:78:A1:BE:39:43:24:5E:A4:98"}}},"request":{"raw":"GET /storage/dGw9I3TvMfryOEGSQ5HYi1DZzLGzGLKJ2KNMr0Kb.exe HTTP/1.1\r\nHost: api.metaskins.gg\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 07 Apr 2025 09:07:15 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 7329808\r\nlast-modified: Sun, 06 Apr 2025 18:15:38 GMT\r\netag: \"67f2c4ca-6fd810\"\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=xVFbH2K1XqZ6n2rvrnNYo6Gn73WS64ASs4hHymVEzioo06ZtERD5xlqUOaibiPqkHt5wzrEu7vhcbrUgvnIGFJP8Nrmgsl2525uAPekqEE4R0XLercoSmyMlNvVMd1eTtju1\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 92c85fa3a8c65696-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=2855\u0026min_rtt=669\u0026rtt_var=3114\u0026sent=9\u0026recv=11\u0026lost=0\u0026retrans=1\u0026sent_bytes=3571\u0026recv_bytes=1297\u0026delivery_rate=2140428\u0026cwnd=254\u0026unsent_bytes=0\u0026cid=e668d0e4504ebc7a\u0026ts=158\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7329808,"size_decoded":0,"mime_type":"application/octet-stream","magic":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 13 sections","md5":"4238d55d43bed69641d9a24b0fe1e2d4","sha1":"314f1ff3c30746f0db518ef02654c238d9ecd22f","sha256":"e75c64d6d5ab4ba338236ad8b264c82e3b65e767ca1e2b7403beb3fbeb64b600","sha512":"9dd18fe447c6e936566ae9dd7492af68420224a4840049846800922a1a01c5636490418e5730b183ccab0b7df56e46dde72b4e9b5e7aca31f2dc51c30a5e2b67","ssdeep":"196608:zk2NDZHQaW20bBl3ZbzeCrSaOxrR2PzF1:zk2N1HQ/Blp5EBwJ1","tlshash":"927633128ec96426f9529bb23990356c8370657b48cac37dcd11dc3822e1af8db57fda","first_seen":"2025-04-07T09:07:40.048893Z","last_seen":"2025-04-07T09:07:40.048893Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1045,"timings":{"blocked":35,"dns":0,"connect":1,"send":0,"wait":142,"receive":833,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2025-04-07","alert":"Scan result 13/71","trigger":"e75c64d6d5ab4ba338236ad8b264c82e3b65e767ca1e2b7403beb3fbeb64b600","verdict":"malicious","severity":"","comment":"malicious - 13/71","link":"https://www.virustotal.com/gui/file/e75c64d6d5ab4ba338236ad8b264c82e3b65e767ca1e2b7403beb3fbeb64b600","meta":null}],"urlquery":null}}]}