Report - cdn.discordapp.com/attachments/722788134336593941/1236411089080680501/RDR2_TR.zip?ex=6637e90f&is=6636978f&hm=148978a526c8fd2b307aca4dfc0b862e1a7ea8417eeeb7536cf3fa002aabb881&

Report Overview

Submitted URL
cdn.discordapp.com/attachments/722788134336593941/1236411089080680501/RDR2_TR.zip?ex=6637e90f&is=6636978f&hm=148978a526c8fd2b307aca4dfc0b862e1a7ea8417eeeb7536cf3fa002aabb881&
IP
162.159.130.233
ASN
#13335 CLOUDFLARENET
Submitted
2024-05-04 20:18:54
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
5

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cdn.discordapp.com	2474	2015-02-26	2015-08-24	2024-05-03	628 B	12 MB	162.159.130.233

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
cdn.discordapp.com/attachments/722788134336593941/1236411089080680501/RDR2_TR.zip?ex=6637e90f&is=6636978f&hm=148978a526c8fd2b307aca4dfc0b862e1a7ea8417eeeb7536cf3fa002aabb881&
IP
162.159.130.233
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
12 MB (12017327 bytes)
Hash
d85ea17be42649ed052768843992d0cc
f4ce98e2c104601ad5d9f4319948444e3b3a2b44
934c73cfc0318d44be26e217f3f34abf0d9adde94e24daeebc5bf5a73dfe0876

Archive (12)

Filename

Md5

File type

asiloader.log

eae76a2e9260e374424dcc0bee076c25

ASCII text, with CRLF line terminators

fontmap.xml

a69d69dd457a36ebb19105198d3cb249

exported SGML document, ASCII text, with CRLF line terminators

fontmap.xml

a69d69dd457a36ebb19105198d3cb249

exported SGML document, ASCII text, with CRLF line terminators

RDR2

0631b68ec127ccb93bde533c855aa734

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 970x614, components 3

RDR2D

8a3b4174e6687010abfad00358d0cd3e

PC bitmap, Windows 3.x format, 50 x 50 x 24, image size 7600, cbSize 7654, bits offset 54

rdr2tr.01

736976afde81bbdc202fa2bb48d9ce50

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

V17

ea80022677dc295e7b11d54f4b0c3a58

Unicode text, UTF-8 text, with CRLF line terminators

dinput8.dll

f66b293ad5afa49c2bd8b58bdc18d453

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

fontfix.asi

0fa5efd92129358430f351a5d6f33762

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

rdr2-translator.asi

79c7e5923b363c26aa96676ad43ba03c

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

rdr2-translator.xml

d868c4a052ccff6bcc82b521cf3d2c22

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

ScriptHookRDR2.dll

987feafad74a8cae87641dbc04108497

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/68

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

cdn.discordapp.com/attachments/722788134336593941/1236411089080680501/RDR2_TR.zip?ex=6637e90f&is=6636978f&hm=148978a526c8fd2b307aca4dfc0b862e1a7ea8417eeeb7536cf3fa002aabb881&

162.159.130.233

200 OK

12 MB

URL User Request GET HTTP/2
cdn.discordapp.com/attachments/722788134336593941/1236411089080680501/RDR2_TR.zip?ex=6637e90f&is=6636978f&hm=148978a526c8fd2b307aca4dfc0b862e1a7ea8417eeeb7536cf3fa002aabb881&
IP
162.159.130.233:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerCloudflare, Inc.
Subjectdiscordapp.com
Fingerprint97:8B:EE:AD:1E:BF:A1:69:E7:94:29:F7:55:7A:29:64:19:C7:81:39
ValidityFri, 20 Oct 2023 00:00:00 GMT - Sat, 19 Oct 2024 23:59:59 GMT

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
12 MB (12017327 bytes)
Hash
d85ea17be42649ed052768843992d0cc
f4ce98e2c104601ad5d9f4319948444e3b3a2b44
934c73cfc0318d44be26e217f3f34abf0d9adde94e24daeebc5bf5a73dfe0876

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/68

HTTP Headers

GET /attachments/722788134336593941/1236411089080680501/RDR2_TR.zip?ex=6637e90f&is=6636978f&hm=148978a526c8fd2b307aca4dfc0b862e1a7ea8417eeeb7536cf3fa002aabb881& HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 04 May 2024 20:18:22 GMT
content-type: application/zip
content-length: 12017327
cf-ray: 87eb2df6fe9d569a-OSL
cf-cache-status: MISS
accept-ranges: bytes, bytes
cache-control: public, max-age=31536000
content-disposition: attachment; filename="RDR2_TR.zip"
etag: "d85ea17be42649ed052768843992d0cc"
expires: Sun, 04 May 2025 20:18:22 GMT
last-modified: Sat, 04 May 2024 20:16:15 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
x-goog-generation: 1714853775123982
x-goog-hash: crc32c=vAmBXA==, md5=2F6he+QmSe0FJ2iEOZLQzA==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 12017327
x-guploader-uploadid: ABPtcPpyy9s4BHfTfoSy2WBAzhPi6NcQpIsi1naE8aUARB9feIrXjIk7_TW1ANx04iSsUXEb_Ww
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tvrZmhPUdphLfBfKvr9opBIH0O1o7FB9BbUzWlvtp3o44DV6iWOyOvJWFJcA%2BuktNWIQnLdbzGoOaJySunKjclX4ffHAN2VA%2BAP7%2BFxYn8X801I0Q%2BqjwhE1GOfGWmatoP%2Fw1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
set-cookie: __cf_bm=AKrzqZRyyxUswRG5wF_n0e6tW9bnUwObYWZmddBVwQI-1714853902-1.0.1.1-SGjR4ZEl7wJ3WBugBGtSOhsuE4i46Y1vLCODgvK.QJJ4mBFeBawNYkGbURgF03yf13e_f_ve5t07k2LDWrq4Jg; path=/; expires=Sat, 04-May-24 20:48:22 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
_cfuvid=8Hn625y3q8Vlslbzz__83xX7aiX3EmWBlvDOcWysee4-1714853902471-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
X-Firefox-Spdy: h2