Report - cdn.ldplayer.net/download/ldad/LDPlayer9.exe?n=LDPlayer9_es_1009

Report Overview

Visitedpublic

2024-05-22 00:59:06

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
cdn.ldplayer.net	unknown	2018-11-19	2023-11-09 12:22:12	2024-04-10 09:56:23	525 B	3.5 MB	54.230.111.42
aus5.mozilla.org	2548	1998-01-24	2015-10-27 08:06:24	2024-05-20 18:27:01	512 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

cdn.ldplayer.net/download/ldad/LDPlayer9.exe?n=LDPlayer9_es_1009_ld.exe

IP / ASN

54.230.111.42

#16509 AMAZON-02

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

Size3.5 MB (3461368 bytes)

MD552311163022dbd17bb80414f3d18c194

SHA1d6e0a809eda9724f9cd16770da59ef8b50210c8f

SHA2566ae4f439c7bb84942e3f3f17b7bb3ba48cee214832b28a38b2f29a985b054cc5

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 10/72

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET cdn.ldplayer.net/download/ldad/LDPlayer9.exe?n=LDPlayer9_es_1009_ld.exe

54.230.111.42

200 OK

3.5 MB

URL User Request GET HTTPS

cdn.ldplayer.net/download/ldad/LDPlayer9.exe?n=LDPlayer9_es_1009_ld.exe

IP / ASN

54.230.111.42

#16509 AMAZON-02

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

First Seen2024-04-24

Last Seen2024-08-20

Times Seen84

Size3.5 MB (3461368 bytes)

MD552311163022dbd17bb80414f3d18c194

SHA1d6e0a809eda9724f9cd16770da59ef8b50210c8f

SHA2566ae4f439c7bb84942e3f3f17b7bb3ba48cee214832b28a38b2f29a985b054cc5

Certificate Info

IssuerAmazon

Subject*.ldplayer.net

FingerprintE8:54:6E:34:3B:C5:25:33:2B:9F:54:B6:A5:63:B5:EA:DC:48:6B:09

ValiditySat, 09 Sep 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 10/72

HTTP Headers

GET /download/ldad/LDPlayer9.exe?n=LDPlayer9_es_1009_ld.exe HTTP/1.1
Host: cdn.ldplayer.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/octet-stream
content-length: 3461368
server: AliyunOSS
x-oss-request-id: 664AC0BF0900E6373496D5A4
accept-ranges: bytes
last-modified: Tue, 23 Apr 2024 08:46:02 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 2048601488971175648
x-oss-storage-class: Standard
x-oss-server-side-encryption: AES256
content-md5: UjERYwItvRe7gEFPPRjBlA==
x-oss-server-time: 27
date: Tue, 21 May 2024 03:20:38 GMT
etag: "52311163022DBD17BB80414F3D18C194"
vary: Accept-Encoding
content-disposition: attachment;filename=LDPlayer9_es_1009_ld.exe
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: ChgZXIjEgDJMybZSSj383kd3CeAuCiPYSGgZj7T___k8utBx1CbCaQ==
age: 77882
X-Firefox-Spdy: h2

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL HTTP

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

IP / ASN

35.244.181.201

#396982 GOOGLE-CLOUD-PLATFORM

Requested byN/A

Resource Info

File typeXML 1.0 document, ASCII text, with very long lines (332)

First Seen2023-10-13

Last Seen2025-06-20

Times Seen185315

Size444 B (444 bytes)

MD53b324dec137a87ef7e24a30a65b13dd0

SHA1c0faa95b2f1018e264b3a14aaf50d1003e6c27b3

SHA2566cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/202402/aus.content-signature.mozilla.org-2024-07-04-09-28-34.chain; p384ecdsa=KjF-bzTyjJXg0NWHpv6jg-QHUf01OzRohHAj9tRJt1vXcUUFbe-DvfYCgEkpg2uKfAI_G4iygLMKsCwYRsMF7xRP5N8YQBlslO1q0OTzCVV-QIPnROUMN1wLaenUS0PU
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Wed, 22 May 2024 00:57:09 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 111
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2