{"report_id":"9f05264e-bdf7-4fbb-9960-b2ea1293c7c2","version":6,"status":"done","tags":[],"date":"2024-04-16T09:56:19Z","url":{"schema":"http","addr":"secure.eicar.org/eicar.com.txt","fqdn":"secure.eicar.org","domain":"eicar.org","tld":"org"},"ip":{"addr":"89.238.73.97","port":0,"asn":34240,"as":"manitu GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"secure.eicar.org/eicar.com.txt","fqdn":"secure.eicar.org","domain":"eicar.org","tld":"org"},"title":"secure.eicar.org/eicar.com.txt"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-25T20:03:20Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"secure.eicar.org","ip":{"addr":"89.238.73.97","port":443,"asn":34240,"as":"manitu GmbH","country":"Germany","country_code":"DE"},"domain_registered":"1998-03-25","domain_rank":0,"first_seen":"2017-02-06 10:32:57","last_seen":"2024-04-14 01:52:55","alert_count":4,"request_count":2,"received_data":2763,"sent_data":922,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":[{"md5":"44d88612fea8a8f36de82e1278abb02f","sha1":"3395856ce81f2b7382dee72602f798b642f14140","sha256":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","sha512":"cc805d5fab1fd71a4ab352a9c533e65fb2d5b885518f4e565e68847223b8e6b85cb48f3afad842726d99239c9e36505c64b0dc9a061d9e507d833277ada336ab","magic":"EICAR virus test files","size":68,"url":{"schema":"https","addr":"secure.eicar.org/eicar.com.txt","fqdn":"secure.eicar.org","domain":"eicar.org","tld":"org"},"ip":{"addr":"89.238.73.97","port":443,"asn":34240,"as":"manitu GmbH","country":"Germany","country_code":"DE"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2024-04-16","alert":"Just an EICAR test file - this is boring but users asked for it","trigger":"secure.eicar.org/eicar.com.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2019-03-24","description":"Just an EICAR test file - this is boring but users asked for it","hash1":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","reference":"http://2016.eicar.org/85-0-Download.html","rule":"SUSP_Just_EICAR","score":"40"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Trellix Threat Reasearch YARA rules","scan_date":"2024-04-16","alert":"Rule to detect the EICAR pattern","trigger":"secure.eicar.org/eicar.com.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/advanced-threat-research/Yara-Rules/tree/master","meta":{"actor_group":"Unknown","actor_type":"Unknown","author":"Marc Rivero | McAfee ATR Team","description":"Rule to detect the EICAR pattern","hash":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","malware_family":"W32/Eicar","malware_type":"eicar","reference":"https://www.eicar.org/","rule":"malw_eicar","rule_version":"v1"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Elastic Security YARA Rules","scan_date":"2024-04-16","alert":"Multi.EICAR.Not-a-virus","trigger":"secure.eicar.org/eicar.com.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/elastic/protections-artifacts/tree/main/yara","meta":{"arch_context":"x86, arm64","author":"Elastic Security","creation_date":"2021-01-21","fingerprint":"bb0e0bdf70ec65d98f652e2428e3567013d5413f2725a2905b372fd18da8b9dd","id":"ac8f42d6-52da-46ec-8db1-5a5f69222a38","last_modified":"2022-01-13","license":"Elastic License v2","os":"multi","rule":"Multi_EICAR_ac8f42d6","scan_context":"file, memory","severity":"1","threat_name":"Multi.EICAR.Not-a-virus"}},{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-04-16","alert":"Scan result 65/66","trigger":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","verdict":"malicious","severity":"","comment":"malicious - 65/66","link":"https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2024-04-16","alert":"Just an EICAR test file - this is boring but users asked for it","trigger":"secure.eicar.org/eicar.com.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2019-03-24","description":"Just an EICAR test file - this is boring but users asked for it","hash1":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","reference":"http://2016.eicar.org/85-0-Download.html","rule":"SUSP_Just_EICAR","score":"40"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Trellix Threat Reasearch YARA rules","scan_date":"2024-04-16","alert":"Rule to detect the EICAR pattern","trigger":"secure.eicar.org/eicar.com.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/advanced-threat-research/Yara-Rules/tree/master","meta":{"actor_group":"Unknown","actor_type":"Unknown","author":"Marc Rivero | McAfee ATR Team","description":"Rule to detect the EICAR pattern","hash":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","malware_family":"W32/Eicar","malware_type":"eicar","reference":"https://www.eicar.org/","rule":"malw_eicar","rule_version":"v1"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Elastic Security YARA Rules","scan_date":"2024-04-16","alert":"Multi.EICAR.Not-a-virus","trigger":"secure.eicar.org/eicar.com.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/elastic/protections-artifacts/tree/main/yara","meta":{"arch_context":"x86, arm64","author":"Elastic Security","creation_date":"2021-01-21","fingerprint":"bb0e0bdf70ec65d98f652e2428e3567013d5413f2725a2905b372fd18da8b9dd","id":"ac8f42d6-52da-46ec-8db1-5a5f69222a38","last_modified":"2022-01-13","license":"Elastic License v2","os":"multi","rule":"Multi_EICAR_ac8f42d6","scan_context":"file, memory","severity":"1","threat_name":"Multi.EICAR.Not-a-virus"}}]},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"secure.eicar.org/eicar.com.txt","fqdn":"secure.eicar.org","domain":"eicar.org","tld":"org"},"ip":{"addr":"89.238.73.97","port":443,"asn":34240,"as":"manitu GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2024-04-16T09:55:54.500Z","timestamp":1713261354500,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"secure.eicar.org","organization":""},"issuer":{"commonName":"R3","organization":"Let's Encrypt"},"validity":{"start":"Thu, 22 Feb 2024 06:15:10 GMT","end":"Wed, 22 May 2024 06:15:09 GMT"},"fingerprint":{"sha1":"DD:A0:D1:81:08:20:0A:A6:86:41:D2:9B:8A:70:9D:4D:9B:11:79:A6","sha256":"C9:08:45:67:4F:F2:48:CA:64:4A:F9:3F:AE:7D:C2:DC:4A:78:9B:E7:0F:5C:71:02:15:BE:4A:07:D6:4B:5E:51"}}},"request":{"raw":"GET /eicar.com.txt HTTP/1.1\r\nHost: secure.eicar.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 16 Apr 2024 09:55:44 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 01 Jul 2020 19:34:06 GMT\r\nETag: \"44-5a966600698bd\"\r\nAccept-Ranges: bytes\r\nContent-Length: 68\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nKeep-Alive: timeout=5, max=50\r\nConnection: Keep-Alive\r\nContent-Type: text/plain; charset=utf-8\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":68,"size_decoded":68,"mime_type":"text/plain; charset=utf-8","magic":"EICAR virus test files","md5":"44d88612fea8a8f36de82e1278abb02f","sha1":"3395856ce81f2b7382dee72602f798b642f14140","sha256":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","sha512":"cc805d5fab1fd71a4ab352a9c533e65fb2d5b885518f4e565e68847223b8e6b85cb48f3afad842726d99239c9e36505c64b0dc9a061d9e507d833277ada336ab","ssdeep":"","tlshash":"41a022003b0eee2ba20b00200032e8b00808020e2ce00a3820a020b8c83308803ec228","first_seen":"2023-04-06T11:20:18Z","last_seen":"2026-09-25T16:46:50.454467Z","times_seen":1942,"resource_available":true,"data":null}},"time_used":200,"timings":{"blocked":87,"dns":0,"connect":26,"send":0,"wait":26,"receive":0,"ssl":55},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2024-04-16","alert":"Just an EICAR test file - this is boring but users asked for it","trigger":"secure.eicar.org/eicar.com.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2019-03-24","description":"Just an EICAR test file - this is boring but users asked for it","hash1":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","reference":"http://2016.eicar.org/85-0-Download.html","rule":"SUSP_Just_EICAR","score":"40"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Trellix Threat Reasearch YARA rules","scan_date":"2024-04-16","alert":"Rule to detect the EICAR pattern","trigger":"secure.eicar.org/eicar.com.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/advanced-threat-research/Yara-Rules/tree/master","meta":{"actor_group":"Unknown","actor_type":"Unknown","author":"Marc Rivero | McAfee ATR Team","description":"Rule to detect the EICAR pattern","hash":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","malware_family":"W32/Eicar","malware_type":"eicar","reference":"https://www.eicar.org/","rule":"malw_eicar","rule_version":"v1"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Elastic Security YARA Rules","scan_date":"2024-04-16","alert":"Multi.EICAR.Not-a-virus","trigger":"secure.eicar.org/eicar.com.txt","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/elastic/protections-artifacts/tree/main/yara","meta":{"arch_context":"x86, arm64","author":"Elastic Security","creation_date":"2021-01-21","fingerprint":"bb0e0bdf70ec65d98f652e2428e3567013d5413f2725a2905b372fd18da8b9dd","id":"ac8f42d6-52da-46ec-8db1-5a5f69222a38","last_modified":"2022-01-13","license":"Elastic License v2","os":"multi","rule":"Multi_EICAR_ac8f42d6","scan_context":"file, memory","severity":"1","threat_name":"Multi.EICAR.Not-a-virus"}},{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-04-16","alert":"Scan result 65/66","trigger":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","verdict":"malicious","severity":"","comment":"malicious - 65/66","link":"https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"secure.eicar.org/favicon.ico","fqdn":"secure.eicar.org","domain":"eicar.org","tld":"org"},"ip":{"addr":"89.238.73.97","port":443,"asn":34240,"as":"manitu GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://secure.eicar.org/eicar.com.txt","date":"2024-04-16T09:55:54.813Z","timestamp":1713261354813,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"secure.eicar.org","organization":""},"issuer":{"commonName":"R3","organization":"Let's Encrypt"},"validity":{"start":"Thu, 22 Feb 2024 06:15:10 GMT","end":"Wed, 22 May 2024 06:15:09 GMT"},"fingerprint":{"sha1":"DD:A0:D1:81:08:20:0A:A6:86:41:D2:9B:8A:70:9D:4D:9B:11:79:A6","sha256":"C9:08:45:67:4F:F2:48:CA:64:4A:F9:3F:AE:7D:C2:DC:4A:78:9B:E7:0F:5C:71:02:15:BE:4A:07:D6:4B:5E:51"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: secure.eicar.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://secure.eicar.org/eicar.com.txt\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Tue, 16 Apr 2024 09:55:44 GMT\r\nServer: Apache\r\nLast-Modified: Mon, 15 Apr 2024 08:03:57 GMT\r\nETag: \"7bb-6161e103ac25e\"\r\nAccept-Ranges: bytes\r\nContent-Length: 1979\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nX-Error-Code: 404\r\nKeep-Alive: timeout=5, max=49\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=utf-8\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":1979,"size_decoded":1979,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"eb54eaea1de51bee8d46975777324550","sha1":"b8b44b53b471f1bbbc5b1a824128a97c20dd762f","sha256":"4e9e660a552158a266933b9c5c258d46782f412fb276c88196d2eeb9b9596900","sha512":"c3e39eb6adaa7b9bbe45580fbafa93cf9dd74ff9c76a41358eeb75b32c40291f526a34a5378279abb8207712996eb0ff85063c23ccecefd87ee530a735205eb3","ssdeep":"","tlshash":"5e4146a5724f106f1243839b023952a4cdffe8619213227bb8ee667fd3cd90097811cd","first_seen":"2023-10-19T03:05:57Z","last_seen":"2026-09-25T16:46:50.45509Z","times_seen":1351,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}