{"report_id":"af8f254c-c054-41f4-97d6-77ed2baa848c","version":6,"status":"done","tags":[],"date":"2023-11-19T09:48:48Z","url":{"schema":"http","addr":"breezesys.com/downloads/nkremote210.exe","fqdn":"breezesys.com","domain":"breezesys.com","tld":"com"},"ip":{"addr":"217.160.0.197","port":0,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-26T12:40:30Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"default"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"breezesys.com","ip":{"addr":"217.160.0.197","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"domain_registered":"2000-03-29","domain_rank":0,"first_seen":"2012-05-22 07:16:53","last_seen":"2023-10-22 05:06:19","alert_count":1,"request_count":1,"received_data":6167119,"sent_data":495,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":[{"md5":"e401c6b77eb4b65e16a30bf3e0017305","sha1":"4aae8c39460bdf28acfd888634d30ef353a656c1","sha256":"5260788f7380cb59edbb8e71e1f9c4eeb146a40be8e081e1dc531d0a87c30897","sha512":"4f4b6ccab38b847a754898f0e067098cd9b7fa8189802b184c9c55c7e87c1d0b7ff8e1f1326ff4fb1dbf7c202dbecbd648f28d2aaa644a9278eb126d76e25614","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed\\012- data","size":6166812,"url":{"schema":"https","addr":"breezesys.com/downloads/nkremote210.exe","fqdn":"breezesys.com","domain":"breezesys.com","tld":"com"},"ip":{"addr":"217.160.0.197","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2015-05-05","alert":"Scan result 1/56","trigger":"5260788f7380cb59edbb8e71e1f9c4eeb146a40be8e081e1dc531d0a87c30897","verdict":"suspicious","severity":"","comment":"suspicious - 1/56","link":"https://www.virustotal.com/gui/file/5260788f7380cb59edbb8e71e1f9c4eeb146a40be8e081e1dc531d0a87c30897","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"breezesys.com/downloads/nkremote210.exe","fqdn":"breezesys.com","domain":"breezesys.com","tld":"com"},"ip":{"addr":"217.160.0.197","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2023-11-19T09:48:33.466Z","timestamp":1700387313466,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.breezesys.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 30 Sep 2023 00:00:00 GMT","end":"Mon, 14 Oct 2024 23:59:59 GMT"},"fingerprint":{"sha1":"B4:C3:25:6B:30:38:2B:54:2A:B5:48:AB:3D:73:52:A2:06:44:1C:F0","sha256":"3D:EC:8F:11:5D:7C:52:59:CB:97:44:7E:AB:2F:09:0D:6E:56:84:5C:74:FC:EE:37:51:12:49:78:72:E1:77:3B"}}},"request":{"raw":"GET /downloads/nkremote210.exe HTTP/1.1\r\nHost: breezesys.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/x-msdos-program\r\ncontent-length: 6166812\r\ndate: Sun, 19 Nov 2023 09:48:32 GMT\r\nserver: Apache\r\ncontent-security-policy: upgrade-insecure-requests;\r\nlast-modified: Wed, 28 Aug 2019 16:26:29 GMT\r\netag: \"5e191c-5912fd9f7da31\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6166812,"size_decoded":0,"mime_type":"application/x-msdos-program","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed\\012- data","md5":"e401c6b77eb4b65e16a30bf3e0017305","sha1":"4aae8c39460bdf28acfd888634d30ef353a656c1","sha256":"5260788f7380cb59edbb8e71e1f9c4eeb146a40be8e081e1dc531d0a87c30897","sha512":"4f4b6ccab38b847a754898f0e067098cd9b7fa8189802b184c9c55c7e87c1d0b7ff8e1f1326ff4fb1dbf7c202dbecbd648f28d2aaa644a9278eb126d76e25614","ssdeep":"98304:9LkkQgZx11ihsUBj2wMkyTJ5VnC/xfCXXMNA6LmUyr+7UsMxVGYhCr6fgvTZjvR3:9oLgTWBKJfnUAX8tmUyrIfM7aMgbFvXJ","tlshash":"895633cf62d8295cd78660372c114e49eb3444686063bf779edc9ea4b47e7e818339ca","first_seen":"2023-11-19T10:48:50Z","last_seen":"2023-11-19T10:48:50Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1101,"timings":{"blocked":166,"dns":1,"connect":53,"send":0,"wait":61,"receive":709,"ssl":88},"alerts":{"ids":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2015-05-05","alert":"Scan result 1/56","trigger":"5260788f7380cb59edbb8e71e1f9c4eeb146a40be8e081e1dc531d0a87c30897","verdict":"suspicious","severity":"","comment":"suspicious - 1/56","link":"https://www.virustotal.com/gui/file/5260788f7380cb59edbb8e71e1f9c4eeb146a40be8e081e1dc531d0a87c30897","meta":null}],"urlquery":null}}]}