Report Overview

  1. Visited public
    2024-11-06 21:51:02
    Tags
  2. URL

    github.com/deskflow/deskflow/releases/download/v1.17.0/deskflow-1.17.0.0_win64.msi

  3. Finishing URL

    about:privatebrowsing

  4. IP / ASN
    140.82.121.3

    #36459 GITHUB

    Title
    about:privatebrowsing
Detections
urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDNRankRegisteredFirst SeenLast Seen
objects.githubusercontent.com1340602014-02-062021-11-012024-11-06
github.com14232007-10-092016-07-132024-11-06

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules
SeverityIndicatorAlert
mediumobjects.githubusercontent.com/github-production-release-asset-2e65be/25135037/7960f405-ca8c-44ea-a734-7417f81b08a9?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241106%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241106T215035Z&X-Amz-Expires=300&X-Amz-Signature=23940b54b6395c93e9d54615ee27ee8e8ad5fdf3b254fff5f19cf718eeb3b440&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Ddeskflow-1.17.0.0_win64.msi&response-content-type=application%2Foctet-streamDetect files is `SliverFox` malware

OpenPhish

No alerts detected


PhishTank

No alerts detected


Mnemonic Secure DNS

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


Files detected

  1. URL

    objects.githubusercontent.com/github-production-release-asset-2e65be/25135037/7960f405-ca8c-44ea-a734-7417f81b08a9?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241106%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241106T215035Z&X-Amz-Expires=300&X-Amz-Signature=23940b54b6395c93e9d54615ee27ee8e8ad5fdf3b254fff5f19cf718eeb3b440&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Ddeskflow-1.17.0.0_win64.msi&response-content-type=application%2Foctet-stream

  2. IP

    185.199.110.133

  3. ASN

    #54113 FASTLY

  1. File type

    Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Deskflow (64-bit), Author: Deskflow, Keywords: Installer, Comments: This installer database contains the logic and data required to install Deskflow (64-bit)., Template: x64;1033, Revision Number: {4627DACD-5190-405A-AA72-586C79CF737E}, Create Time/Date: Wed Oct 2 09:15:28 2024, Last Saved Time/Date: Wed Oct 2 09:15:28 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2

    Size

    18 MB (17821696 bytes)

  2. Hash

    2116babbf9f49ad0b359c9de0db8c815

    170ebfc5027dacaef25174391d9fd818ef0c87c7

    Detections

    AnalyzerVerdictAlert
    YARAhub by abuse.chmalware
    Detect files is `SliverFox` malware

JavaScript (0)

HTTP Transactions (2)

URLIPResponseSize
github.com/deskflow/deskflow/releases/download/v1.17.0/deskflow-1.17.0.0_win64.msi
140.82.121.4302 Found0 B
objects.githubusercontent.com/github-production-release-asset-2e65be/25135037/7960f405-ca8c-44ea-a734-7417f81b08a9?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241106%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241106T215035Z&X-Amz-Expires=300&X-Amz-Signature=23940b54b6395c93e9d54615ee27ee8e8ad5fdf3b254fff5f19cf718eeb3b440&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Ddeskflow-1.17.0.0_win64.msi&response-content-type=application%2Foctet-stream
185.199.110.133200 OK18 MB