Report - download.hitpaw.net/downloads/hitpaw-fotorpea-bing

Report Overview

Visitedpublic

2025-02-25 18:31:43

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
download.hitpaw.net	unknown	2020-03-11	2021-04-12	2025-02-17	553 B	3.9 MB	104.18.26.3
aus5.mozilla.org	2548	1998-01-24	2015-10-27	2025-02-19	524 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

download.hitpaw.net/downloads/hitpaw-fotorpea-bing_5809.exe?rnclid=11740508033071876401

IP / ASN

104.18.26.3

#13335 CLOUDFLARENET

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 7 sections

Size3.9 MB (3887360 bytes)

MD52bbe4959c593d93f581d7b6829522d58

SHA1d64bd86d80d072cb8924c6fdc34fa3c55486c087

SHA2567bb7b08134a889311278eea2b6e523fbb73ed212cd6bb077411edeafe062cf87

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/72

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET download.hitpaw.net/downloads/hitpaw-fotorpea-bing_5809.exe?rnclid=11740508033071876401

104.18.26.3

200 OK

3.9 MB

URL

download.hitpaw.net/downloads/hitpaw-fotorpea-bing_5809.exe?rnclid=11740508033071876401

IP / ASN

104.18.26.3

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 7 sections

First Seen2025-01-25

Last Seen2025-02-25

Times Seen2

Size3.9 MB (3887360 bytes)

MD52bbe4959c593d93f581d7b6829522d58

SHA1d64bd86d80d072cb8924c6fdc34fa3c55486c087

SHA2567bb7b08134a889311278eea2b6e523fbb73ed212cd6bb077411edeafe062cf87

Certificate Info

IssuerGoogle Trust Services

Subjecthitpaw.net

Fingerprint87:0D:BC:72:0D:7C:95:4A:C3:16:B2:6E:5C:48:65:DA:D2:08:D0:DC

ValidityWed, 08 Jan 2025 17:01:39 GMT - Tue, 08 Apr 2025 18:01:33 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/72

HTTP Headers

GET /downloads/hitpaw-fotorpea-bing_5809.exe?rnclid=11740508033071876401 HTTP/1.1
Host: download.hitpaw.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 25 Feb 2025 18:31:13 GMT
content-type: application/octet-stream
content-length: 3887360
cf-ray: 9179c5663f33b518-OSL
cf-cache-status: HIT
accept-ranges: bytes
age: 1030834
cache-control: public, max-age=691200
content-disposition: attachment;filename=hitpaw-fotorpea-bing_11740508033071876401.exe
etag: "67721ad9-3b5100"
expires: Wed, 05 Mar 2025 18:31:13 GMT
last-modified: Mon, 30 Dec 2024 04:00:25 GMT
vary: Accept-Encoding
server: cloudflare
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.41%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

200 OK

444 B

URL

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.41%2Clibpulse%20not-available)/default/default/update.xml

IP / ASN

35.244.181.201

#396982 GOOGLE-CLOUD-PLATFORM

Requested byN/A

Resource Info

File typeXML 1.0 document, ASCII text, with very long lines (332)

First Seen2023-10-13

Last Seen2025-06-20

Times Seen185315

Size444 B (444 bytes)

MD53b324dec137a87ef7e24a30a65b13dd0

SHA1c0faa95b2f1018e264b3a14aaf50d1003e6c27b3

SHA2566cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.41%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/g/chains/202402/aus.content-signature.mozilla.org-2025-04-10-18-02-02.chain; p384ecdsa=d48EA6C4plXxmgjiiwurt5JUdtfEbhJbVVU4IbW3SVLW1yaxTdbX_ft4AUV45qJrH6lV_ULMqrsfGSWHoh8ift2XBmQpUVeBH-qt5HzmS0qD-4hvehhglRNRuVYUdSzY
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Tue, 25 Feb 2025 18:31:00 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 32
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2