Report - ds.bbsoftware.co.uk/bbflbk2.exe?sid=m3znjkrsrr2ilz453dm55555

Report Overview

Submitted URL
ds.bbsoftware.co.uk/bbflbk2.exe?sid=m3znjkrsrr2ilz453dm55555
IP
18.168.244.13
ASN
#16509 AMAZON-02
Submitted
2024-04-20 00:43:45
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ds.bbsoftware.co.uk	unknown	1998-05-21	2012-06-19	2023-12-25	514 B	658 B	18.168.244.13
files.bbsoftware.co.uk	unknown	1998-05-21	2013-05-01	2024-01-19	488 B	14 MB	143.204.55.62

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-04-20	medium	files.bbsoftware.co.uk/bbflbk2.exe	Detect files is `SliverFox` malware

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
files.bbsoftware.co.uk/bbflbk2.exe
IP
143.204.55.62
ASN
#16509 AMAZON-02

File type
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
Size
14 MB (14226376 bytes)
Hash
52a9b900a4e5afc22d4ba8145c43822f
594e9aa77b959f438886d5c7ab0d5f53f43b8d33
629e43091d2969c872f9d2f8189d44e86be0d8d89acf3e3cc88a4d1e56aca6a2

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

ds.bbsoftware.co.uk/bbflbk2.exe?sid=m3znjkrsrr2ilz453dm55555

18.168.244.13

302 Found

159 B

URL User Request GET HTTP/2
ds.bbsoftware.co.uk/bbflbk2.exe?sid=m3znjkrsrr2ilz453dm55555
IP
18.168.244.13:443
ASN
#16509 AMAZON-02

Certificate
IssuerDigiCert Inc
Subject*.bbsoftware.co.uk
Fingerprint81:B0:A8:72:15:EC:80:B2:A6:DE:94:4E:5F:A9:DD:B5:2B:5E:44:37
ValidityWed, 28 Feb 2024 00:00:00 GMT - Sun, 30 Mar 2025 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
159 B (159 bytes)
Hash
ddc097099a6ab040fd6968a843c415ee
58c3c325a82ffede2d29e30041310ad655e44a95
1ab240d82bb102ae8a74105e9f14e9ee3c0d00956b39ad51170ac4105d801cd4

HTTP Headers

GET /bbflbk2.exe?sid=m3znjkrsrr2ilz453dm55555 HTTP/1.1
Host: ds.bbsoftware.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
cache-control: private
content-type: text/html; charset=utf-8
location: https://files.bbsoftware.co.uk/bbflbk2.exe
server: Microsoft-IIS/10.0
set-cookie: ASP.NET_SessionId=0s5xfibqf5l4mt015jc0db4s; path=/; HttpOnly; SameSite=Lax
x-aspnet-version: 4.0.30319
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: "1; mode=block"
referrer-policy: origin-when-cross-origin
date: Sat, 20 Apr 2024 00:43:17 GMT
content-length: 159
X-Firefox-Spdy: h2

files.bbsoftware.co.uk/bbflbk2.exe

143.204.55.62

200 OK

14 MB

URL User Request GET HTTP/2
files.bbsoftware.co.uk/bbflbk2.exe
IP
143.204.55.62:443
ASN
#16509 AMAZON-02

Certificate
IssuerAmazon
Subjectfiles.bbsoftware.co.uk
FingerprintCB:AE:99:40:AD:92:2E:C9:80:DB:7B:EB:3C:26:87:53:99:04:F8:86
ValiditySun, 11 Jun 2023 00:00:00 GMT - Tue, 09 Jul 2024 23:59:59 GMT

File type
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
Size
14 MB (14226376 bytes)
Hash
52a9b900a4e5afc22d4ba8145c43822f
594e9aa77b959f438886d5c7ab0d5f53f43b8d33
629e43091d2969c872f9d2f8189d44e86be0d8d89acf3e3cc88a4d1e56aca6a2

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware

HTTP Headers

GET /bbflbk2.exe HTTP/1.1
Host: files.bbsoftware.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/octet-stream
content-length: 14226376
date: Sat, 20 Apr 2024 00:43:19 GMT
last-modified: Tue, 22 Nov 2016 10:41:32 GMT
etag: "52a9b900a4e5afc22d4ba8145c43822f"
accept-ranges: bytes
server: AmazonS3
x-cache: Miss from cloudfront
via: 1.1 c9f2a4d2bcd548d1a3cbe1617a22f216.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: sFfW6jrXiwZk4NZZpsDjf-axSTh-YocOmJ5A6aVNAzwamcppYWlQdQ==
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers