{"report_id":"f1a94872-550c-4c6d-8c1f-1d8e477aec25","version":6,"status":"done","tags":[],"date":"2025-02-04T14:30:52Z","url":{"schema":"http","addr":"bitbucket.org/lazanya/jon/downloads/invoice.exe","fqdn":"bitbucket.org","domain":"bitbucket.org","tld":"org"},"ip":{"addr":"185.166.143.48","port":0,"asn":16509,"as":"AMAZON-02","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"","expires_at":"2027-04-15T14:30:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"bitbucket.org","ip":{"addr":"185.166.143.50","port":443,"asn":16509,"as":"AMAZON-02","country":"The Netherlands","country_code":"NL"},"domain_registered":"1997-11-24","domain_rank":13657,"first_seen":"2012-05-21T19:07:59Z","last_seen":"2025-01-30T03:05:41.360164Z","alert_count":0,"request_count":1,"received_data":5869,"sent_data":513,"comment":"","tags":null,"fingerprints":null},{"fqdn":"bbuseruploads.s3.amazonaws.com","ip":{"addr":"54.231.173.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2005-08-18","domain_rank":419617,"first_seen":"2014-05-24T15:44:20Z","last_seen":"2025-01-29T20:57:29.064463Z","alert_count":1,"request_count":1,"received_data":5348112,"sent_data":1574,"comment":"","tags":null,"fingerprints":null}],"files":[{"md5":"89c214d27ab5a2c0ce921b7c6794cbd8","sha1":"ed29064d8aeccf3e9fa8126e1399af732e015fbc","sha256":"78d6cbe6dcdef7bca7f35d85930dc16047eb2c2769d68fadc6bd265dc1eb2ae1","sha512":"98e0bb187d303351013772986787ba755c1e5a038abd1a2d8a1a11a1335cc4aa4f53694f81e619450a05dd5f96c3e5a390b278039a813aa6ca3013fc450d5f15","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","size":5347592,"url":{"schema":"https","addr":"bbuseruploads.s3.amazonaws.com/d0e4e50c-99ca-47a2-87ac-127c6bf33992/downloads/504ea5f9-dcce-451f-8146-3ecfcc9094b1/invoice.exe?response-content-disposition=attachment%3B%20filename%3D%22invoice.exe%22\u0026AWSAccessKeyId=ASIA6KOSE3BNHLTF2DLC\u0026Signature=7dYbQdjWQaRN%2BmoIt%2FotyqD894U%3D\u0026x-amz-security-token=IQoJb3JpZ2luX2VjEBcaCXVzLWVhc3QtMSJHMEUCIQDVLLJKsG5GqZ2pkdnBuM5oj46rGK6PZdlW2tuV%2Fx53KgIgGj6459k3qtjZmeSP4T8UvQLAMC0y3vjN9Tb%2BqwAk4TYqpwIIMBAAGgw5ODQ1MjUxMDExNDYiDEE2QSX1vkEMkyjgJyqEAiNCHzrqaeyNvJy%2BKNTPVmux9hnlM%2Bz4Te54bcTK44%2BntkHECwLGNURbDWAQeLZ%2BO1fHYTARjL8wGpp6WCBRH63sNH3AnRgVCZrAKkflJNIZ8oxDhC2ceMFCWP5s5oaKVs2vQw594eVAoz6lRbh4iJRbeBfzgAUnEtVFjM36d07IczlWd3h49Br5ZqOop9PGQv32av1hwv6JefgMYRaIWbL7nV9Q4NdiPxxpKRRMT%2BP0P14hjclAylA6SrQN%2Bx2x1SjZcn05u7lEAukiE0w1Ezvw287QxR4AmKayHEM95xLAkAift1qssygEzX31tRxILd1PyAfTbu0UyQoSwRWYEGmclY6UMJ%2FHiL0GOp0Bvfu1hhBogwnPayV0C2PrJXGjiVzAGefthiQJ%2FT5eWM7EdO2mVtna%2FAHI39AO2DDJdWAWAtEQTmJBiUv1XNG8dcCQ5I67xe5LR9RLvw3npG0w48RuvqSqU6zulEwOMs%2FdiPkBggd5ee6ZZi4retkX3ayRyiRlhkp6yBoW%2BgOFa5%2ByW88YaPF8P6%2FeUuzmkc9KoGx3XX1or7vkj75TdQ%3D%3D\u0026Expires=1738680999","fqdn":"bbuseruploads.s3.amazonaws.com","domain":"bbuseruploads.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"54.231.173.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2025-02-04","alert":"Scan result 22/71","trigger":"78d6cbe6dcdef7bca7f35d85930dc16047eb2c2769d68fadc6bd265dc1eb2ae1","verdict":"malicious","severity":"","comment":"malicious - 22/71","link":"https://www.virustotal.com/gui/file/78d6cbe6dcdef7bca7f35d85930dc16047eb2c2769d68fadc6bd265dc1eb2ae1","meta":null}]}}],"artifacts":{"windows_shortcuts":null,"files":[{"md5":"89c214d27ab5a2c0ce921b7c6794cbd8","sha1":"ed29064d8aeccf3e9fa8126e1399af732e015fbc","sha256":"78d6cbe6dcdef7bca7f35d85930dc16047eb2c2769d68fadc6bd265dc1eb2ae1","sha512":"98e0bb187d303351013772986787ba755c1e5a038abd1a2d8a1a11a1335cc4aa4f53694f81e619450a05dd5f96c3e5a390b278039a813aa6ca3013fc450d5f15","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","size":5347592,"url":{"schema":"https","addr":"bbuseruploads.s3.amazonaws.com/d0e4e50c-99ca-47a2-87ac-127c6bf33992/downloads/504ea5f9-dcce-451f-8146-3ecfcc9094b1/invoice.exe?response-content-disposition=attachment%3B%20filename%3D%22invoice.exe%22\u0026AWSAccessKeyId=ASIA6KOSE3BNHLTF2DLC\u0026Signature=7dYbQdjWQaRN%2BmoIt%2FotyqD894U%3D\u0026x-amz-security-token=IQoJb3JpZ2luX2VjEBcaCXVzLWVhc3QtMSJHMEUCIQDVLLJKsG5GqZ2pkdnBuM5oj46rGK6PZdlW2tuV%2Fx53KgIgGj6459k3qtjZmeSP4T8UvQLAMC0y3vjN9Tb%2BqwAk4TYqpwIIMBAAGgw5ODQ1MjUxMDExNDYiDEE2QSX1vkEMkyjgJyqEAiNCHzrqaeyNvJy%2BKNTPVmux9hnlM%2Bz4Te54bcTK44%2BntkHECwLGNURbDWAQeLZ%2BO1fHYTARjL8wGpp6WCBRH63sNH3AnRgVCZrAKkflJNIZ8oxDhC2ceMFCWP5s5oaKVs2vQw594eVAoz6lRbh4iJRbeBfzgAUnEtVFjM36d07IczlWd3h49Br5ZqOop9PGQv32av1hwv6JefgMYRaIWbL7nV9Q4NdiPxxpKRRMT%2BP0P14hjclAylA6SrQN%2Bx2x1SjZcn05u7lEAukiE0w1Ezvw287QxR4AmKayHEM95xLAkAift1qssygEzX31tRxILd1PyAfTbu0UyQoSwRWYEGmclY6UMJ%2FHiL0GOp0Bvfu1hhBogwnPayV0C2PrJXGjiVzAGefthiQJ%2FT5eWM7EdO2mVtna%2FAHI39AO2DDJdWAWAtEQTmJBiUv1XNG8dcCQ5I67xe5LR9RLvw3npG0w48RuvqSqU6zulEwOMs%2FdiPkBggd5ee6ZZi4retkX3ayRyiRlhkp6yBoW%2BgOFa5%2ByW88YaPF8P6%2FeUuzmkc9KoGx3XX1or7vkj75TdQ%3D%3D\u0026Expires=1738680999","fqdn":"bbuseruploads.s3.amazonaws.com","domain":"bbuseruploads.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"54.231.173.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2025-02-04","alert":"Scan result 22/71","trigger":"78d6cbe6dcdef7bca7f35d85930dc16047eb2c2769d68fadc6bd265dc1eb2ae1","verdict":"malicious","severity":"","comment":"malicious - 22/71","link":"https://www.virustotal.com/gui/file/78d6cbe6dcdef7bca7f35d85930dc16047eb2c2769d68fadc6bd265dc1eb2ae1","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"bitbucket.org/lazanya/jon/downloads/invoice.exe","fqdn":"bitbucket.org","domain":"bitbucket.org","tld":"org"},"ip":{"addr":"185.166.143.50","port":443,"asn":16509,"as":"AMAZON-02","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-02-04T14:30:21.527Z","timestamp":1738679421527,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bitbucket.org","organization":"Atlassian US, Inc."},"issuer":{"commonName":"DigiCert SHA2 Extended Validation Server CA","organization":"DigiCert Inc"},"validity":{"start":"Tue, 30 Jul 2024 00:00:00 GMT","end":"Sat, 30 Aug 2025 23:59:59 GMT"},"fingerprint":{"sha1":"2A:B7:65:D0:F2:15:5D:A9:32:63:6F:1B:9D:6A:14:0B:B8:63:A1:17","sha256":"1C:72:D5:D0:19:6D:59:CB:46:42:4D:BC:12:12:D5:35:14:9C:DE:F8:23:84:78:44:52:8C:2A:DA:B3:33:40:6F"}}},"request":{"raw":"GET /lazanya/jon/downloads/invoice.exe HTTP/1.1\r\nHost: bitbucket.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Tue, 04 Feb 2025 14:30:21 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 0\r\nserver: AtlassianEdge\r\nlocation: https://bbuseruploads.s3.amazonaws.com/d0e4e50c-99ca-47a2-87ac-127c6bf33992/downloads/504ea5f9-dcce-451f-8146-3ecfcc9094b1/invoice.exe?response-content-disposition=attachment%3B%20filename%3D%22invoice.exe%22\u0026AWSAccessKeyId=ASIA6KOSE3BNHLTF2DLC\u0026Signature=7dYbQdjWQaRN%2BmoIt%2FotyqD894U%3D\u0026x-amz-security-token=IQoJb3JpZ2luX2VjEBcaCXVzLWVhc3QtMSJHMEUCIQDVLLJKsG5GqZ2pkdnBuM5oj46rGK6PZdlW2tuV%2Fx53KgIgGj6459k3qtjZmeSP4T8UvQLAMC0y3vjN9Tb%2BqwAk4TYqpwIIMBAAGgw5ODQ1MjUxMDExNDYiDEE2QSX1vkEMkyjgJyqEAiNCHzrqaeyNvJy%2BKNTPVmux9hnlM%2Bz4Te54bcTK44%2BntkHECwLGNURbDWAQeLZ%2BO1fHYTARjL8wGpp6WCBRH63sNH3AnRgVCZrAKkflJNIZ8oxDhC2ceMFCWP5s5oaKVs2vQw594eVAoz6lRbh4iJRbeBfzgAUnEtVFjM36d07IczlWd3h49Br5ZqOop9PGQv32av1hwv6JefgMYRaIWbL7nV9Q4NdiPxxpKRRMT%2BP0P14hjclAylA6SrQN%2Bx2x1SjZcn05u7lEAukiE0w1Ezvw287QxR4AmKayHEM95xLAkAift1qssygEzX31tRxILd1PyAfTbu0UyQoSwRWYEGmclY6UMJ%2FHiL0GOp0Bvfu1hhBogwnPayV0C2PrJXGjiVzAGefthiQJ%2FT5eWM7EdO2mVtna%2FAHI39AO2DDJdWAWAtEQTmJBiUv1XNG8dcCQ5I67xe5LR9RLvw3npG0w48RuvqSqU6zulEwOMs%2FdiPkBggd5ee6ZZi4retkX3ayRyiRlhkp6yBoW%2BgOFa5%2ByW88YaPF8P6%2FeUuzmkc9KoGx3XX1or7vkj75TdQ%3D%3D\u0026Expires=1738680999\r\nexpires: Tue, 04 Feb 2025 14:30:21 GMT\r\ncache-control: max-age=0, no-cache, no-store, must-revalidate, private\r\nx-used-mesh: False\r\nvary: Accept-Language, Origin\r\ncontent-language: en\r\nx-view-name: bitbucket.apps.downloads.views.download_file\r\nx-dc-location: Micros-3\r\nx-served-by: 6638bef48f32\r\nx-version: bb93dc05b832\r\nx-static-version: bb93dc05b832\r\nx-request-count: 30\r\nx-render-time: 0.07518982887268066\r\nx-b3-traceid: 801b09bfaf814b959c2669f03e102c53\r\nx-b3-spanid: 3c993abe5ee3c415\r\nx-frame-options: SAMEORIGIN\r\ncontent-security-policy: frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; object-src 'none'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *; connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; base-uri 'self'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website\r\nx-usage-quota-remaining: 999021.964\r\nx-usage-request-cost: 999.30\r\nx-usage-user-time: 0.023371\r\nx-usage-system-time: 0.006608\r\nx-usage-input-ops: 0\r\nx-usage-output-ops: 0\r\nage: 0\r\nx-cache: MISS\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\natl-traceid: 801b09bfaf814b959c2669f03e102c53\r\natl-request-id: 801b09bf-af81-4b95-9c26-69f03e102c53\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nreport-to: {\"endpoints\": [{\"url\": \"https://dz8aopenkvv6s.cloudfront.net\"}], \"group\": \"endpoint-1\", \"include_subdomains\": true, \"max_age\": 600}\r\nnel: {\"failure_fraction\": 0.001, \"include_subdomains\": true, \"max_age\": 600, \"report_to\": \"endpoint-1\"}\r\nserver-timing: atl-edge;dur=188,atl-edge-internal;dur=5,atl-edge-upstream;dur=184,atl-edge-pop;desc=\"aws-eu-central-1\"\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"application/x-msdownload","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T08:48:34.014477Z","times_seen":18599010,"resource_available":true,"data":null}},"time_used":458,"timings":{"blocked":122,"dns":19,"connect":21,"send":0,"wait":212,"receive":0,"ssl":80},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bbuseruploads.s3.amazonaws.com/d0e4e50c-99ca-47a2-87ac-127c6bf33992/downloads/504ea5f9-dcce-451f-8146-3ecfcc9094b1/invoice.exe?response-content-disposition=attachment%3B%20filename%3D%22invoice.exe%22\u0026AWSAccessKeyId=ASIA6KOSE3BNHLTF2DLC\u0026Signature=7dYbQdjWQaRN%2BmoIt%2FotyqD894U%3D\u0026x-amz-security-token=IQoJb3JpZ2luX2VjEBcaCXVzLWVhc3QtMSJHMEUCIQDVLLJKsG5GqZ2pkdnBuM5oj46rGK6PZdlW2tuV%2Fx53KgIgGj6459k3qtjZmeSP4T8UvQLAMC0y3vjN9Tb%2BqwAk4TYqpwIIMBAAGgw5ODQ1MjUxMDExNDYiDEE2QSX1vkEMkyjgJyqEAiNCHzrqaeyNvJy%2BKNTPVmux9hnlM%2Bz4Te54bcTK44%2BntkHECwLGNURbDWAQeLZ%2BO1fHYTARjL8wGpp6WCBRH63sNH3AnRgVCZrAKkflJNIZ8oxDhC2ceMFCWP5s5oaKVs2vQw594eVAoz6lRbh4iJRbeBfzgAUnEtVFjM36d07IczlWd3h49Br5ZqOop9PGQv32av1hwv6JefgMYRaIWbL7nV9Q4NdiPxxpKRRMT%2BP0P14hjclAylA6SrQN%2Bx2x1SjZcn05u7lEAukiE0w1Ezvw287QxR4AmKayHEM95xLAkAift1qssygEzX31tRxILd1PyAfTbu0UyQoSwRWYEGmclY6UMJ%2FHiL0GOp0Bvfu1hhBogwnPayV0C2PrJXGjiVzAGefthiQJ%2FT5eWM7EdO2mVtna%2FAHI39AO2DDJdWAWAtEQTmJBiUv1XNG8dcCQ5I67xe5LR9RLvw3npG0w48RuvqSqU6zulEwOMs%2FdiPkBggd5ee6ZZi4retkX3ayRyiRlhkp6yBoW%2BgOFa5%2ByW88YaPF8P6%2FeUuzmkc9KoGx3XX1or7vkj75TdQ%3D%3D\u0026Expires=1738680999","fqdn":"bbuseruploads.s3.amazonaws.com","domain":"bbuseruploads.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"54.231.173.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-02-04T14:30:21.871Z","timestamp":1738679421871,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Mon, 22 Apr 2024 00:00:00 GMT","end":"Mon, 07 Apr 2025 23:59:59 GMT"},"fingerprint":{"sha1":"57:FE:C9:73:13:31:CA:2C:91:7F:05:C3:3B:16:FF:3F:1B:D8:7D:E2","sha256":"77:0B:A1:DF:CF:D6:D6:42:87:B1:85:76:0E:AD:C5:67:47:8F:1B:32:07:D7:73:F1:47:8D:39:ED:3F:29:20:41"}}},"request":{"raw":"GET /d0e4e50c-99ca-47a2-87ac-127c6bf33992/downloads/504ea5f9-dcce-451f-8146-3ecfcc9094b1/invoice.exe?response-content-disposition=attachment%3B%20filename%3D%22invoice.exe%22\u0026AWSAccessKeyId=ASIA6KOSE3BNHLTF2DLC\u0026Signature=7dYbQdjWQaRN%2BmoIt%2FotyqD894U%3D\u0026x-amz-security-token=IQoJb3JpZ2luX2VjEBcaCXVzLWVhc3QtMSJHMEUCIQDVLLJKsG5GqZ2pkdnBuM5oj46rGK6PZdlW2tuV%2Fx53KgIgGj6459k3qtjZmeSP4T8UvQLAMC0y3vjN9Tb%2BqwAk4TYqpwIIMBAAGgw5ODQ1MjUxMDExNDYiDEE2QSX1vkEMkyjgJyqEAiNCHzrqaeyNvJy%2BKNTPVmux9hnlM%2Bz4Te54bcTK44%2BntkHECwLGNURbDWAQeLZ%2BO1fHYTARjL8wGpp6WCBRH63sNH3AnRgVCZrAKkflJNIZ8oxDhC2ceMFCWP5s5oaKVs2vQw594eVAoz6lRbh4iJRbeBfzgAUnEtVFjM36d07IczlWd3h49Br5ZqOop9PGQv32av1hwv6JefgMYRaIWbL7nV9Q4NdiPxxpKRRMT%2BP0P14hjclAylA6SrQN%2Bx2x1SjZcn05u7lEAukiE0w1Ezvw287QxR4AmKayHEM95xLAkAift1qssygEzX31tRxILd1PyAfTbu0UyQoSwRWYEGmclY6UMJ%2FHiL0GOp0Bvfu1hhBogwnPayV0C2PrJXGjiVzAGefthiQJ%2FT5eWM7EdO2mVtna%2FAHI39AO2DDJdWAWAtEQTmJBiUv1XNG8dcCQ5I67xe5LR9RLvw3npG0w48RuvqSqU6zulEwOMs%2FdiPkBggd5ee6ZZi4retkX3ayRyiRlhkp6yBoW%2BgOFa5%2ByW88YaPF8P6%2FeUuzmkc9KoGx3XX1or7vkj75TdQ%3D%3D\u0026Expires=1738680999 HTTP/1.1\r\nHost: bbuseruploads.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: lsYNdJ3o6CuUqh0vPvJaUo5dspE5GSvt8Ew7MxUqlpTiESZ4U9PS6S2iglgFq4yDL6cm9VAcfBM=\r\nx-amz-request-id: X77DZQM344HWQA1X\r\nDate: Tue, 04 Feb 2025 14:30:23 GMT\r\nLast-Modified: Mon, 03 Feb 2025 17:58:12 GMT\r\nETag: \"89c214d27ab5a2c0ce921b7c6794cbd8\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: Ugp81km73cPN7hqdTM3r.nddU2Plz8Hk\r\nContent-Disposition: attachment; filename=\"invoice.exe\"\r\nAccept-Ranges: bytes\r\nContent-Type: application/x-msdownload\r\nContent-Length: 5347592\r\nServer: AmazonS3\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":5347592,"size_decoded":5347592,"mime_type":"application/x-msdownload","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","md5":"89c214d27ab5a2c0ce921b7c6794cbd8","sha1":"ed29064d8aeccf3e9fa8126e1399af732e015fbc","sha256":"78d6cbe6dcdef7bca7f35d85930dc16047eb2c2769d68fadc6bd265dc1eb2ae1","sha512":"98e0bb187d303351013772986787ba755c1e5a038abd1a2d8a1a11a1335cc4aa4f53694f81e619450a05dd5f96c3e5a390b278039a813aa6ca3013fc450d5f15","ssdeep":"98304:Vxwxd/6+6efPCqe9kNDqnS2wdYdstG1f2yrOnTJkh:VxCyefPCq18nlwnzyrOnNm","tlshash":"8036f111b3d581b6d4bf0638d87952669770bc088326d7af9790be697d33b808e22377","first_seen":"2025-02-04T01:27:05.571606Z","last_seen":"2025-02-05T10:44:01.413089Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1450,"timings":{"blocked":224,"dns":14,"connect":92,"send":0,"wait":127,"receive":875,"ssl":115},"alerts":{"ids":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2025-02-04","alert":"Scan result 22/71","trigger":"78d6cbe6dcdef7bca7f35d85930dc16047eb2c2769d68fadc6bd265dc1eb2ae1","verdict":"malicious","severity":"","comment":"malicious - 22/71","link":"https://www.virustotal.com/gui/file/78d6cbe6dcdef7bca7f35d85930dc16047eb2c2769d68fadc6bd265dc1eb2ae1","meta":null}],"urlquery":null}}]}