Report - nightly.link/SourMesen/Mesen2/workflows/build/master/Mesen%20(Linux%20-%20ubuntu-20.04%20-%20clang).zip

Report Overview

Submitted URL
nightly.link/SourMesen/Mesen2/workflows/build/master/Mesen%20(Linux%20-%20ubuntu-20.04%20-%20clang).zip
IP
45.32.185.199
ASN
#20473 AS-CHOOPA
Submitted
2024-04-17 19:01:32
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
nightly.link	unknown	2020-11-23	2020-11-23	2024-04-15	557 B	511 B	45.32.185.199
pipelinesghubeus9.actions.githubusercontent.com	unknown	2014-02-06	2023-08-22	2024-04-17	798 B	18 MB	40.88.239.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
pipelinesghubeus9.actions.githubusercontent.com/OTxo8A2LzQ1l7uA1pd2UzoSHTWRAULi5gCC9bAxKH67QS8rsnX/_apis/pipelines/1/runs/329/signedartifactscontent?artifactName=Mesen%20%28Linux%20-%20ubuntu-20.04%20-%20clang%29&urlExpires=2024-04-17T19%3A01%3A41.0825659Z&urlSigningMethod=HMACV2&urlSignature=tY9MpGICh9omETYMsNqSCuvB48moXyfFFK7%2BxzPoE%2B4%3D
IP
40.88.239.133
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
18 MB (18086306 bytes)
Hash
e128f64387da758a45e23ffd19a90cd6
6acc1492c05cf1a5725250a7fa3a4503615be8cb
b65c5202f6c0f138f904fe388bc4419b42fa8f3a90e3f1eb377bea778285e0cd

Archive (1)

Filename

Md5

File type

Mesen

750d0a0699c565cbfebf28a4c5892ff2

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	nightly.link/SourMesen/Mesen2/workflows/build/master/Mesen%20(Linux%20-%20ubuntu-20.04%20-%20clang).zip	45.32.185.199	302 Found	0 B
URL User Request GET HTTP/1.1 nightly.link/SourMesen/Mesen2/workflows/build/master/Mesen%20(Linux%20-%20ubuntu-20.04%20-%20clang).zip IP 45.32.185.199:443 ASN #20473 AS-CHOOPA Certificate IssuerLet's Encrypt Subjectnightly.link Fingerprint43:A4:E0:83:71:A1:93:44:6C:E6:3C:4E:AE:49:B8:6D:01:4F:97:18 ValiditySun, 31 Mar 2024 21:22:26 GMT - Sat, 29 Jun 2024 21:22:25 GMT File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers GET /SourMesen/Mesen2/workflows/build/master/Mesen%20(Linux%20-%20ubuntu-20.04%20-%20clang).zip HTTP/1.1 Host: nightly.link User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/1.1 302 Found Server: nginx/1.22.1 Date: Wed, 17 Apr 2024 19:01:01 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: https://pipelinesghubeus9.actions.githubusercontent.com/OTxo8A2LzQ1l7uA1pd2UzoSHTWRAULi5gCC9bAxKH67QS8rsnX/_apis/pipelines/1/runs/329/signedartifactscontent?artifactName=Mesen%20%28Linux%20-%20ubuntu-20.04%20-%20clang%29&urlExpires=2024-04-17T19%3A01%3A41.0825659Z&urlSigningMethod=HMACV2&urlSignature=tY9MpGICh9omETYMsNqSCuvB48moXyfFFK7%2BxzPoE%2B4%3D

	pipelinesghubeus9.actions.githubusercontent.com/OTxo8A2LzQ1l7uA1pd2UzoSHTWRAULi5gCC9bAxKH67QS8rsnX/_apis/pipelines/1/runs/329/signedartifactscontent?artifactName=Mesen%20%28Linux%20-%20ubuntu-20.04%20-%20clang%29&urlExpires=2024-04-17T19%3A01%3A41.0825659Z&urlSigningMethod=HMACV2&urlSignature=tY9MpGICh9omETYMsNqSCuvB48moXyfFFK7%2BxzPoE%2B4%3D	40.88.239.133	200 OK	18 MB
URL User Request GET HTTP/1.1 pipelinesghubeus9.actions.githubusercontent.com/OTxo8A2LzQ1l7uA1pd2UzoSHTWRAULi5gCC9bAxKH67QS8rsnX/_apis/pipelines/1/runs/329/signedartifactscontent?artifactName=Mesen%20%28Linux%20-%20ubuntu-20.04%20-%20clang%29&urlExpires=2024-04-17T19%3A01%3A41.0825659Z&urlSigningMethod=HMACV2&urlSignature=tY9MpGICh9omETYMsNqSCuvB48moXyfFFK7%2BxzPoE%2B4%3D IP 40.88.239.133:443 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK Certificate IssuerDigiCert Inc Subject.actions.githubusercontent.com Fingerprint3E:A8:0E:90:2F:C3:85:F3:6B:C0:81:93:FB:C6:78:20:2D:57:29:94 ValidityWed, 20 Sep 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 18 MB (18086306 bytes) Hash e128f64387da758a45e23ffd19a90cd6 6acc1492c05cf1a5725250a7fa3a4503615be8cb b65c5202f6c0f138f904fe388bc4419b42fa8f3a90e3f1eb377bea778285e0cd HTTP Headers GET /OTxo8A2LzQ1l7uA1pd2UzoSHTWRAULi5gCC9bAxKH67QS8rsnX/_apis/pipelines/1/runs/329/signedartifactscontent?artifactName=Mesen%20%28Linux%20-%20ubuntu-20.04%20-%20clang%29&urlExpires=2024-04-17T19%3A01%3A41.0825659Z&urlSigningMethod=HMACV2&urlSignature=tY9MpGICh9omETYMsNqSCuvB48moXyfFFK7%2BxzPoE%2B4%3D HTTP/1.1 Host: pipelinesghubeus9.actions.githubusercontent.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/1.1 200 OK Content-Type: application/zip Date: Wed, 17 Apr 2024 19:01:00 GMT Server: Kestrel Cache-Control: no-store,no-cache Pragma: no-cache Transfer-Encoding: chunked Strict-Transport-Security: max-age=2592000 X-TFS-ProcessId: 783cc87f-424d-4910-89b4-34761c6e10fb ActivityId: 17e4bc96-19c1-4484-9ffc-8c5549512380 X-TFS-Session: 17e4bc96-19c1-4484-9ffc-8c5549512380 X-VSS-E2EID: 17e4bc96-19c1-4484-9ffc-8c5549512380 X-VSS-SenderDeploymentId: 80a0d4a1-4b02-aa13-a606-f3d476158d51 Content-Disposition: attachment; filename="Mesen (Linux - ubuntu-20.04 - clang).zip"; filename=UTF-8''Mesen%20%28Linux%20-%20ubuntu-20.04%20-%20clang%29.zip