Scan report · about 2 months agoPublic

chocolatey.org

104.18.21.76AS13335 · US

Submittedhttps://chocolatey.org/install

page delivers an executable (https://community.chocolatey.org/install.ps1)

delivers a script, not an installer ("install.ps1")

Engine tags

Verdict

2 of 8 enginesSuspiciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 2.0 s · 34 requests

01 · Visitor openschocolatey.org/install

02 · Page shown

Chocolatey Software | Installing Chocolatey

03 · File delivered · suspiciousinstall.ps1community.chocolatey.orgHanded over by the page, not served at the scanned address.

04 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Be careful — warning signs found

Automated

Its form submits what you type to a different website than the one you are on. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

install.ps1

We analysed the file this page delivered — it is Suspicious.

Success

SHA-256 44e045ed5350758616d664c5af631e7f2cd10165f5bf2bd82cbf3a0bb8f63462

SupportingPage delivers an executable under a document pretext

https://community.chocolatey.org/install.ps1 · delivers a script, not an installer ("install.ps1")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileCleaninstall.ps1

SHA-25644e045ed5350758616d664c5af631e7f2cd10165f5bf2bd82cbf3a0bb8f63462

Fromhxxps://community[.]chocolatey[.]org/install[.]ps1

Infrastructure

IP: 104.18.21.76CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Oct 26, 2026

WHOIS

Registrar: GoDaddy.com, LLC
Created: May 20, 2011
Expires: May 20, 2027
Nameservers: hope.ns.cloudflare.comowen.ns.cloudflare.com

29 malicious9 suspicious

Hashes & fingerprints

Page Hasha7e95cc945e362aa3c7f122acc5a8b62a4d8f8f642efa87c741a70028238032d Favicon Hash2c4c1178e981dbf39041092344116b6bcbc5217b3975058e9f2382de357cf6ad DOM Hash9f1ab5b31780f745921a226d7bfa83443c350c1333d4c9bc7b496405bd75ce10 Screenshot pHashd22880c3c996f1ff JARM27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint7304436B6F148CE53903E02BC2293A4EC048D133 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “Chocolatey Software | Installing Chocolatey”

Visit Site

Engines

8 · time to verdict