urlscan.io logo urlscan.io
SecurityTrails logo

persianov.net Open in urlscan Pro
2606:4700:3034::681b:a0a3  Public Scan

Go To Rescan Add Verdict Report
URL: https://persianov.net/emotet-malware-analysis-part-2
Submission: On October 22 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 24 HTTP transactions. The main IP is 2606:4700:3034::681b:a0a3, located in United States and belongs to CLOUDFLARENET, US. The main domain is persianov.net.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on September 3rd 2020. Valid for: a year.
This is the only time persianov.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
21 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
24 3
Domain Requested by
21 persianov.net persianov.net
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
1 www.googletagmanager.com persianov.net
24 3

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.reddit.com
www.linkedin.com
www.facebook.com
github.com
www.youtube.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-09-03 -
2021-09-03		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-10-06 -
2020-12-29		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://persianov.net/emotet-malware-analysis-part-2
Frame ID: 31654814EA186D311A49CE83957BCD2B
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

24
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

922 kB
Transfer

1041 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request emotet-malware-analysis-part-2
persianov.net/ 		17 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c9cf5c6f37b5925247d926ea1ba22e8a4beada8170d5254f21920d66a44461d

Request headers

:method
GET
:authority
persianov.net
:scheme
https
:path
/emotet-malware-analysis-part-2
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 22 Oct 2020 22:47:17 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=d459e2e67390c77e30fc5dfbdbaf901441603406836; expires=Sat, 21-Nov-20 22:47:16 GMT; path=/; domain=.persianov.net; HttpOnly; SameSite=Lax; Secure
last-modified
Sun, 05 Jul 2020 09:53:45 GMT
access-control-allow-origin
*
expires
Thu, 22 Oct 2020 22:57:17 GMT
cache-control
max-age=600
x-proxy-cache
MISS
x-github-request-id
B818:4DAA:2969E55:2C01DE7:5F920BF2
via
1.1 varnish
age
0
x-served-by
cache-fra19128-FRA
x-cache
MISS
x-cache-hits
0
x-timer
S1603406837.010690,VS0,VE91
vary
Accept-Encoding
x-fastly-request-id
3d3627cbd75880eace879c93286c7e55313ea531
cf-cache-status
DYNAMIC
cf-request-id
05f417cd040000073e3135f000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5e66c25b3807073e-FRA
content-encoding
gzip
js
www.googletagmanager.com/gtag/ 		94 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-72526364-1
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
db8c6f34fe857a611eb1eff1051226be89780f4a7ed771ca0808522315b70d77
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 22 Oct 2020 22:47:17 GMT
content-encoding
br
vary
Accept-Encoding
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37961
x-xss-protection
0
last-modified
Thu, 22 Oct 2020 22:31:06 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 22 Oct 2020 22:47:17 GMT
monokai.css
persianov.net/css/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://persianov.net/css/monokai.css
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bda34f247ecc21803b157de8ab5e089ecb07108e4c0c429a6c083cdc2fa87018

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
d0fdec8b8ae765a95bf8aeba43a8a1b947f78904
date
Thu, 22 Oct 2020 22:47:17 GMT
content-encoding
gzip
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-cache
MISS
status
200
x-cache-hits
0
content-length
882
cf-request-id
05f417cd7a0000073ee9075000000001
x-served-by
cache-fra19149-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
B57E:1317A:47FF6C2:4C40B6F:5F920BF5
x-timer
S1603406837.232829,VS0,VE92
etag
W/"5f01a324-e9b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
via
1.1 varnish
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25bf9a4073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
styles.css
persianov.net/css/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://persianov.net/css/styles.css
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
60816ceb591c8397eab06de5676830fe3bec0b04bdff84f7790a229cc27bf491

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
626b7ebc2e5a88cd4d0a50ff47c64330d01b6d07
date
Thu, 22 Oct 2020 22:47:17 GMT
content-encoding
gzip
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-cache
MISS
status
200
x-origin-cache
HIT
content-length
1137
cf-request-id
05f417cd7a0000073e5a806000000001
x-served-by
cache-fra19130-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
B0F0:F156:76DCC8:81E778:5F920BF5
x-timer
S1603406837.255472,VS0,VE86
etag
W/"5f01a324-1017"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
via
1.1 varnish
expires
Thu, 22 Oct 2020 22:57:17 GMT
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25bf9a6073e-FRA
x-proxy-cache
MISS
x-cache-hits
0
header.png
persianov.net/img/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/header.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8025550df90e39aa79ce1abc057038033f93ef1555991f4be7046cbe7b77e58e

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
96b4e3fe1916bafdf8e456933d14280fe514b5f5
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
36463
cf-request-id
05f417cd800000073e128bf000000001
x-served-by
cache-fra19134-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
B0F0:F156:76DCC7:81E771:5F920BF2
x-timer
S1603406837.150190,VS0,VE85
etag
"5f01a324-8e6f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25bf9b7073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
pe_1_dlls.png
persianov.net/img/emotet_malware/ 		63 KB
63 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/pe_1_dlls.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14cfbc970ef3281eb42e1a7da8c99f6628e9e52ffe586c82f54d3944e6d9a6d1

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
e7da9438e445d220d6536d5d060c0b2afcaa48a1
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
64646
cf-request-id
05f417cd800000073e623fd000000001
x-served-by
cache-fra19137-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
A862:127C:4DE8E48:5274077:5F920BF5
x-timer
S1603406837.130684,VS0,VE95
etag
"5f01a324-fc86"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25bf9b9073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
pe_1_sections.png
persianov.net/img/emotet_malware/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/pe_1_sections.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cda7db655983cfd177d7a89ed2180c171ab9e271cf26957a793918149c60f3f5

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
ca8d1ec47a41ba93f8355a3853432b02beb1c063
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
21705
cf-request-id
05f417cd800000073e1c8a7000000001
x-served-by
cache-fra19135-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
F3DE:2D56:1031E0E:115C382:5F920BF4
x-timer
S1603406837.136983,VS0,VE86
etag
"5f01a324-54c9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25bf9ba073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
pe_1_packer_1.png
persianov.net/img/emotet_malware/ 		79 KB
80 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/pe_1_packer_1.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd99908fc89607684da52d39467058fdd785de7491b158a237a313a466331870

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
e0aac8f9b9809ea8aee88217fbf7b3b0f59eb460
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
81024
cf-request-id
05f417cd800000073e122b1000000001
x-served-by
cache-fra19143-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
CEEE:2D56:1031E10:115C38B:5F920BF5
x-timer
S1603406837.255303,VS0,VE91
etag
"5f01a324-13c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25bf9bb073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
pe_1_packer_2.png
persianov.net/img/emotet_malware/ 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/pe_1_packer_2.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
32d16bcf56a7226c7816a905d346884d563e9b9ad41157e84fe5916dbe500e9a

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
1c924b1b4c576da7bbd3b96040ef5e63be1635a3
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
43634
cf-request-id
05f417cd800000073e07866000000001
x-served-by
cache-fra19153-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
50BE:645D:51E3E41:56BE59B:5F920BF4
x-timer
S1603406837.135998,VS0,VE89
etag
"5f01a324-aa72"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09bc073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
hybrid_analysis.png
persianov.net/img/emotet_malware/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/hybrid_analysis.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8552b0ab65840a07c91fea28c792234a887d84aa8b69e3677cce836654752e64

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
ace9d0b4517d6a8a05a0bf7afeac19e810bbaafa
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
28171
cf-request-id
05f417cd800000073e4c2fb000000001
x-served-by
cache-fra19144-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
F290:0BC3:12052A9:134BFA6:5F920BF5
x-timer
S1603406837.261428,VS0,VE86
etag
"5f01a324-6e0b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09bd073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
kernelbase_dll.png
persianov.net/img/emotet_malware/ 		108 KB
108 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/kernelbase_dll.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
01c5bcc2ee6471f423e35a9baf467d13851637f947bf7e9b6a32cb8a48e7b6c8

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
853bfddb684f5e8e47acaa31f9f82bd1199ca7e0
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
110702
cf-request-id
05f417cd820000073e0b33c000000001
x-served-by
cache-fra19164-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
2672:645D:51E3E41:56BE5A3:5F920BF4
x-timer
S1603406837.131094,VS0,VE91
etag
"5f01a324-1b06e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09c0073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
create_process_a_kernelbase.png
persianov.net/img/emotet_malware/ 		86 KB
86 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/create_process_a_kernelbase.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79abedaf1cb66a3c9505dc17431ec006ab2228434ccc5a81def4e27390f8a40d

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
d4b6498d65132b97377fd321ead12fcd49a87ef1
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
87695
cf-request-id
05f417cd810000073ef53ba000000001
x-served-by
cache-fra19143-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
467E:F96D:4B23117:4F922EB:5F920BF4
x-timer
S1603406837.130709,VS0,VE608
etag
"5f01a324-1568f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406838"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09c1073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
three_unpacked_binaries.png
persianov.net/img/emotet_malware/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/three_unpacked_binaries.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
91161d323e4d05e41ec6fbe3fc9462a16bf538ea6e03dff087136baa028da983

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
fbe753e016b29c6366f2d71d37ca34b16b5d3ff3
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
15320
cf-request-id
05f417cd810000073efab57000000001
x-served-by
cache-fra19163-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
F37C:2D54:24C5ED:2B1473:5F920BF2
x-timer
S1603406837.146072,VS0,VE592
etag
"5f01a324-3bd8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406838"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09c3073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
follow_in_dump_unpacked_binaries.png
persianov.net/img/emotet_malware/ 		75 KB
76 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/follow_in_dump_unpacked_binaries.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c74311ffb965b6d9b3aae66ea5f1d36de69f28e109e4c47275cfffd7e45359f9

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
37d49fc0ad9bf41a608053bdea96e5d883d187bd
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
77056
cf-request-id
05f417cd810000073e52125000000001
x-served-by
cache-fra19171-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
2638:6FD7:2A31D26:2CCF830:5F920BF4
x-timer
S1603406837.137214,VS0,VE91
etag
"5f01a324-12d00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09c5073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
three_functions_start.png
persianov.net/img/emotet_malware/ 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/three_functions_start.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
929b4361bbdf8053533587bee06a6c97cfb86e2840f7863f61cfd5a8a9d8b764

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
1a9c9e8808f8b525e0442bd644fa8683fce52285
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
20797
cf-request-id
05f417cd850000073e5f3a9000000001
x-served-by
cache-fra19133-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
141E:12A2C:4A731B4:4ED40FC:5F920BF5
x-timer
S1603406837.139583,VS0,VE85
etag
"5f01a324-513d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09c6073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
encrypted_strings.png
persianov.net/img/emotet_malware/ 		94 KB
94 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/encrypted_strings.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5311fa86f159e39b7c45bdfd8612cc65396364816bd552d18332681c2d1b630e

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
75e239949532139866187ae0aee9461a8eb0eeb1
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
96120
cf-request-id
05f417cd820000073e3136b000000001
x-served-by
cache-fra19155-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
2202:2D58:4FAF2FC:54674F6:5F920BF4
x-timer
S1603406837.131854,VS0,VE608
etag
"5f01a324-17778"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406838"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09c8073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
mutex_checks.png
persianov.net/img/emotet_malware/ 		64 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/mutex_checks.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a311be5fbdb9c3df1e8c26672ec4cc4a2b0fc0170d79299dfe8294a08ad978c4

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
0e07126d3951741e127f0a6aad983dd9224e70db
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
65706
cf-request-id
05f417cd820000073e3c89c000000001
x-served-by
cache-fra19151-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
D8C0:12A2C:4A731B4:4ED40FE:5F920BF5
x-timer
S1603406837.132777,VS0,VE606
etag
"5f01a324-100aa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406838"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09ca073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
new_process_created.png
persianov.net/img/emotet_malware/ 		22 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/new_process_created.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f700076e7aa05b7928e2bad5c44aaad9c579128cda874a927d04c790c3bef65c

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
3bb43e609cc90686b31982c1b511574fd5838ff4
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
22962
cf-request-id
05f417cd820000073e508cd000000001
x-served-by
cache-fra19164-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
CEC4:F9F4:127B434:13C7D93:5F920BF2
x-timer
S1603406837.131422,VS0,VE406
etag
"5f01a324-59b2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406838"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09cd073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
list_of_possible_names.png
persianov.net/img/emotet_malware/ 		32 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/list_of_possible_names.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a06e66db7e0fd7a71c271f2ded9f84819f0c80e15759f1f1b197e59b85c1778d

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
f415f51de0503d0c4d0429c136058c24aef274a7
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
33215
cf-request-id
05f417cd820000073eed331000000001
x-served-by
cache-fra19138-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
DEDE:127C:4DE8E48:5274067:5F920BF4
x-timer
S1603406837.131746,VS0,VE87
etag
"5f01a324-81bf"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09ce073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
get_computer_name.png
persianov.net/img/emotet_malware/ 		56 KB
57 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/get_computer_name.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f20ed42503686673c0e801818cebdfc3075a9f35b3f53265b5ee4ef68e31f90a

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
18dc626e6dc6ea3d55c43140617a0d7772c941ff
date
Thu, 22 Oct 2020 22:47:17 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
57553
cf-request-id
05f417cd820000073ee9076000000001
x-served-by
cache-fra19120-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
CE5A:F96D:4B23117:4F922F1:5F920BF4
x-timer
S1603406837.131512,VS0,VE90
etag
"5f01a324-e0d1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25c09d1073e-FRA
x-proxy-cache
MISS
expires
Thu, 22 Oct 2020 22:57:17 GMT
email-decode.min.js
persianov.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
856 B 		Script
General
Check archive.org
Download Go to
Full URL
https://persianov.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 22 Oct 2020 22:47:17 GMT
content-encoding
gzip
vary
Accept-Encoding
nel
{"report_to":"cf-nel","max_age":604800}
status
200
cf-request-id
05f417cd7f0000073ef0848000000001
last-modified
Wed, 21 Oct 2020 15:36:27 GMT
server
cloudflare
etag
W/"5f90557b-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
5e66c25bf9b5073e-FRA
expires
Sat, 24 Oct 2020 22:47:17 GMT
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-72526364-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Sep 2020 01:50:37 GMT
server
Golfe2
age
5489
date
Thu, 22 Oct 2020 21:15:48 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18650
expires
Thu, 22 Oct 2020 23:15:48 GMT
collect
www.google-analytics.com/j/ 		1 B
425 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1480871765&t=pageview&_s=1&dl=https%3A%2F%2Fpersianov.net%2Femotet-malware-analysis-part-2&ul=en-us&de=UTF-8&dt=Emotet%20malware%20analysis.%20Part%202.%20%7C%20Persianov%20on%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1761514394&gjid=1280961017&cid=31259812.1603406837&tid=UA-72526364-1&_gid=1934574109.1603406837&_r=1&gtm=2ouae1&z=1295359490
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 22 Oct 2020 22:47:17 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
text/plain
access-control-allow-origin
https://persianov.net
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
retron.ttf
persianov.net/fonts/ 		33 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://persianov.net/fonts/retron.ttf
Requested by
Host: persianov.net
URL: https://persianov.net/css/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
717114a706b3d3da1d19cfa2006696da7853e5b66772f94417a1c0aec7087173

Request headers

Origin
https://persianov.net
Referer
https://persianov.net/css/styles.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
419b43e14ec1ff55208c3115cbf57cc72652f9d5
date
Thu, 22 Oct 2020 22:47:17 GMT
content-encoding
gzip
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-cache
MISS
status
200
x-origin-cache
HIT
content-length
8824
cf-request-id
05f417ce6f0000073e470c1000000001
x-served-by
cache-fra19164-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
4898:6FD8:53ABF98:5894DF8:5F920BF3
x-timer
S1603406837.371940,VS0,VE88
etag
W/"5f01a324-8244"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603406837"}],"group":"cf-nel","max_age":604800}
content-type
font/ttf
via
1.1 varnish
expires
Thu, 22 Oct 2020 22:57:17 GMT
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5e66c25d7c9f073e-FRA
x-proxy-cache
MISS
x-cache-hits
0

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData

4 Cookies

Domain/Path Name / Value
.persianov.net/ Name: _gat_gtag_UA_72526364_1
Value: 1
.persianov.net/ Name: _gid
Value: GA1.2.1934574109.1603406837
.persianov.net/ Name: _ga
Value: GA1.2.31259812.1603406837
.persianov.net/ Name: __cfduid
Value: d459e2e67390c77e30fc5dfbdbaf901441603406836

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

persianov.net
www.google-analytics.com
www.googletagmanager.com
2606:4700:3034::681b:a0a3
2a00:1450:4001:809::200e
2a00:1450:4001:824::2008
01c5bcc2ee6471f423e35a9baf467d13851637f947bf7e9b6a32cb8a48e7b6c8
14cfbc970ef3281eb42e1a7da8c99f6628e9e52ffe586c82f54d3944e6d9a6d1
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2c9cf5c6f37b5925247d926ea1ba22e8a4beada8170d5254f21920d66a44461d
32d16bcf56a7226c7816a905d346884d563e9b9ad41157e84fe5916dbe500e9a
5311fa86f159e39b7c45bdfd8612cc65396364816bd552d18332681c2d1b630e
60816ceb591c8397eab06de5676830fe3bec0b04bdff84f7790a229cc27bf491
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
717114a706b3d3da1d19cfa2006696da7853e5b66772f94417a1c0aec7087173
79abedaf1cb66a3c9505dc17431ec006ab2228434ccc5a81def4e27390f8a40d
8025550df90e39aa79ce1abc057038033f93ef1555991f4be7046cbe7b77e58e
8552b0ab65840a07c91fea28c792234a887d84aa8b69e3677cce836654752e64
91161d323e4d05e41ec6fbe3fc9462a16bf538ea6e03dff087136baa028da983
929b4361bbdf8053533587bee06a6c97cfb86e2840f7863f61cfd5a8a9d8b764
a06e66db7e0fd7a71c271f2ded9f84819f0c80e15759f1f1b197e59b85c1778d
a311be5fbdb9c3df1e8c26672ec4cc4a2b0fc0170d79299dfe8294a08ad978c4
bd99908fc89607684da52d39467058fdd785de7491b158a237a313a466331870
bda34f247ecc21803b157de8ab5e089ecb07108e4c0c429a6c083cdc2fa87018
c74311ffb965b6d9b3aae66ea5f1d36de69f28e109e4c47275cfffd7e45359f9
cda7db655983cfd177d7a89ed2180c171ab9e271cf26957a793918149c60f3f5
db8c6f34fe857a611eb1eff1051226be89780f4a7ed771ca0808522315b70d77
f20ed42503686673c0e801818cebdfc3075a9f35b3f53265b5ee4ef68e31f90a
f700076e7aa05b7928e2bad5c44aaad9c579128cda874a927d04c790c3bef65c