www.welivesecurity.com
Open in
urlscan Pro
2600:1408:8c00::172e:9632
Public Scan
URL:
https://www.welivesecurity.com/en/eset-research/hotpage-story-signed-vulnerable-ad-injecting-driver/
Submission: On July 26 via api from DE — Scanned from US
Submission: On July 26 via api from DE — Scanned from US
Summary
This website contacted 3 IPs
in 1 countries
across 4 domains to perform 47 HTTP transactions.
The main IP is 2600:1408:8c00::172e:9632, located in
Ashburn, United States and
belongs to AKAMAI-ASN1, NL.
The main domain is www.welivesecurity.com.
The Cisco Umbrella rank of the primary domain is 380578.
TLS certificate: Issued by Thawte TLS RSA CA G1 on January 19th 2024. Valid for: a year.
This is the only time www.welivesecurity.com was scanned on urlscan.io!
TLS certificate: Issued by Thawte TLS RSA CA G1 on January 19th 2024. Valid for: a year.
This is the only time www.welivesecurity.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 17 | 2600:1408:8c0... 2600:1408:8c00::172e:9632 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 1 | 2606:2800:11f... 2606:2800:11f:1cb7:261b:1f9c:2074:3c | 15133 (EDGECAST) (EDGECAST) | |
| 47 | 3 |
17
2600:1408:8c00::172e:9632
(Ashburn, United States)
ASN20940 (AKAMAI-ASN1, NL)
ASN20940 (AKAMAI-ASN1, NL)
| www.welivesecurity.com |
1
2606:2800:11f:1cb7:261b:1f9c:2074:3c
(United States)
ASN15133 (EDGECAST, US)
ASN15133 (EDGECAST, US)
| web-assets.esetstatic.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 17 |
welivesecurity.com
www.welivesecurity.com — Cisco Umbrella Rank: 380578 |
84 KB |
| 1 |
esetstatic.com
web-assets.esetstatic.com Failed |
|
| 0 |
disqus.com
Failed
welivesecurity.disqus.com Failed |
|
| 0 |
go-mpulse.net
Failed
s.go-mpulse.net Failed |
|
| 47 | 4 |
| Domain | Requested by | |
|---|---|---|
| 17 | www.welivesecurity.com |
www.welivesecurity.com
|
| 1 | web-assets.esetstatic.com |
www.welivesecurity.com
|
| 0 | welivesecurity.disqus.com Failed |
www.welivesecurity.com
|
| 0 | s.go-mpulse.net Failed |
www.welivesecurity.com
|
| 47 | 4 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.welivesecurity.com Thawte TLS RSA CA G1 |
2024-01-19 - 2025-01-18 |
a year | crt.sh |
| web-assets.esetstatic.com Thawte TLS RSA CA G1 |
2024-05-22 - 2025-05-21 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.welivesecurity.com/en/eset-research/hotpage-story-signed-vulnerable-ad-injecting-driver/
Frame ID: 4CF3382B0968C5617B12803812B51EBD
Requests: 47 HTTP requests in this frame
Frame:
https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B
Frame ID: BCD13F9CA267B2DDF3D36620092A0E0B
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
HotPage: Story of a signed, vulnerable, ad-injecting driverDetected technologies
Google Tag Manager
(Tag Managers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- googletagmanager\.com/ns\.html[^>]+></iframe>
- <!-- (?:End )?Google Tag Manager -->
Page Statistics
60 Outgoing links
These are links going to different origins than the main page.
URL: https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware
Title: Mandiant Intelligence
Title: Mandiant Intelligence
Search URL Search Domain Scan URL
URL: https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/
Title: SentinelLabs
Title: SentinelLabs
Search URL Search Domain Scan URL
URL: https://www.gdatasoftware.com/blog/microsoft-signed-a-malicious-netfilter-rootkit
Title: G DATA
Title: G DATA
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows-hardware/drivers/dashboard/code-signing-reqs
Title: Microsoft’s driver code-signing requirements
Title: Microsoft’s driver code-signing requirements
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-oshared/91755632-4b0d-44ca-89a9-9699afbbd268
Title: SpcSpOpusInfo
Title: SpcSpOpusInfo
Search URL Search Domain Scan URL
URL: https://github.com/lief-project/LIEF
Title: LIEF binary parser
Title: LIEF binary parser
Search URL Search Domain Scan URL
URL: https://www.windowsservercatalog.com/results.aspx?&bCatID=1283&cpID=34251&avc=10&ava=0&avt=0&avq=0&OR=1&PGS=25
Title: Windows Server Catalog
Title: Windows Server Catalog
Search URL Search Domain Scan URL
URL: https://netfiltersdk.com/
Title: netfilter
Title: netfilter
Search URL Search Domain Scan URL
URL: https://dingtalk.com/qidian/company/1190156990002244544
Title: dingtalk
Title: dingtalk
Search URL Search Domain Scan URL
URL: https://en.wikipedia.org/wiki/Web_crawler
Title: web crawler
Title: web crawler
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/feature-discovery#standard-hypervisor-cpuid-leaves
Title: Hypervisor Discovery
Title: Hypervisor Discovery
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgeneratesymmetrickey
Title: BCryptGenerateSymmetricKey
Title: BCryptGenerateSymmetricKey
Search URL Search Domain Scan URL
URL: https://github.com/DarthTon/Blackbone
Title: Blackbone
Title: Blackbone
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetcreateprocessnotifyroutineex
Title: process creation
Title: process creation
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetloadimagenotifyroutineex
Title: image loading
Title: image loading
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/irp-mj-device-control
Title: IRP_MJ_DEVICE_CONTROL
Title: IRP_MJ_DEVICE_CONTROL
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-kestackattachprocess
Title: KeStackAttachProcess
Title: KeStackAttachProcess
Search URL Search Domain Scan URL
URL: https://github.com/DarthTon/Blackbone/blob/master/src/BlackBoneDrv/Private.c#L515
Title: ZwCreateThreadEx
Title: ZwCreateThreadEx
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw
Title: CreateProcessW
Title: CreateProcessW
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows/win32/sync/asynchronous-procedure-calls
Title: APC routine
Title: APC routine
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-ioqueueworkitemex
Title: IoQueueWorkItemEx
Title: IoQueueWorkItemEx
Search URL Search Domain Scan URL
URL: https://www.microsoft.com/en-us/research/project/detours/
Title: Microsoft Detours hooking library
Title: Microsoft Detours hooking library
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/fr-fr/windows/win32/api/processthreadsapi/nf-processthreadsapi-setprocessmitigationpolicy
Title: SetProcessMitigationPolicy
Title: SetProcessMitigationPolicy
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows/win32/api/ws2tcpip/nf-ws2tcpip-getaddrinfo
Title: getaddrinfo
Title: getaddrinfo
Search URL Search Domain Scan URL
URL: https://www.openssl.org/docs/man1.1.1/man3/SSL_read.html
Title: SSL_read
Title: SSL_read
Search URL Search Domain Scan URL
URL: https://www.openssl.org/docs/man1.1.1/man3/SSL_write.html
Title: SSL_write
Title: SSL_write
Search URL Search Domain Scan URL
URL: https://chromium.googlesource.com/chromium/src/+/lkgr/net/socket/ssl_client_socket_impl.cc#1350
Title: DoPayloadWrite
Title: DoPayloadWrite
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntdeviceiocontrolfile
Title: NtDeviceIoControlFile
Title: NtDeviceIoControlFile
Search URL Search Domain Scan URL
URL: https://www.rfc-editor.org/rfc/rfc9110#section-15.4.3
Title: HTTP code 302
Title: HTTP code 302
Search URL Search Domain Scan URL
URL: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe
Title: iframe
Title: iframe
Search URL Search Domain Scan URL
URL: https://developer.mozilla.org/en-US/docs/Web/API/Location/replace
Title: replace
Title: replace
Search URL Search Domain Scan URL
URL: https://github.com/MicrosoftDocs/windows-driver-docs/blob/staging/windows-driver-docs-pr/driversecurity/windows-security-model.md
Title: ACLs
Title: ACLs
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows/win32/services/protecting-anti-malware-services-
Title: protected processes
Title: protected processes
Search URL Search Domain Scan URL
URL: https://www.eset.com/int/business/services/threat-intelligence/?utm_source=welivesecurity.com&utm_medium=referral&utm_campaign=wls-research&utm_content=hotpage-story-signed-vulnerable-ad-injecting-driver&sfdccampaignid=7011n0000017htTAAQ
Title: ESET Threat Intelligence
Title: ESET Threat Intelligence
Search URL Search Domain Scan URL
URL: https://github.com/eset/malware-ioc/tree/master/hotpage
Title: GitHub repository
Title: GitHub repository
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/resources/versions/
Title: version 15
Title: version 15
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1588/003
Title: T1588.003
Title: T1588.003
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1204/002
Title: T1204.002
Title: T1204.002
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1569/002
Title: T1569.002
Title: T1569.002
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1574/013
Title: T1574.013
Title: T1574.013
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1055/004
Title: T1055.004
Title: T1055.004
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1553/002
Title: T1553.002
Title: T1553.002
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1140
Title: T1140
Title: T1140
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1055/001
Title: T1055.001
Title: T1055.001
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1027/009
Title: T1027.009
Title: T1027.009
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1070/004
Title: T1070.004
Title: T1070.004
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1027/002
Title: T1027.002
Title: T1027.002
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1033
Title: T1033
Title: T1033
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1185
Title: T1185
Title: T1185
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1071/001
Title: T1071.001
Title: T1071.001
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1573/001
Title: T1573.001
Title: T1573.001
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/versions/v15/techniques/T1565/002
Title: T1565.002
Title: T1565.002
Search URL Search Domain Scan URL
URL: https://www.facebook.com/sharer/sharer.php?u=https://www.welivesecurity.com/en/eset-research/hotpage-story-signed-vulnerable-ad-injecting-driver/
Search URL Search Domain Scan URL
URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.welivesecurity.com/en/eset-research/hotpage-story-signed-vulnerable-ad-injecting-driver/
Search URL Search Domain Scan URL
URL: https://twitter.com/intent/tweet?url=https://www.welivesecurity.com/en/eset-research/hotpage-story-signed-vulnerable-ad-injecting-driver/
Search URL Search Domain Scan URL
URL: https://www.eset.com/
Title: ESET
Title: ESET
Search URL Search Domain Scan URL
URL: https://www.facebook.com/eset/
Search URL Search Domain Scan URL
URL: https://youtube.com/esetglobal
Search URL Search Domain Scan URL
URL: https://twitter.com/ESET
Search URL Search Domain Scan URL
URL: https://www.linkedin.com/company/eset
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
47 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
www.welivesecurity.com/en/eset-research/hotpage-story-signed-vulnerable-ad-injecting-driver/ |
143 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-BookLF-405f3258.woff
www.welivesecurity.com/build/assets/ |
56 KB 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-BoldLF-31f4bc72.woff
www.welivesecurity.com/build/assets/ |
31 KB 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-DemiLF-8885b886.woff
www.welivesecurity.com/build/assets/ |
16 KB 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
hotpage-ad-injecting-driver.jpeg
web-assets.esetstatic.com/tn/-x425/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
article-header-995fa639.js
www.welivesecurity.com/build/assets/ |
442 B 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app-6317871c.css
www.welivesecurity.com/build/assets/ |
298 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
romain-dumont.jpeg
web-assets.esetstatic.com/tn/-x45/wls/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
hotpage-ad-injecting-driver.jpeg
web-assets.esetstatic.com/tn/-x700/wls/2024/7-2024/hotpage/ |
21 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-1-owner-of-hotpage-driver-s-digital-signature.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-2-hotpage-driver-s-certificate-extended-verification-and-code-signing-attributes.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-3-hotpage-driver-s-certificate-spcspopusinfo-attribute.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-4-extraction-of-the-company-name-from-the-hotpage-driver-s-certificate.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-5-the-chinese-company-s-certified-products-listed-in-the-windows-server-catalog.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-6-translated-executive-and-shareholder-information-about-the-company.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-7-screenshot-of-the-dwadsafe-com-webpage-made-by-zhizhuyinqing-com.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-8-mention-of-dwadsafe-com-in-a-forum-dedicated-to-internet-cafe-maintenance.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-9-overview-of-the-installer-s-workflow.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-10-newtalbe-configuration.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-11-simplified-driver-logic.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-12-the-hotpage-configuration.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-13-legitimate-main-page-of-the-web-directory-2345-com.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-14-ad-riddled-page-mimicking-the-homepage-of-2345-com.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-15-function-that-finds-the-command-line-buffer-left-and-disassembly-of-the-getcommandlinea.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-16-patterns-used-to-find-the-dopayloadwrite-function.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-17-finding-the-pointer-to-the-ssl-write-function.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-18-hook-routine-for-ntdeviceiocontrolfile-api-function.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-19-redirection-method-0.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
figure-20-log-file-of-our-injected-library.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
welivesecurity-eset-threat-intelligence.jpeg
web-assets.esetstatic.com/wls/2023/2023-12/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
signed-kernel-drivers-windows-vulnerabilities-1.jpg
web-assets.esetstatic.com/tn/-x82/wls/2022/01/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
DLink_Malware-1.jpg
web-assets.esetstatic.com/tn/-x82/wls/2018/06/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
Untitled-design-2-1.jpg
web-assets.esetstatic.com/tn/-x82/wls/2019/06/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
apt-activity-report-4523d00f.webp
www.welivesecurity.com/build/assets/ |
0 0 |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app-7a4ecde0.js
www.welivesecurity.com/build/assets/ |
25 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
search-7d9f58b7.js
www.welivesecurity.com/build/assets/ |
20 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
_commonjsHelpers-042e6b4d.js
www.welivesecurity.com/build/assets/ |
725 B 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
prism-40494b65.css
www.welivesecurity.com/build/assets/ |
0 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
prism-40d1b0a4.js
www.welivesecurity.com/build/assets/ |
0 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
article-e3625c4c.css
www.welivesecurity.com/build/assets/ |
0 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
article-fd027339.js
www.welivesecurity.com/build/assets/ |
0 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
7R9SM-QGSYF-QDLJK-UETXR-SPM6B
s.go-mpulse.net/boomerang/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
embed.js
welivesecurity.disqus.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
7R9SM-QGSYF-QDLJK-UETXR-SPM6B
s.go-mpulse.net/boomerang/ Frame BCD1 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
671 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-MediumLF-261e3ac5.woff
www.welivesecurity.com/build/assets/ |
0 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-BookItalicLF-4cad214a.woff
www.welivesecurity.com/build/assets/ |
0 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-LightLF-ec800a5b.woff
www.welivesecurity.com/build/assets/ |
0 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/tn/-x425/wls/2024/7-2024/hotpage/hotpage-ad-injecting-driver.jpeg
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/tn/-x45/wls/romain-dumont.jpeg
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-1-owner-of-hotpage-driver-s-digital-signature.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-2-hotpage-driver-s-certificate-extended-verification-and-code-signing-attributes.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-3-hotpage-driver-s-certificate-spcspopusinfo-attribute.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-4-extraction-of-the-company-name-from-the-hotpage-driver-s-certificate.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-5-the-chinese-company-s-certified-products-listed-in-the-windows-server-catalog.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-6-translated-executive-and-shareholder-information-about-the-company.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-7-screenshot-of-the-dwadsafe-com-webpage-made-by-zhizhuyinqing-com.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-8-mention-of-dwadsafe-com-in-a-forum-dedicated-to-internet-cafe-maintenance.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-9-overview-of-the-installer-s-workflow.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-10-newtalbe-configuration.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-11-simplified-driver-logic.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-12-the-hotpage-configuration.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-13-legitimate-main-page-of-the-web-directory-2345-com.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-14-ad-riddled-page-mimicking-the-homepage-of-2345-com.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-15-function-that-finds-the-command-line-buffer-left-and-disassembly-of-the-getcommandlinea.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-16-patterns-used-to-find-the-dopayloadwrite-function.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-17-finding-the-pointer-to-the-ssl-write-function.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-18-hook-routine-for-ntdeviceiocontrolfile-api-function.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-19-redirection-method-0.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-20-log-file-of-our-injected-library.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2023/2023-12/welivesecurity-eset-threat-intelligence.jpeg
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/tn/-x82/wls/2022/01/signed-kernel-drivers-windows-vulnerabilities-1.jpg
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/tn/-x82/wls/2018/06/DLink_Malware-1.jpg
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/tn/-x82/wls/2019/06/Untitled-design-2-1.jpg
- Domain
- s.go-mpulse.net
- URL
- https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B
- Domain
- welivesecurity.disqus.com
- URL
- https://welivesecurity.disqus.com/embed.js
- Domain
- s.go-mpulse.net
- URL
- https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B
Verdicts & Comments Add Verdict or Comment
7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| $current_language object| BOOMR_mq string| BOOMR_API_key object| BOOMR number| BOOMR_lstart function| disqus_config1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .welivesecurity.com/ | Name: AKA_A2 Value: A |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Content-Security-Policy | default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://*.akamaihd.net https://*.akstat.io https://*.eset.com https://*.hotjar.com https://*.hotjar.io https://adservice.google.com https://captcha.eset.com https://captcha.welivesecurity.com https://cc.welivesecurity.com https://cdn.esetstatic.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://px.ads.linkedin.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://*.hotjar.com wss://ws1.hotjar.com; font-src 'self' data: https://script.hotjar.com; form-action 'self'; frame-ancestors 'self'; frame-src 'self' https://*.slideshare.net https://bid.g.doubleclick.net https://c.disquscdn.com https://disqus.com https://m.facebook.com https://open.spotify.com/ https://platform.twitter.com https://player.vimeo.com https://share.transistor.fm https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.podbean.com https://www.screencast.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://*.esetstatic.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.welivesecurity.com https://connect.facebook.net https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://twitter.com https://www.facebook.com https://www.google-analytics.com https://www.google.al https://www.google.ba https://www.google.bf https://www.google.bg https://www.google.by https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.co.ao https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.ls https://www.google.co.ma https://www.google.co.tz https://www.google.co.za https://www.google.com.af https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.br https://www.google.com.co https://www.google.com.do https://www.google.com.eg https://www.google.com.gi https://www.google.com.gt https://www.google.com.hk https://www.google.com.kw https://www.google.com.ly https://www.google.com.mx https://www.google.com.ni https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.sa https://www.google.com.sl https://www.google.com.tr https://www.google.com.tw https://www.google.com.vn https://www.google.cv https://www.google.cz https://www.google.es https://www.google.fi https://www.google.ge https://www.google.gm https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.ie https://www.google.it https://www.google.je https://www.google.jo https://www.google.kg https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.md https://www.google.mw https://www.google.no https://www.google.ps https://www.google.rs https://www.google.sk https://www.google.tg https://www.google.tn https://www.googletagmanager.com https://www.hotjar.com https://www.linkedin.com https://www.youtube.com; manifest-src 'self'; media-src 'self' https://web-assets.esetstatic.com; object-src 'self' https://content.screencast.com; prefetch-src https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://a.disquscdn.com https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.ie https://www.google.nl https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default; |
| Strict-Transport-Security | max-age=15724800 |
| X-Content-Type-Options | nosniff |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
s.go-mpulse.net
web-assets.esetstatic.com
welivesecurity.disqus.com
www.welivesecurity.com
s.go-mpulse.net
web-assets.esetstatic.com
welivesecurity.disqus.com
2600:1408:8c00::172e:9632
2606:2800:11f:1cb7:261b:1f9c:2074:3c
606ea62b1a8a1e2b24b9e0eafef0757cea22f73f3956d6548611f7c26c4551b5
6317871c5ca7b272b4fd676ec207449ca4e75847b4af2c95f4682e15fde4af95
644fbb688b94c602990a4988d379d439a5151ea782e06496cb6347cbbb64e49d
e5e04f46d2646cb5035d685732660ea47d4034283026320de0a6ea75d243ea48
ed915d2176566b841f0e01e7632ce7a20b023cbcb4f5976a6015284fccd8a865