urlscan.io logo urlscan.io
SecurityTrails logo

persianov.net Open in urlscan Pro
2606:4700:3034::681b:a0a3  Public Scan

Go To Rescan Add Verdict Report
URL: https://persianov.net/emotet-malware-analysis-part-2
Submission: On October 05 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 24 HTTP transactions. The main IP is 2606:4700:3034::681b:a0a3, located in United States and belongs to CLOUDFLARENET, US. The main domain is persianov.net.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on September 3rd 2020. Valid for: a year.
This is the only time persianov.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
21 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
24 3
Domain Requested by
21 persianov.net persianov.net
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
1 www.googletagmanager.com persianov.net
24 3

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.reddit.com
www.linkedin.com
www.facebook.com
github.com
www.youtube.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-09-03 -
2021-09-03		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-09-03 -
2020-11-26		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://persianov.net/emotet-malware-analysis-part-2
Frame ID: DE53C06B09EC2B6A52D6564E912303E6
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

24
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

920 kB
Transfer

1037 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request emotet-malware-analysis-part-2
persianov.net/ 		17 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
06a5daf36476b3616c0917f7686e8523545c1e21fb4e9ef0f622ab432a3017d9

Request headers

:method
GET
:authority
persianov.net
:scheme
https
:path
/emotet-malware-analysis-part-2
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Mon, 05 Oct 2020 23:17:07 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=d5dc00cac1644c8d41988c7ee76ad22021601939827; expires=Wed, 04-Nov-20 23:17:07 GMT; path=/; domain=.persianov.net; HttpOnly; SameSite=Lax; Secure
last-modified
Sun, 05 Jul 2020 09:53:45 GMT
access-control-allow-origin
*
expires
Mon, 05 Oct 2020 23:27:07 GMT
cache-control
max-age=600
x-proxy-cache
MISS
x-github-request-id
93D8:B35C:A6A8704:B19D7BF:5F7BA972
via
1.1 varnish
age
0
x-served-by
cache-fra19164-FRA
x-cache
MISS
x-cache-hits
0
x-timer
S1601939828.666387,VS0,VE89
vary
Accept-Encoding
x-fastly-request-id
540d09238a77a95157b54baee9d497d83ceff62b
cf-cache-status
DYNAMIC
cf-request-id
059ca703bc00002b95400b7200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5ddadab2c88a2b95-FRA
content-encoding
gzip
js
www.googletagmanager.com/gtag/ 		90 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-72526364-1
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
12b3eb1b3084193ec624049ce657a93fbd4249f49b14fe1c79c7c24698882be6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 05 Oct 2020 23:17:07 GMT
content-encoding
br
vary
Accept-Encoding
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36666
x-xss-protection
0
last-modified
Mon, 05 Oct 2020 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 05 Oct 2020 23:17:07 GMT
monokai.css
persianov.net/css/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://persianov.net/css/monokai.css
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bda34f247ecc21803b157de8ab5e089ecb07108e4c0c429a6c083cdc2fa87018

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
b5475ebb9c7b820b5e769a7311480efe785d9720
date
Mon, 05 Oct 2020 23:17:07 GMT
content-encoding
gzip
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-cache
MISS
status
200
x-cache-hits
0
content-length
882
cf-request-id
059ca7043700002b95400ba200000001
x-served-by
cache-fra19129-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
6BC6:79D9:C587754:D2B2787:5F7BA971
x-timer
S1601939828.776745,VS0,VE87
etag
W/"5f01a324-e9b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
via
1.1 varnish
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab389e32b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
styles.css
persianov.net/css/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://persianov.net/css/styles.css
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
60816ceb591c8397eab06de5676830fe3bec0b04bdff84f7790a229cc27bf491

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
2a4d88e0ecf1de81b0719ba30f1b1e0005422373
date
Mon, 05 Oct 2020 23:17:07 GMT
content-encoding
gzip
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-cache
MISS
status
200
x-cache-hits
0
content-length
1137
cf-request-id
059ca7043700002b95400bb200000001
x-served-by
cache-fra19155-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
BB04:D891:855010:9757B5:5F7BA973
x-timer
S1601939828.777537,VS0,VE87
etag
W/"5f01a324-1017"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
via
1.1 varnish
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab389e52b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
header.png
persianov.net/img/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/header.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8025550df90e39aa79ce1abc057038033f93ef1555991f4be7046cbe7b77e58e

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
66a28967961a28ac3ac75be349f52bed4e52545a
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
36463
cf-request-id
059ca7043e00002b95400bd200000001
x-served-by
cache-fra19180-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
C082:B97F:B089B92:BC06705:5F7BA973
x-timer
S1601939828.785502,VS0,VE89
etag
"5f01a324-8e6f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab399fe2b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
pe_1_dlls.png
persianov.net/img/emotet_malware/ 		63 KB
63 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/pe_1_dlls.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14cfbc970ef3281eb42e1a7da8c99f6628e9e52ffe586c82f54d3944e6d9a6d1

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
a02f8a275f06b4bc79305eb5a05a912e37ea0650
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
64646
cf-request-id
059ca7043e00002b95400be200000001
x-served-by
cache-fra19174-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
A8C2:B97D:2EED3E7:326D25D:5F7BA973
x-timer
S1601939828.784399,VS0,VE89
etag
"5f01a324-fc86"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a002b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
pe_1_sections.png
persianov.net/img/emotet_malware/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/pe_1_sections.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cda7db655983cfd177d7a89ed2180c171ab9e271cf26957a793918149c60f3f5

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
564024a2f2c528681036ff7f13a67cd55647f42e
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
21705
cf-request-id
059ca7043e00002b95400bf200000001
x-served-by
cache-fra19148-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
E04E:5989:2534D0F:2853251:5F7BA973
x-timer
S1601939828.797632,VS0,VE87
etag
"5f01a324-54c9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a012b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
pe_1_packer_1.png
persianov.net/img/emotet_malware/ 		79 KB
80 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/pe_1_packer_1.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd99908fc89607684da52d39467058fdd785de7491b158a237a313a466331870

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
234897f6a634396b0c099c3d381e1320678b8175
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
81024
cf-request-id
059ca7043e00002b95400c0200000001
x-served-by
cache-fra19130-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
CDE6:32B7:5F18D09:65DD182:5F7BA973
x-timer
S1601939828.789960,VS0,VE89
etag
"5f01a324-13c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a032b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
pe_1_packer_2.png
persianov.net/img/emotet_malware/ 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/pe_1_packer_2.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
32d16bcf56a7226c7816a905d346884d563e9b9ad41157e84fe5916dbe500e9a

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
038f29cb65a6e16cf4703dac9524dae205d3c4b8
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
43634
cf-request-id
059ca7043e00002b95400c1200000001
x-served-by
cache-fra19148-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
B5DA:D895:A1F489A:ACB7433:5F7BA973
x-timer
S1601939828.795752,VS0,VE85
etag
"5f01a324-aa72"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a062b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
hybrid_analysis.png
persianov.net/img/emotet_malware/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/hybrid_analysis.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8552b0ab65840a07c91fea28c792234a887d84aa8b69e3677cce836654752e64

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
e3959609696a7b17e4b789b98787c0b1473d914f
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
28171
cf-request-id
059ca7043e00002b95400c2200000001
x-served-by
cache-fra19169-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
8D28:B146:A17C289:ABDF05A:5F7BA973
x-timer
S1601939828.785068,VS0,VE89
etag
"5f01a324-6e0b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a092b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
kernelbase_dll.png
persianov.net/img/emotet_malware/ 		108 KB
109 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/kernelbase_dll.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
01c5bcc2ee6471f423e35a9baf467d13851637f947bf7e9b6a32cb8a48e7b6c8

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
4b58db068321c6e8cf6e012f05c8b2e93152ecd3
date
Mon, 05 Oct 2020 23:17:08 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
110702
cf-request-id
059ca7043e00002b95400c3200000001
x-served-by
cache-fra19130-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
4826:B1B4:9F2E795:A95CFF6:5F7BA973
x-timer
S1601939828.792714,VS0,VE251
etag
"5f01a324-1b06e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a0b2b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
create_process_a_kernelbase.png
persianov.net/img/emotet_malware/ 		86 KB
86 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/create_process_a_kernelbase.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79abedaf1cb66a3c9505dc17431ec006ab2228434ccc5a81def4e27390f8a40d

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
da79f76060450746333fb2c8230274d77cf71d13
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
87695
cf-request-id
059ca7043e00002b95400c4200000001
x-served-by
cache-fra19156-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
6BB0:5DC7:B50C896:C160727:5F7BA973
x-timer
S1601939828.784837,VS0,VE93
etag
"5f01a324-1568f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a0d2b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
three_unpacked_binaries.png
persianov.net/img/emotet_malware/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/three_unpacked_binaries.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
91161d323e4d05e41ec6fbe3fc9462a16bf538ea6e03dff087136baa028da983

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
c7506250770a2010f99722a6f31afd9020cdbb9c
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
15320
cf-request-id
059ca7043e00002b95400c5200000001
x-served-by
cache-fra19130-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
5E1E:B330:9D5FAE3:A7662F1:5F7BA973
x-timer
S1601939828.788567,VS0,VE86
etag
"5f01a324-3bd8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a102b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
follow_in_dump_unpacked_binaries.png
persianov.net/img/emotet_malware/ 		75 KB
76 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/follow_in_dump_unpacked_binaries.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c74311ffb965b6d9b3aae66ea5f1d36de69f28e109e4c47275cfffd7e45359f9

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
12778f53b7ae5952b3ae270147d5a11442238f3a
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
77056
cf-request-id
059ca7043e00002b95400c6200000001
x-served-by
cache-fra19136-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
CE98:D895:A1F489A:ACB7374:5F7BA970
x-timer
S1601939828.789175,VS0,VE88
etag
"5f01a324-12d00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a132b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
three_functions_start.png
persianov.net/img/emotet_malware/ 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/three_functions_start.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
929b4361bbdf8053533587bee06a6c97cfb86e2840f7863f61cfd5a8a9d8b764

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
3d294fda54df4396d4bdd443b8af0ef3664f24b7
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
20797
cf-request-id
059ca7043e00002b95400c7200000001
x-served-by
cache-fra19144-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
6F4C:B32E:2C6317D:2F9A786:5F7BA972
x-timer
S1601939828.785672,VS0,VE89
etag
"5f01a324-513d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a162b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
encrypted_strings.png
persianov.net/img/emotet_malware/ 		94 KB
94 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/encrypted_strings.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5311fa86f159e39b7c45bdfd8612cc65396364816bd552d18332681c2d1b630e

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
958b61f22f706f0db66e5c0f5b2ce56af6389f05
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
96120
cf-request-id
059ca7043e00002b95400c8200000001
x-served-by
cache-fra19123-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
7F2C:D894:5969288:5F9B26F:5F7BA971
x-timer
S1601939828.787282,VS0,VE94
etag
"5f01a324-17778"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a182b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
mutex_checks.png
persianov.net/img/emotet_malware/ 		64 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/mutex_checks.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a311be5fbdb9c3df1e8c26672ec4cc4a2b0fc0170d79299dfe8294a08ad978c4

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
73c01ad776cb728b9810dba0023fbf82ba7b6fe2
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
content-length
65706
cf-request-id
059ca7043e00002b95400c9200000001
x-served-by
cache-fra19182-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
C6D2:D894:5969288:5F9B290:5F7BA973
x-timer
S1601939828.791148,VS0,VE169
etag
"5f01a324-100aa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a192b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
new_process_created.png
persianov.net/img/emotet_malware/ 		22 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/new_process_created.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f700076e7aa05b7928e2bad5c44aaad9c579128cda874a927d04c790c3bef65c

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
3a4e795b83bddc52eb8879842a39d117e7fba5ce
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
22962
cf-request-id
059ca7043e00002b95400ca200000001
x-served-by
cache-fra19121-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
B7EE:79D9:C587755:D2B27DE:5F7BA973
x-timer
S1601939828.789597,VS0,VE91
etag
"5f01a324-59b2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a1c2b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
list_of_possible_names.png
persianov.net/img/emotet_malware/ 		32 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/list_of_possible_names.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a06e66db7e0fd7a71c271f2ded9f84819f0c80e15759f1f1b197e59b85c1778d

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
0048ed81602ffaa786cc9ec8096cb3f3892d0df9
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
33215
cf-request-id
059ca7043e00002b95400cb200000001
x-served-by
cache-fra19151-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
1312:B1B4:9F2E795:A95CFE7:5F7BA973
x-timer
S1601939828.788765,VS0,VE88
etag
"5f01a324-81bf"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a1e2b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
get_computer_name.png
persianov.net/img/emotet_malware/ 		56 KB
57 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://persianov.net/img/emotet_malware/get_computer_name.png
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f20ed42503686673c0e801818cebdfc3075a9f35b3f53265b5ee4ef68e31f90a

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
7c5a69b73a552e295c83168ff5d9435104ab2bfc
date
Mon, 05 Oct 2020 23:17:07 GMT
via
1.1 varnish
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cache
MISS
status
200
x-cache-hits
0
x-origin-cache
HIT
content-length
57553
cf-request-id
059ca7043e00002b95400cc200000001
x-served-by
cache-fra19179-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
88E4:2B0F:E18960:FCADDF:5F7BA96F
x-timer
S1601939828.793190,VS0,VE87
etag
"5f01a324-e0d1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab39a202b95-FRA
x-proxy-cache
MISS
expires
Mon, 05 Oct 2020 23:27:07 GMT
email-decode.min.js
persianov.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
856 B 		Script
General
Check archive.org
Download Go to
Full URL
https://persianov.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: persianov.net
URL: https://persianov.net/emotet-malware-analysis-part-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 05 Oct 2020 23:17:07 GMT
content-encoding
gzip
vary
Accept-Encoding
nel
{"report_to":"cf-nel","max_age":604800}
status
200
cf-request-id
059ca7043e00002b95400bc200000001
last-modified
Thu, 01 Oct 2020 22:18:19 GMT
server
cloudflare
etag
W/"5f7655ab-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
5ddadab399fb2b95-FRA
expires
Wed, 07 Oct 2020 23:17:07 GMT
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-72526364-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Sep 2020 01:50:37 GMT
server
Golfe2
age
2607
date
Mon, 05 Oct 2020 22:33:40 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18650
expires
Tue, 06 Oct 2020 00:33:40 GMT
collect
www.google-analytics.com/j/ 		1 B
64 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1892352012&t=pageview&_s=1&dl=https%3A%2F%2Fpersianov.net%2Femotet-malware-analysis-part-2&ul=en-us&de=UTF-8&dt=Emotet%20malware%20analysis.%20Part%202.%20%7C%20Persianov%20on%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=694821051&gjid=947759043&cid=2089790663.1601939828&tid=UA-72526364-1&_gid=170931449.1601939828&_r=1&gtm=2ou9n1&z=1779825543
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://persianov.net/emotet-malware-analysis-part-2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 05 Oct 2020 23:17:07 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
text/plain
access-control-allow-origin
https://persianov.net
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
retron.ttf
persianov.net/fonts/ 		33 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://persianov.net/fonts/retron.ttf
Requested by
Host: persianov.net
URL: https://persianov.net/css/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:a0a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
717114a706b3d3da1d19cfa2006696da7853e5b66772f94417a1c0aec7087173

Request headers

Origin
https://persianov.net
Referer
https://persianov.net/css/styles.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
bf86f9a7e540c8e9ddabffa280840760b4fddc41
date
Mon, 05 Oct 2020 23:17:07 GMT
content-encoding
gzip
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-cache
MISS
status
200
x-origin-cache
HIT
content-length
8824
cf-request-id
059ca704a200002b95400ce200000001
x-served-by
cache-fra19145-FRA
last-modified
Sun, 05 Jul 2020 09:53:40 GMT
server
cloudflare
x-github-request-id
D20E:B97F:B089B99:BC066F4:5F7BA973
x-timer
S1601939828.886821,VS0,VE89
etag
W/"5f01a324-8244"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601939828"}],"group":"cf-nel","max_age":604800}
content-type
font/ttf
via
1.1 varnish
expires
Mon, 05 Oct 2020 23:27:07 GMT
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5ddadab43b212b95-FRA
x-proxy-cache
MISS
x-cache-hits
0

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData

4 Cookies

Domain/Path Name / Value
.persianov.net/ Name: _gat_gtag_UA_72526364_1
Value: 1
.persianov.net/ Name: _gid
Value: GA1.2.170931449.1601939828
.persianov.net/ Name: _ga
Value: GA1.2.2089790663.1601939828
.persianov.net/ Name: __cfduid
Value: d5dc00cac1644c8d41988c7ee76ad22021601939827

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

persianov.net
www.google-analytics.com
www.googletagmanager.com
2606:4700:3034::681b:a0a3
2a00:1450:4001:816::2008
2a00:1450:4001:81f::200e
01c5bcc2ee6471f423e35a9baf467d13851637f947bf7e9b6a32cb8a48e7b6c8
06a5daf36476b3616c0917f7686e8523545c1e21fb4e9ef0f622ab432a3017d9
12b3eb1b3084193ec624049ce657a93fbd4249f49b14fe1c79c7c24698882be6
14cfbc970ef3281eb42e1a7da8c99f6628e9e52ffe586c82f54d3944e6d9a6d1
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
32d16bcf56a7226c7816a905d346884d563e9b9ad41157e84fe5916dbe500e9a
5311fa86f159e39b7c45bdfd8612cc65396364816bd552d18332681c2d1b630e
60816ceb591c8397eab06de5676830fe3bec0b04bdff84f7790a229cc27bf491
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
717114a706b3d3da1d19cfa2006696da7853e5b66772f94417a1c0aec7087173
79abedaf1cb66a3c9505dc17431ec006ab2228434ccc5a81def4e27390f8a40d
8025550df90e39aa79ce1abc057038033f93ef1555991f4be7046cbe7b77e58e
8552b0ab65840a07c91fea28c792234a887d84aa8b69e3677cce836654752e64
91161d323e4d05e41ec6fbe3fc9462a16bf538ea6e03dff087136baa028da983
929b4361bbdf8053533587bee06a6c97cfb86e2840f7863f61cfd5a8a9d8b764
a06e66db7e0fd7a71c271f2ded9f84819f0c80e15759f1f1b197e59b85c1778d
a311be5fbdb9c3df1e8c26672ec4cc4a2b0fc0170d79299dfe8294a08ad978c4
bd99908fc89607684da52d39467058fdd785de7491b158a237a313a466331870
bda34f247ecc21803b157de8ab5e089ecb07108e4c0c429a6c083cdc2fa87018
c74311ffb965b6d9b3aae66ea5f1d36de69f28e109e4c47275cfffd7e45359f9
cda7db655983cfd177d7a89ed2180c171ab9e271cf26957a793918149c60f3f5
f20ed42503686673c0e801818cebdfc3075a9f35b3f53265b5ee4ef68e31f90a
f700076e7aa05b7928e2bad5c44aaad9c579128cda874a927d04c790c3bef65c