| deb43e46-145f-4ebd-abfb-69a78b67bacf.usrfiles.com/ugd/deb43e_9998f980f0894b74a63a80736b23f1b8.txt |  54.230.111.109 | 200 OK | 1.4 MB |
URL User Request GET HTTP/2deb43e46-145f-4ebd-abfb-69a78b67bacf.usrfiles.com/ugd/deb43e_9998f980f0894b74a63a80736b23f1b8.txt IP54.230.111.109:443
CertificateIssuerSectigo Limited Subject*.usrfiles.com Fingerprint15:F4:65:90:B4:A0:48:C6:7D:B3:74:65:0C:F1:AF:70:66:E6:AD:40 ValidityWed, 26 Jul 2023 00:00:00 GMT - Mon, 22 Jan 2024 23:59:59 GMT
File typeASCII text, with very long lines (65536), with no line terminators Size1.4 MB (1430092 bytes) Hash61b2efe23b6e3361efa3f16a24fb0eff a03499a6c38b0d30a583dc1e99191b539f3f2981 53a4a77d3f5755e9cb75f938543b5d2fc08af9cf37dba9e8886735a19112907d
| Analyzer | Verdict | Alert |
|---|
| urlquery | suspicious | Suspicious - Base64 encoded file | | Public Nextron YARA rules | malware | Detects an base64 encoded executable with reversed characters |
GET /ugd/deb43e_9998f980f0894b74a63a80736b23f1b8.txt HTTP/1.1
Host: deb43e46-145f-4ebd-abfb-69a78b67bacf.usrfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/plain
content-length: 1430092
server: openresty/1.21.4.1
date: Wed, 29 Nov 2023 14:55:17 GMT
expires: Wed, 29 Nov 2023 15:55:17 GMT
cache-control: public, max-age=15552000, immutable
last-modified: Mon, 01 Nov 2021 13:41:07 GMT
etag: "61b2efe23b6e3361efa3f16a24fb0eff"
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: Content-Length
timing-allow-origin: *
x-seen-by: gcp.us-central-1.media-router-f89dc7b48-7t52j
x-robots-tag: noindex, nofollow
via: 1.1 google, 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: xFw8SoO3wjvmpYouQvcOr2bFbo-HwrvuP56CjwYP1rfGYDK9NtoPhQ==
X-Firefox-Spdy: h2
|
| deb43e46-145f-4ebd-abfb-69a78b67bacf.usrfiles.com/favicon.ico | 54.230.111.109 | 403 Forbidden | 9 B |
URL GET HTTP/3deb43e46-145f-4ebd-abfb-69a78b67bacf.usrfiles.com/favicon.ico IP54.230.111.109:443
Requested byhttps://deb43e46-145f-4ebd-abfb-69a78b67bacf.usrfiles.com/ugd/deb43e_9998f980f0894b74a63a80736b23f1b8.txt CertificateIssuerSectigo Limited Subject*.usrfiles.com Fingerprint15:F4:65:90:B4:A0:48:C6:7D:B3:74:65:0C:F1:AF:70:66:E6:AD:40 ValidityWed, 26 Jul 2023 00:00:00 GMT - Mon, 22 Jan 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hash722969577a96ca3953e84e3d949dee81 3dab5f6012e3e149b5a939b9cebba4a0b84dc8f5 78342a0905a72ce44da083dcb5d23b8ea0c16992ba2a82eece97e033d76ba3d3
GET /favicon.ico HTTP/1.1
Host: deb43e46-145f-4ebd-abfb-69a78b67bacf.usrfiles.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://deb43e46-145f-4ebd-abfb-69a78b67bacf.usrfiles.com/ugd/deb43e_9998f980f0894b74a63a80736b23f1b8.txt
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
content-type: text/plain
content-length: 9
alt-svc: h3=":443"; ma=86400
server: openresty/1.21.4.1
date: Wed, 29 Nov 2023 14:55:19 GMT
access-control-allow-origin: *
cache-control: no-cache, private, must-revalidate, proxy-revalidate, no-store
timing-allow-origin: *
x-seen-by: gcp.us-central-1.media-router-f89dc7b48-5vjmg
via: 1.1 google, 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
x-cache: Error from cloudfront
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: RqsI9bpP9tB083u1XWuQBxBEGJhbBeeX1kkjRtqSbdM_JkGrheunDg==
|