URL User Request GET HTTP/2IP 188.114.96.1:443
CertificateIssuerGoogle Trust Services Subjectpaste.ee Fingerprint52:1C:13:18:FD:78:25:05:EC:7A:13:2A:BD:D7:DF:A6:C6:31:4C:14 ValidityFri, 18 Oct 2024 14:42:19 GMT - Thu, 16 Jan 2025 14:42:18 GMT
File typeASCII text, with very long lines (64856), with no line terminators Hash2b91cb98dd892a7bd18cb3cfe928a3dc 117053c942cd0686476c011e2d285247f9bf00bc 70e0e5649390e255547a653cdbb07ab73d1dd66d2a81f4deb2829c4fd7ec5ffe
| Analyzer | Verdict | Alert |
|---|
| urlquery | suspicious | Suspicious - Base64 encoded file | | Public Nextron YARA rules | malware | Detects an base64 encoded executable with reversed characters |
GET /d/uzzK4/0 HTTP/1.1
Host: paste.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 31 Oct 2024 17:14:54 GMT
content-type: text/plain; charset=utf-8
cache-control: max-age=2592000
strict-transport-security: max-age=63072000
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B8RrYJqJhz7sspYUA08d6tnbDoqbT84bPeoB7gzcjUuMSPUtjdiFjkMWDatbG3syaQ%2BmJHh8BzaMMNqtHm1WMD541V4zrZmqlrGOXuSRYzu6IdnraNIgQKFqXg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8db548b60cbe56cb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=22866&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3190&recv_bytes=1119&delivery_rate=258663&cwnd=254&unsent_bytes=0&cid=ef04a9b23a9da298&ts=834&x=0"
X-Firefox-Spdy: h2
|
IP188.114.96.1:443
Requested byhttps://paste.ee/d/uzzK4/0 CertificateIssuerGoogle Trust Services Subjectpaste.ee Fingerprint52:1C:13:18:FD:78:25:05:EC:7A:13:2A:BD:D7:DF:A6:C6:31:4C:14 ValidityFri, 18 Oct 2024 14:42:19 GMT - Thu, 16 Jan 2025 14:42:18 GMT
File typeHTML document, ASCII text, with no line terminators Hash2b838659c6ea3bbc1241837a1b44840b 296c38b80b7304bd14e5b6c934fca1c32d687917 a9ac287e62f49a385bf05052b658eea54ad6811b368db66f58b581a61435c9ff
GET /favicon.ico HTTP/1.1
Host: paste.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://paste.ee/d/uzzK4/0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Thu, 31 Oct 2024 17:14:55 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OFvsb0jzIgAn2tGUil3crIxojhIc17vpOFWQVmZhe2kRrXheTPyvSyKZBXhZEPoVXwiw%2BvR14MK5EG9KREM0wLvnDKhCESjpVQDbu74%2FnyNBhlKm6cg28tDuQg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8db548bd6d9c5694-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19138&sent=11&recv=6&lost=0&retrans=0&sent_bytes=4079&recv_bytes=1090&delivery_rate=32727&cwnd=12000&unsent_bytes=0&cid=9a11b7451857761f&ts=1110&x=1", cfHdrFlush;dur=0
|
104.21.84.67