| hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt |  168.119.39.36 | 200 OK | 2.1 kB |
URL User Request GET HTTP/2hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt IP168.119.39.36:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subjecthyp3rlinx.altervista.org Fingerprint90:33:5B:0D:25:17:6F:8C:F3:4B:DE:B0:AB:51:DA:82:FD:A0:8A:75 ValidityTue, 09 Apr 2024 23:18:53 GMT - Mon, 08 Jul 2024 23:18:52 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash760d34d27907d85da6b967755998c077 dfc08ebcdd65a26604f38e600c28f29e25f7ba50 e49fe2a451129a3e957563f2b51fa457e1873c73eebce783ed49e72af4d4660c
| Analyzer | Verdict | Alert |
|---|
| Public Nextron YARA rules | malware | Detects MSHTA Bypass |
GET /advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt HTTP/1.1
Host: hyp3rlinx.altervista.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Tue, 11 Jan 2022 02:08:16 GMT
etag: "11e5-5d544ed1ac400-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 2057
content-type: text/plain
date: Wed, 24 Apr 2024 03:08:54 GMT
server: Apache
X-Firefox-Spdy: h2
|
| hyp3rlinx.altervista.org/favicon.ico | 168.119.39.36 | 302 Found | 0 B |
URL GET HTTP/2hyp3rlinx.altervista.org/favicon.ico IP168.119.39.36:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt CertificateIssuerLet's Encrypt Subjecthyp3rlinx.altervista.org Fingerprint90:33:5B:0D:25:17:6F:8C:F3:4B:DE:B0:AB:51:DA:82:FD:A0:8A:75 ValidityTue, 09 Apr 2024 23:18:53 GMT - Mon, 08 Jul 2024 23:18:52 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: hyp3rlinx.altervista.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
location: https://im.altervista.org/favicon.ico
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 24 Apr 2024 03:08:54 GMT
server: Apache
X-Firefox-Spdy: h2
|
| im.altervista.org/favicon.ico |  54.230.111.121 | 200 OK | 22 kB |
URL GET HTTP/2im.altervista.org/favicon.ico IP54.230.111.121:443
Requested byhttps://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt CertificateIssuerAmazon Subjectim.altervista.org Fingerprint90:C7:D6:C8:14:F8:46:20:60:4E:BA:D0:1A:88:72:BC:B3:A2:29:5F ValidityMon, 08 Jan 2024 00:00:00 GMT - Wed, 05 Feb 2025 23:59:59 GMT
File typeMS Windows icon resource - 3 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel Hash10267d81bcabcd1486c7827a4c7ed5f4 4f274c2e2f6de9a642cfcdaca3519ddd20562718 f31b4f31a2ed254cee1e3d17e4dcef59f2ea7bb4a44c16e94a4e6af5524c58d6
GET /favicon.ico HTTP/1.1
Host: im.altervista.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://hyp3rlinx.altervista.org/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/x-icon
content-length: 22382
server: nginx
last-modified: Wed, 09 Feb 2022 14:23:38 GMT
accept-ranges: bytes
date: Wed, 24 Apr 2024 02:03:25 GMT
etag: "6203ce6a-576e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 4c07121ca6e32bcda85cc9091b92050e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: N8DNViS9-T-M538ijDdP5YUxEKzsc1APL5_ApuyZwaE6kitJyr7flA==
age: 3930
X-Firefox-Spdy: h2
|