Report - firebasestorage.googleapis.com/v0/b/order-8abf4.appspot.com/o/transfer.txt?alt=media&token=7e85ea5f-0b89-4136-a3c7-c100a48c638e

Report Overview

Visited public
2023-12-06 08:17:19
Tags
URL
firebasestorage.googleapis.com/v0/b/order-8abf4.appspot.com/o/transfer.txt?alt=media&token=7e85ea5f-0b89-4136-a3c7-c100a48c638e
Finishing URL
firebasestorage.googleapis.com/v0/b/order-8abf4.appspot.com/o/transfer.txt?alt=media&token=7e85ea5f-0b89-4136-a3c7-c100a48c638e
IP / ASN
142.250.74.42
#15169 GOOGLE
Title
firebasestorage.googleapis.com/v0/b/order-8abf4.appspot.com/o/transfer.txt?alt=media&token=7e85ea5f-0b89-4136-a3c7-c100a48c638e
Suspicious - Base64 encoded file

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
firebasestorage.googleapis.com	9937	2005-01-25	2017-01-30 03:42:50	2023-12-05 09:39:14	1.2 kB	324 kB	142.250.74.10

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2023-12-06	medium	firebasestorage.googleapis.com/v0/b/order-8abf4.appspot.com/o/transfer.txt?alt=media&token=7e85ea5f-0b89-4136-a3c7-c100a48c638e	Detects an base64 encoded executable with reversed characters

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
firebasestorage.googleapis.com/v0/b/order-8abf4.appspot.com/o/transfer.txt?alt=media&token=7e85ea5f-0b89-4136-a3c7-c100a48c638e
IP
142.250.74.10
ASN
#15169 GOOGLE

File type
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections\012- data
Size
241 kB (240640 bytes)
Hash
086b1e5538e8ff78a8f35370f86d3baa
febd3e2495aae66f0970a462a938f008f05d0524
1e6c30098543d8b1bc521e4803800e10621de6328d0185303443f8d586ddd148

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 56/72

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

firebasestorage.googleapis.com/v0/b/order-8abf4.appspot.com/o/transfer.txt?alt=media&token=7e85ea5f-0b89-4136-a3c7-c100a48c638e

142.250.74.10

200 OK

321 kB

URL User Request GET HTTP/2
firebasestorage.googleapis.com/v0/b/order-8abf4.appspot.com/o/transfer.txt?alt=media&token=7e85ea5f-0b89-4136-a3c7-c100a48c638e
IP
142.250.74.10:443
ASN
#15169 GOOGLE

Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
321 kB (320856 bytes)
Hash
4936263994c45f4c57205b5fa65ffe4b
477f068748da95af1b19ae19018f8ba35c062d59
33feba1546c2ec816c8259dccc89b2dbacd2fe78f688ea6c051c3bce2b85fea7

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Base64 encoded file
Public Nextron YARA rules	malware	Detects an base64 encoded executable with reversed characters

HTTP Headers

GET /v0/b/order-8abf4.appspot.com/o/transfer.txt?alt=media&token=7e85ea5f-0b89-4136-a3c7-c100a48c638e HTTP/1.1
Host: firebasestorage.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-guploader-uploadid: ABPtcPpJHDijfdOYkWt3ZrB5nlaTnYZkTOx8n-vKeLSuHW4EwKBpqCXLYHgPEp4-SwnR4Fa4yAE
expires: Wed, 06 Dec 2023 08:17:02 GMT
date: Wed, 06 Dec 2023 08:17:02 GMT
cache-control: private, max-age=0
last-modified: Wed, 08 Nov 2023 22:54:51 GMT
etag: "4936263994c45f4c57205b5fa65ffe4b"
x-goog-generation: 1699484091617898
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 320856
x-goog-meta-firebasestoragedownloadtokens: 7e85ea5f-0b89-4136-a3c7-c100a48c638e
content-type: text/plain
content-disposition: inline; filename*=utf-8''transfer.txt
x-goog-hash: crc32c=+RTiYQ==, md5=STYmOZTEX0xXIFtfpl/+Sw==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 320856
server: UploadServer
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

firebasestorage.googleapis.com/favicon.ico

142.250.74.10

404 Not Found

1.6 kB

URL GET HTTP/3
firebasestorage.googleapis.com/favicon.ico
IP
142.250.74.10:443
ASN
#15169 GOOGLE

Requested by
https://firebasestorage.googleapis.com/v0/b/order-8abf4.appspot.com/o/transfer.txt?alt=media&token=7e85ea5f-0b89-4136-a3c7-c100a48c638e
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1136)
Size
1.6 kB (1572 bytes)
Hash
13fec0c2fbf5c47c4608ce0c9405e5a7
dafb6ca27cfd22e88a2d53150c4350fca3d32a21
7f25fd0260c4ef8c26a87a5a126634e846ba539c75e5d508103f4d98831654a5

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: firebasestorage.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://firebasestorage.googleapis.com/v0/b/order-8abf4.appspot.com/o/transfer.txt?alt=media&token=7e85ea5f-0b89-4136-a3c7-c100a48c638e
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 404 Not Found
date: Wed, 06 Dec 2023 08:17:02 GMT
content-type: text/html; charset=UTF-8
server: ESF
content-length: 1572
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers