URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Submission: On January 16 via api from DE — Scanned from US

Summary

This website contacted 59 IPs in 3 countries across 44 domains to perform 220 HTTP transactions. The main IP is 23.220.128.204, located in Ashburn, United States and belongs to AKAMAI-AS, US. The main domain is www.trendmicro.com.
TLS certificate: Issued by Entrust Certification Authority - L1M on October 19th 2024. Valid for: a year.
This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 50 23.220.128.204 16625 (AKAMAI-AS)
8 2606:4700::68... 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
2 172.67.27.152 13335 (CLOUDFLAR...)
25 2600:9000:219... 16509 (AMAZON-02)
9 2600:1408:740... 20940 (AKAMAI-AS...)
2 2607:f8b0:400... 15169 (GOOGLE)
1 2600:1408:c40... 20940 (AKAMAI-AS...)
1 35.201.125.192 396982 (GOOGLE-CL...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
2 3.90.192.190 14618 (AMAZON-AES)
1 34.111.194.12 396982 (GOOGLE-CL...)
1 172.253.122.94 15169 (GOOGLE)
1 1 54.84.103.221 14618 (AMAZON-AES)
1 63.140.39.196 14618 (AMAZON-AES)
8 2607:f8b0:400... 15169 (GOOGLE)
2 2620:116:800b... 14618 (AMAZON-AES)
3 2607:f8b0:400... 15169 (GOOGLE)
1 2600:1408:c40... 20940 (AKAMAI-AS...)
1 1 104.16.95.80 13335 (CLOUDFLAR...)
1 1 150.70.232.194 16880 (AS2-TREND...)
2 2607:f8b0:400... 15169 (GOOGLE)
2 172.253.122.156 15169 (GOOGLE)
1 3.89.51.176 14618 (AMAZON-AES)
2 31.13.66.19 32934 (FACEBOOK)
2 23.13.172.203 16625 (AKAMAI-AS)
2 23.212.251.6 20940 (AKAMAI-AS...)
2 3.171.76.6 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 146.75.28.157 54113 (FASTLY)
1 184.25.40.134 16625 (AKAMAI-AS)
3 172.67.39.148 13335 (CLOUDFLAR...)
1 8 169.150.236.104 60068 (CDN77 Dat...)
4 107.23.123.118 14618 (AMAZON-AES)
1 2600:9000:201... 16509 (AMAZON-02)
1 3 142.251.163.154 15169 (GOOGLE)
4 142.251.167.105 15169 (GOOGLE)
4 6 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
3 2620:1ec:33::10 8075 (MICROSOFT...)
1 3.167.72.96 16509 (AMAZON-02)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 3 68.67.160.186 29990 (ASN-APPNEX)
1 2600:9000:27c... 16509 (AMAZON-02)
3 172.253.62.139 15169 (GOOGLE)
2 34.111.208.231 396982 (GOOGLE-CL...)
1 172.253.115.97 15169 (GOOGLE)
2 162.159.140.229 13335 (CLOUDFLAR...)
2 104.244.42.3 13414 (TWITTER)
2 4 64.233.180.148 15169 (GOOGLE)
4 2607:f8b0:400... 15169 (GOOGLE)
2 172.253.122.148 15169 (GOOGLE)
1 2600:1408:c40... 20940 (AKAMAI-AS...)
1 69.90.254.51 13768 (COGECO-PEER1)
2 31.13.66.35 32934 (FACEBOOK)
4 75.2.108.141 16509 (AMAZON-02)
12 23.48.203.115 20940 (AKAMAI-AS...)
1 192.28.144.124 15224 (OMNITURE)
4 3.171.76.110 16509 (AMAZON-02)
6 54.71.184.33 16509 (AMAZON-02)
1 2 15.197.193.217 16509 (AMAZON-02)
4 44.223.224.255 14618 (AMAZON-AES)
220 59
Apex Domain
Subdomains
Transfer
52 trendmicro.com
www.trendmicro.com
resources.trendmicro.com
trendmicro.com
6 MB
25 tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 1287
71 KB
21 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5650
c.6sc.co — Cisco Umbrella Rank: 6635
ipv6.6sc.co — Cisco Umbrella Rank: 5817
b.6sc.co — Cisco Umbrella Rank: 3773
eps.6sc.co — Cisco Umbrella Rank: 13280
v.eps.6sc.co — Cisco Umbrella Rank: 13786
24 KB
14 sumome.com
load.sumome.com — Cisco Umbrella Rank: 21873
sumome.com — Cisco Umbrella Rank: 20217
436 KB
13 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 45
9572106.fls.doubleclick.net
td.doubleclick.net — Cisco Umbrella Rank: 167
ad.doubleclick.net — Cisco Umbrella Rank: 155
5427711.fls.doubleclick.net — Cisco Umbrella Rank: 997723
7 KB
9 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 37
889 KB
9 scene7.com
trendmicro.scene7.com
219 KB
8 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 38
ssl.google-analytics.com — Cisco Umbrella Rank: 972
41 KB
8 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 342
203 KB
7 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 321
www.linkedin.com — Cisco Umbrella Rank: 662
px4.ads.linkedin.com — Cisco Umbrella Rank: 7068
4 KB
6 equally.ai
widget.equally.ai — Cisco Umbrella Rank: 133673
lb.prod.equally.ai — Cisco Umbrella Rank: 76472
95 KB
4 google.com
www.google.com — Cisco Umbrella Rank: 3
192 B
4 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 2632
10 KB
3 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 474
3 KB
3 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1305
insight.adsrvr.org — Cisco Umbrella Rank: 947
match.adsrvr.org — Cisco Umbrella Rank: 373
7 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 358
15 KB
3 addtoany.com
static.addtoany.com — Cisco Umbrella Rank: 4388
28 KB
3 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 26159
ibc-flow.techtarget.com — Cisco Umbrella Rank: 22652
2 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 9079
668 B
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 120
215 B
2 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 1030
1 KB
2 t.co
t.co — Cisco Umbrella Rank: 943
1 KB
2 acuityplatform.com
origin.acuityplatform.com — Cisco Umbrella Rank: 21807
e.acuityplatform.com — Cisco Umbrella Rank: 18511
3 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 2912
7 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 180
77 KB
2 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 88
24 KB
2 quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 1648
pixel.quantserve.com — Cisco Umbrella Rank: 1053
10 KB
2 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 256
trendmicro.demdex.net Failed
2 KB
2 bc0a.com
cdn.bc0a.com — Cisco Umbrella Rank: 11977
ixfd2-api.bc0a.com — Cisco Umbrella Rank: 14894
14 KB
2 youtube.com
www.youtube.com — Cisco Umbrella Rank: 79
12 KB
2 cludo.com
customer.cludo.com — Cisco Umbrella Rank: 16448
81 KB
1 mktoresp.com
605-sfw-393.mktoresp.com — Cisco Umbrella Rank: 733097
318 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 19205
281 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 17331
283 B
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 1689
448 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 1051
16 KB
1 xg4ken.com
resources.xg4ken.com — Cisco Umbrella Rank: 7939
4 KB
1 bizographics.com
sjs.bizographics.com — Cisco Umbrella Rank: 49732
17 KB
1 omtrdc.net
tmi.tt.omtrdc.net
6 KB
1 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 1590
490 B
1 gstatic.com
fonts.gstatic.com
47 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 514
310 B
1 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 417
72 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30
2 KB
220 44
Domain Requested by
50 www.trendmicro.com 1 redirects www.trendmicro.com
25 tags.tiqcdn.com www.trendmicro.com
12 b.6sc.co www.trendmicro.com
9 www.googletagmanager.com tags.tiqcdn.com
www.googletagmanager.com
www.google-analytics.com
9 trendmicro.scene7.com www.trendmicro.com
8 load.sumome.com 1 redirects www.trendmicro.com
8 cdn.cookielaw.org www.trendmicro.com
cdn.cookielaw.org
6 sumome.com load.sumome.com
www.trendmicro.com
6 www.google-analytics.com tags.tiqcdn.com
www.google-analytics.com
www.trendmicro.com
www.googletagmanager.com
5 px.ads.linkedin.com 3 redirects www.trendmicro.com
4 lb.prod.equally.ai www.trendmicro.com
4 v.eps.6sc.co www.trendmicro.com
4 td.doubleclick.net www.googletagmanager.com
4 www.google.com www.trendmicro.com
www.googletagmanager.com
4 tags.srv.stackadapt.com tags.tiqcdn.com
www.trendmicro.com
tags.srv.stackadapt.com
3 secure.adnxs.com 2 redirects www.trendmicro.com
3 bat.bing.com www.googletagmanager.com
www.trendmicro.com
3 googleads.g.doubleclick.net 1 redirects www.trendmicro.com
3 static.addtoany.com tags.tiqcdn.com
static.addtoany.com
www.trendmicro.com
2 eps.6sc.co j.6sc.co
2 epsilon.6sense.com www.trendmicro.com
2 www.facebook.com www.trendmicro.com
2 5427711.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 ad.doubleclick.net www.trendmicro.com
2 9572106.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 analytics.twitter.com www.trendmicro.com
2 t.co www.trendmicro.com
2 ibc-flow.techtarget.com www.trendmicro.com
2 widget.equally.ai tags.tiqcdn.com
widget.equally.ai
2 munchkin.marketo.net tags.tiqcdn.com
munchkin.marketo.net
2 connect.facebook.net tags.tiqcdn.com
connect.facebook.net
2 www.googleadservices.com www.trendmicro.com
2 ssl.google-analytics.com tags.tiqcdn.com
www.trendmicro.com
2 dpm.demdex.net assets.adobedtm.com
www.trendmicro.com
2 www.youtube.com www.trendmicro.com
www.youtube.com
2 customer.cludo.com www.trendmicro.com
1 match.adsrvr.org www.trendmicro.com
1 insight.adsrvr.org 1 redirects
1 pixel.quantserve.com www.trendmicro.com
1 605-sfw-393.mktoresp.com munchkin.marketo.net
1 e.acuityplatform.com www.trendmicro.com
1 ipv6.6sc.co www.trendmicro.com
1 c.6sc.co www.trendmicro.com
1 attr.ml-api.io www.trendmicro.com
1 s.ml-attr.com 1 redirects
1 js.adsrvr.org www.trendmicro.com
1 px4.ads.linkedin.com www.trendmicro.com
1 www.linkedin.com 1 redirects
1 rules.quantcount.com secure.quantserve.com
1 origin.acuityplatform.com tags.tiqcdn.com
1 static.ads-twitter.com tags.tiqcdn.com
1 trk.techtarget.com tags.tiqcdn.com
1 j.6sc.co tags.tiqcdn.com
1 resources.xg4ken.com www.trendmicro.com
1 trendmicro.com 1 redirects
1 resources.trendmicro.com 1 redirects
1 sjs.bizographics.com tags.tiqcdn.com
1 secure.quantserve.com tags.tiqcdn.com
1 tmi.tt.omtrdc.net www.trendmicro.com
1 cm.everesttech.net 1 redirects
1 fonts.gstatic.com fonts.googleapis.com
1 ixfd2-api.bc0a.com cdn.bc0a.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 cdn.bc0a.com tags.tiqcdn.com
1 assets.adobedtm.com tags.tiqcdn.com
1 fonts.googleapis.com www.trendmicro.com
0 trendmicro.demdex.net Failed www.trendmicro.com
220 67
Subject Issuer Validity Valid
www.trendmicro.com
Entrust Certification Authority - L1M
2024-10-19 -
2025-11-18
a year crt.sh
cookielaw.org
WE1
2024-12-09 -
2025-03-09
3 months crt.sh
upload.video.google.com
WR2
2024-12-09 -
2025-03-03
3 months crt.sh
customer.cludo.com
WE1
2024-12-22 -
2025-03-22
3 months crt.sh
tags.tiqcdn.com
Amazon RSA 2048 M02
2024-03-19 -
2025-04-17
a year crt.sh
*.scene7.com
DigiCert TLS RSA SHA256 2020 CA1
2024-10-09 -
2025-10-11
a year crt.sh
*.google.com
WR2
2024-12-09 -
2025-03-03
3 months crt.sh
assets.adobedtm.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-07-09 -
2025-08-09
a year crt.sh
cdn.bc0a.com
WR3
2024-12-28 -
2025-03-29
3 months crt.sh
geolocation.onetrust.com
WE1
2024-12-09 -
2025-03-09
3 months crt.sh
*.demdex.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-09-25 -
2025-10-26
a year crt.sh
ixfd-api.bc0a.com
WR3
2024-12-05 -
2025-03-05
3 months crt.sh
*.gstatic.com
WR2
2024-12-09 -
2025-03-03
3 months crt.sh
*.tt.omtrdc.net
DigiCert TLS RSA SHA256 2020 CA1
2024-02-26 -
2025-03-28
a year crt.sh
*.google-analytics.com
WR2
2024-12-09 -
2025-03-03
3 months crt.sh
quantserve.com
R11
2024-12-21 -
2025-03-21
3 months crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA
2024-07-12 -
2025-07-11
a year crt.sh
*.googleadservices.com
WR2
2024-12-09 -
2025-03-03
3 months crt.sh
*.xg4ken.com
Go Daddy Secure Certificate Authority - G2
2024-10-29 -
2025-11-30
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2024-10-25 -
2025-01-23
3 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2024-10-22 -
2025-10-24
a year crt.sh
6sc.co
R11
2024-12-20 -
2025-03-20
3 months crt.sh
equally.ai
Amazon RSA 2048 M03
2024-04-05 -
2025-05-03
a year crt.sh
trk.techtarget.com
WE1
2025-01-16 -
2025-04-16
3 months crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-06-25 -
2025-06-24
a year crt.sh
*.acuityplatform.com
DigiCert TLS RSA SHA256 2020 CA1
2024-12-05 -
2025-12-05
a year crt.sh
static.addtoany.com
WE1
2025-01-02 -
2025-04-02
3 months crt.sh
*.srv.stackadapt.com
Amazon RSA 2048 M03
2024-08-09 -
2025-09-06
a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2024-10-14 -
2025-04-14
6 months crt.sh
www.bing.com
Microsoft Azure RSA TLS Issuing CA 08
2024-12-15 -
2025-06-13
6 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2024-04-23 -
2025-05-25
a year crt.sh
ibc-flow.techtarget.com
WR3
2024-12-20 -
2025-03-20
3 months crt.sh
t.co
E6
2024-11-26 -
2025-02-24
3 months crt.sh
*.twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-10-09 -
2025-10-08
a year crt.sh
*.doubleclick.net
WR2
2024-12-09 -
2025-03-03
3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2024-02-14 -
2025-03-16
a year crt.sh
*.g.doubleclick.net
WR2
2024-12-09 -
2025-03-03
3 months crt.sh
epsilon.6sense.com
Amazon RSA 2048 M02
2024-10-02 -
2025-11-01
a year crt.sh
*.mktoresp.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-08-15 -
2025-09-15
a year crt.sh
load.sumome.com
R10
2024-12-09 -
2025-03-09
3 months crt.sh
eps.6sc.co
Amazon RSA 2048 M03
2024-08-27 -
2025-09-25
a year crt.sh
v.eps.6sc.co
Amazon RSA 2048 M03
2024-09-06 -
2025-10-05
a year crt.sh
*.sumome.com
Amazon RSA 2048 M03
2024-12-18 -
2026-01-17
a year crt.sh
*.prod.equally.ai
Sectigo RSA Domain Validation Secure Server CA
2024-11-21 -
2025-12-22
a year crt.sh

This page contains 11 frames:

Primary Page: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Frame ID: C7DA0CE15D858C619904217EDC24E9BD
Requests: 200 HTTP requests in this frame

Frame: https://trendmicro.demdex.net/dest5.html?d_nsid=0
Frame ID: FD82E9A426BF813B3BCB18FF28C313E4
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/51f0/sw_iframe.html?origin=https%3A%2F%2Fwww.trendmicro.com
Frame ID: 565D05BAC9790136FEDF2A664BE81B02
Requests: 1 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: 9C15AEB66EEF4CC66A506D5279D23742
Requests: 1 HTTP requests in this frame

Frame: https://9572106.fls.doubleclick.net/activityi;dc_pre=CMPpwoDu-YoDFd4LaAgditcawA;src=9572106;type=trend002;cat=globa0;ord=6182505795124;npa=0;auiddc=1913402742.1737017382;u1=%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html;ps=1;pcor=878722116;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe51d0v9190653197z872003116za201zb72003116;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102123607~102198178;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Frame ID: 3080381C0375566AC3CD7FEB142F9DC4
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9572106;type=trend002;cat=globa0;ord=6182505795124;npa=0;auiddc=1913402742.1737017382;u1=%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html;ps=1;pcor=878722116;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe51d0v9190653197z872003116za201zb72003116;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102123607~102198178;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Frame ID: A209B95B7299718156842CD0E1515438
Requests: 1 HTTP requests in this frame

Frame: https://5427711.fls.doubleclick.net/activityi;dc_pre=CJWxyYDu-YoDFV8MaAgdsZQztg;src=5427711;type=remar0;cat=allsi0;ord=1;num=7930024394815;npa=0;auiddc=1913402742.1737017382;u1=%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html;ps=1;pcor=639972996;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe51d0v9188098692z872003116za201zb72003116;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102123607~102198178;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Frame ID: 5B859CA07D934305A46CC5EFDA91F423
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=5427711;type=remar0;cat=allsi0;ord=1;num=7930024394815;npa=0;auiddc=1913402742.1737017382;u1=%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html;ps=1;pcor=639972996;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe51d0v9188098692z872003116za201zb72003116;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102123607~102198178;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Frame ID: C8E8468B65BCCE883B30A7657B8B5CAE
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/929919117?random=1737017382534&cv=11&fst=1737017382534&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be51d0v886840403z872003116za201zb72003116&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102123608~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html&hn=www.googleadservices.com&frm=0&tiba=Batloader%20Malware%20Abuses%20Legitimate%20Tools%20Uses%20Obfuscated%20JavaScript%20Files%20in%20Q4%202022%20Attacks%20%7C%20Trend%20Micro%20(US)&npa=0&pscdl=noapi&auid=1913402742.1737017382&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: 2F335FD1C3433F481629C83C92DE3D61
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/929919117?random=1737017382567&cv=11&fst=1737017382567&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be51d0v886840403z872003116za201zb72003116&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102123608~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html&hn=www.googleadservices.com&frm=0&tiba=Batloader%20Malware%20Abuses%20Legitimate%20Tools%20Uses%20Obfuscated%20JavaScript%20Files%20in%20Q4%202022%20Attacks%20%7C%20Trend%20Micro%20(US)&npa=0&pscdl=noapi&auid=1913402742.1737017382&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: E7F622B93F691AE9B8B0A3460260572F
Requests: 1 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/upb/?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html&upid=803df29&upv=1.1.0&paapi=1
Frame ID: 36A1406532BEC0AEED1F50C2B64B9701
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Batloader Malware Abuses Legitimate Tools Uses Obfuscated JavaScript Files in Q4 2022 Attacks | Trend Micro (US)

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc\.clientlibs/

Overall confidence: 100%
Detected patterns
  • addtoany\.com/menu/page\.js

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js

Overall confidence: 100%
Detected patterns
  • load\.sumome\.com

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

220
Requests

96 %
HTTPS

31 %
IPv6

44
Domains

67
Subdomains

59
IPs

3
Countries

8865 kB
Transfer

17093 kB
Size

73
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 73
  • https://cm.everesttech.net/cm/dd?d_uuid=08479027476172161404447148141523325933 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=Z4jIJQAAAJkskAOj
Request Chain 105
  • https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js HTTP 302
  • https://trendmicro.com/ HTTP 301
  • https://www.trendmicro.com/ HTTP 301
  • https://www.trendmicro.com/en_us/business.html
Request Chain 119
  • https://load.sumome.com/ HTTP 301
  • https://load.sumome.com/sumome.js
Request Chain 127
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=839628873&cv=9&fst=1737017381622&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=-600&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html&tiba=Batloader%20Malware%20Abuses%20Legitimate%20Tools%20Uses%20Obfuscated%20JavaScript%20Files%20in%20Q4%202022%20Attacks%20%7C%20Trend%20Micro%20(US)&hn=www.googleadservices.com&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQIIkMmxAgjTxbECCOvMsQJKJ2V2ZW50LXNvdXJjZTtuYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=IhMIj86EgO75igMVDGlHAR2hUywUMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS8 HTTP 302
  • https://www.google.com/pagead/1p-conversion/1015287688/?random=839628873&cv=9&fst=1737017381622&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=-600&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html&tiba=Batloader%20Malware%20Abuses%20Legitimate%20Tools%20Uses%20Obfuscated%20JavaScript%20Files%20in%20Q4%202022%20Attacks%20%7C%20Trend%20Micro%20(US)&hn=www.googleadservices.com&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQIIkMmxAgjTxbECCOvMsQJKJ2V2ZW50LXNvdXJjZTtuYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=IhMIj86EgO75igMVDGlHAR2hUywUMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS8&is_vtc=1&cid=CAQSGwCa7L7dvxo-yletMtOsCZozBkYstsUXSFXzew&random=1616563680&resp=GooglemKTybQhCsO
Request Chain 129
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1737017381789&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1737017381789&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D8866%26time%3D1737017381789%26url%3Dhttps%253A%252F%252Fwww.trendmicro.com%252Fen_us%252Fresearch%252F23%252Fa%252Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1737017381789&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1737017381789&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html&cookiesTest=true&liSync=true&e_ipv6=AQIFkY0n1uz_igAAAZRuTdbuZUvKaZ46Amzal6Gg9hJyNHGpMBM0PnXc8bzCeQMzTrkPJQ
Request Chain 137
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=5167236365858027990
Request Chain 152
  • https://9572106.fls.doubleclick.net/activityi;src=9572106;type=trend002;cat=globa0;ord=6182505795124;npa=0;auiddc=1913402742.1737017382;u1=%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html;ps=1;pcor=878722116;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe51d0v9190653197z872003116za201zb72003116;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102123607~102198178;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html HTTP 302
  • https://9572106.fls.doubleclick.net/activityi;dc_pre=CMPpwoDu-YoDFd4LaAgditcawA;src=9572106;type=trend002;cat=globa0;ord=6182505795124;npa=0;auiddc=1913402742.1737017382;u1=%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html;ps=1;pcor=878722116;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe51d0v9190653197z872003116za201zb72003116;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102123607~102198178;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Request Chain 158
  • https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=7930024394815;npa=0;auiddc=1913402742.1737017382;u1=%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html;ps=1;pcor=639972996;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe51d0v9188098692z872003116za201zb72003116;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102123607~102198178;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html HTTP 302
  • https://5427711.fls.doubleclick.net/activityi;dc_pre=CJWxyYDu-YoDFV8MaAgdsZQztg;src=5427711;type=remar0;cat=allsi0;ord=1;num=7930024394815;npa=0;auiddc=1913402742.1737017382;u1=%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html;ps=1;pcor=639972996;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe51d0v9188098692z872003116za201zb72003116;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102123607~102198178;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Request Chain 199
  • https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html&upid=803df29&upv=1.1.0&paapi=1 HTTP 302
  • https://match.adsrvr.org/track/upb/?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fa%2Fbatloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html&upid=803df29&upv=1.1.0&paapi=1

220 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
www.trendmicro.com/en_us/research/23/a/
164 KB
27 KB
Document
General
Full URL
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
72eaa8ec0121fac34d2e7fdd55b571cc88425b15cfd9c57eff3b5876ba8407e1
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-length
27664
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com
content-type
text/html;charset=utf-8
date
Thu, 16 Jan 2025 08:49:39 GMT
server
nginx
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-prod-n-02
Yes
x-xss-protection
1;mode=block
OtAutoBlock.js
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/
339 KB
49 KB
Script
General
Full URL
https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/OtAutoBlock.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ec6e60eccd6b2d3ff7edf499b388216646cd18d1341bef9ddb6b66148bec3f1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

content-md5
eyeKvIW5tqB8G5ZfBpfOTA==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
cf-cache-status
HIT
etag
0x8DCE8A808848BAB
age
77844
x-ms-lease-status
unlocked
x-content-type-options
nosniff
x-ms-version
2009-09-19
expires
Fri, 17 Jan 2025 08:49:39 GMT
date
Thu, 16 Jan 2025 08:49:39 GMT
content-type
application/javascript
last-modified
Wed, 09 Oct 2024 21:19:17 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin, cross-origin
x-ms-request-id
5309813e-f01e-0091-5c6e-41073b000000
cf-ray
902cda7dddb4f79b-LAX
accept-ranges
bytes
access-control-allow-origin
*
content-length
49679
x-ms-blob-type
BlockBlob
server
cloudflare
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
22 KB
8 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
52e5401f96ca9a7fc38248bf9469bdc7006f53de52d7abfec96f4a39cf665d6d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

content-md5
TR3+yr7DZCz8Fh2PJMSBjQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DD35135A74B0A0
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
23923
x-content-type-options
nosniff
date
Thu, 16 Jan 2025 08:49:39 GMT
content-type
application/javascript
last-modified
Wed, 15 Jan 2025 03:18:59 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
09abf8c2-801e-009e-2e14-67eacd000000
cf-ray
902cda7dddb8f79b-LAX
accept-ranges
bytes
access-control-allow-origin
*
content-length
7211
x-ms-blob-type
BlockBlob
server
cloudflare
jquery.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
111 KB
33 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
5e22ea5c930abbc085ab76916ce30cff31ab7aefc38bcb7dc1158b3c500303d8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
content-encoding
br
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
34015
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:39 GMT
content-type
application/javascript;charset=utf-8
last-modified
Fri, 06 Dec 2024 20:35:08 GMT
server
Akamai Resource Optimizer
x-frame-options
SAMEORIGIN
utils.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
10 KB
3 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

mpulse_cdn_cache
HIT
strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
content-encoding
br
x-content-type-options
nosniff
mpulse_origin_time
0
x-prod-n-01
Yes
content-length
3224
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:39 GMT
content-type
application/javascript;charset=utf-8
last-modified
Fri, 06 Dec 2024 10:46:36 GMT
server
Akamai Resource Optimizer
x-frame-options
SAMEORIGIN
css
fonts.googleapis.com/
28 KB
2 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::5f Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
87f3c566fded467082953eef2a96ae49cce26e2ee4d5f7dde84d95f6da5858e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 16 Jan 2025 08:49:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 16 Jan 2025 08:49:39 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Thu, 16 Jan 2025 08:41:01 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
cludo-search.min.css
customer.cludo.com/css/296/1798/
16 KB
3 KB
Stylesheet
General
Full URL
https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.27.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"0238c4e6e55d81:0"
age
68351
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 16 Jan 2025 08:49:39 GMT
content-type
text/css
last-modified
Thu, 21 Apr 2022 10:55:26 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
max-age=300
cf-ray
902cda7d7dd05307-LAX
access-control-allow-origin
*
server
cloudflare
x-lb
2
clientlib-trendresearch.min.css
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/
445 KB
41 KB
Stylesheet
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
eee32d7d7bb0e9820c6857f4780aba2d58a727d7e27113254539a2b25f0d5f7a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
content-encoding
br
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
41875
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:39 GMT
content-type
text/css;charset=utf-8
last-modified
Thu, 09 Jan 2025 19:53:07 GMT
server
Akamai Resource Optimizer
x-frame-options
SAMEORIGIN
header-footer.min.css
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/
80 KB
7 KB
Stylesheet
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
184443b46a0008a934190c2ed1df466029c704ee78f143c29497c0c38f8db835
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
content-encoding
br
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
7398
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:39 GMT
content-type
text/css;charset=utf-8
last-modified
Thu, 19 Dec 2024 19:37:34 GMT
server
Akamai Resource Optimizer
x-frame-options
SAMEORIGIN
utag.sync.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2199:5e00:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
24aae4d0655e4d68bddc5796f62020d2881d758c4a0767870167501d56390110

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

vary
accept-encoding
cache-control
max-age=300
content-encoding
br
etag
W/"1b3ed7c6531e9ffaa88189dc569bbb09"
x-amz-version-id
kehFnQtBKRw5VMar3shxabalCmlrfeE.
age
144
via
1.1 7f4d5d15a00b6ae82bb7aabc4560d3a6.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
12dNAkRO1B2Gi0ePKm31N4mGrR_KG98MSo3Lk6E2-gWqs2yZM5UAPA==
date
Thu, 16 Jan 2025 08:47:16 GMT
content-type
application/javascript
last-modified
Tue, 07 Jan 2025 23:09:01 GMT
server
AmazonS3
x-amz-cf-pop
IAD79-C1
x-amz-server-side-encryption
AES256
tm-logo-red-white-t.svg
www.trendmicro.com/content/dam/trendmicro/global/en/core/images/logos/
5 KB
3 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/core/images/logos/tm-logo-red-white-t.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4c38452d4117e2bb77829601aca27ac6584ebdf4d42ce505c0f7b1ae0f933147
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

mpulse_cdn_cache
HIT
content-encoding
gzip
etag
"154e-5f3af05760400"
x-content-type-options
nosniff
mpulse_origin_time
0
expires
Thu, 16 Jan 2025 08:51:03 GMT
server-timing
cdn-cache; desc=MISS, edge; dur=49, origin; dur=132
date
Thu, 16 Jan 2025 08:49:39 GMT
content-type
image/svg+xml
vary
Accept-Encoding
content-disposition
attachment; filename="tm-logo-red-white-t.svg"
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; preload
last-modified
Thu, 02 Feb 2023 03:18:40 GMT
cache-control
max-age=84
x-prod-n-02
Yes
accept-ranges
bytes
content-length
2173
x-xss-protection
1;mode=block
server
nginx
trend-vision-one-laptop-console-nav.svg
www.trendmicro.com/content/dam/trendmicro/global/en/core/images/console-images/navigation/
529 KB
381 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/core/images/console-images/navigation/trend-vision-one-laptop-console-nav.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d50a796a476b1fcf5c96954fd3576ff056c278490683dce6f1504a9ded73edc1
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

mpulse_cdn_cache
HIT
content-encoding
gzip
etag
"8428e-60a606b8ffa80"
x-content-type-options
nosniff
mpulse_origin_time
0
expires
Thu, 16 Jan 2025 08:50:23 GMT
server-timing
cdn-cache; desc=MISS, edge; dur=62, origin; dur=214
date
Thu, 16 Jan 2025 08:49:39 GMT
content-type
image/svg+xml
vary
Accept-Encoding
content-disposition
attachment; filename="trend-vision-one-laptop-console-nav.svg"
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; preload
last-modified
Fri, 17 Nov 2023 22:11:38 GMT
cache-control
max-age=44
x-prod-n-02
Yes
accept-ranges
bytes
content-length
389784
x-xss-protection
1;mode=block
server
nginx
asrm-console-shot
trendmicro.scene7.com/is/image/trendmicro/
14 KB
14 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/asrm-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:7400::17c7:3f60 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
Unknown /
Resource Hash
84f657435e631a1442815def2faa66eb24833b1047908ebd71275bfbef9690ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
etag
"1ac209128f661abb8a982d1bdb20d08e"
x-adobe-smart-imaging
0
expires
Thu, 16 Jan 2025 15:00:55 GMT
access-control-allow-origin
*
content-length
14534
date
Thu, 16 Jan 2025 08:49:39 GMT
akamai-grn
0.5c3fc717.1737017379.20929fa
last-modified
Wed, 04 Jan 2023 02:43:26 GMT
content-type
image/webp
server
Unknown
x-akamai-cache
Hit
xdr-product-console-shot
trendmicro.scene7.com/is/image/trendmicro/
18 KB
18 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:7400::17c7:3f60 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
Unknown /
Resource Hash
74f5da663574c88f8694494adf45161949674fcfff783f3306b0644dc2a84adb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
etag
"b3ffdce154f5ac33f90bafd0b8f52ddf"
x-adobe-smart-imaging
0
expires
Thu, 16 Jan 2025 10:12:25 GMT
access-control-allow-origin
*
content-length
18350
date
Thu, 16 Jan 2025 08:49:39 GMT
akamai-grn
0.5c3fc717.1737017379.20929fb
last-modified
Wed, 04 Jan 2023 02:43:22 GMT
content-type
image/webp
server
Unknown
x-akamai-cache
Hit
cloud-one-workload-security-console-shot
trendmicro.scene7.com/is/image/trendmicro/
20 KB
21 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-workload-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:7400::17c7:3f60 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
Unknown /
Resource Hash
da316d75d41c92dac17387c6c4e18d457cbbecb0587ed53081bb21afcb4e0e10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
etag
"fd80448de919134c924f18226b59ecd2"
x-adobe-smart-imaging
0
expires
Thu, 16 Jan 2025 17:20:36 GMT
access-control-allow-origin
*
content-length
20734
date
Thu, 16 Jan 2025 08:49:40 GMT
akamai-grn
0.5c3fc717.1737017380.2092a4d
last-modified
Wed, 04 Jan 2023 02:50:40 GMT
content-type
image/webp
server
Unknown
x-akamai-cache
Hit
cloud-one-container-console-shot
trendmicro.scene7.com/is/image/trendmicro/
22 KB
23 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-container-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:7400::17c7:3f60 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
Unknown /
Resource Hash
cd1eef6ba8780ec4e408014498fe98f8691792cc00168d4b115f1500d502a3fc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
etag
"0bd7f96f29e779fac6dc954866b8de36"
x-adobe-smart-imaging
0
expires
Thu, 16 Jan 2025 14:43:32 GMT
access-control-allow-origin
*
content-length
22816
date
Thu, 16 Jan 2025 08:49:40 GMT
akamai-grn
0.5c3fc717.1737017380.2092a4e
last-modified
Wed, 04 Jan 2023 02:43:25 GMT
content-type
image/webp
server
Unknown
x-akamai-cache
Hit
cloud-one-file-storage-console-shot
trendmicro.scene7.com/is/image/trendmicro/
10 KB
10 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-file-storage-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:7400::17c7:3f60 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
Unknown /
Resource Hash
3f95c868390ea2426ee26d756867a51141df402ab30ccc73404c16450fc10f4b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

etag
"81b7f638d5ac80cfde194124da99cc5e"
x-adobe-smart-imaging
0
expires
Thu, 16 Jan 2025 11:41:42 GMT
access-control-allow-origin
*
content-length
10478
date
Thu, 16 Jan 2025 08:49:40 GMT
akamai-grn
0.5c3fc717.1737017380.2092a4f
content-type
image/webp
last-modified
Wed, 04 Jan 2023 02:50:40 GMT
server
Unknown
x-akamai-cache
Hit
sps-mobile-security-enterprise-console-shot
trendmicro.scene7.com/is/image/trendmicro/
20 KB
20 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/sps-mobile-security-enterprise-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:7400::17c7:3f60 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
Unknown /
Resource Hash
68c21f3bfefc064bc07808b48bba6165dfc210d152ba4a6a35a567ed49151877
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
etag
"183303c0127c38a2849f7046d6cccef2"
x-adobe-smart-imaging
0
expires
Thu, 16 Jan 2025 15:01:25 GMT
access-control-allow-origin
*
content-length
19998
date
Thu, 16 Jan 2025 08:49:40 GMT
akamai-grn
0.5c3fc717.1737017380.2092a50
last-modified
Wed, 04 Jan 2023 02:50:40 GMT
content-type
image/webp
server
Unknown
x-akamai-cache
Hit
zero-trust-access-console-shot
trendmicro.scene7.com/is/image/trendmicro/
24 KB
24 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/zero-trust-access-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:7400::17c7:3f60 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
Unknown /
Resource Hash
1c580985c46f2d69e9d251c3275a031da27d8219e702677f7285ddad9134c562
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
etag
"54553bd846274282dee4b07c8fd3198b"
x-adobe-smart-imaging
0
expires
Thu, 16 Jan 2025 12:08:39 GMT
access-control-allow-origin
*
content-length
24410
date
Thu, 16 Jan 2025 08:49:40 GMT
akamai-grn
0.5c3fc717.1737017380.2092a51
last-modified
Wed, 04 Jan 2023 02:43:22 GMT
content-type
image/webp
server
Unknown
x-akamai-cache
Hit
email-security-console-shot
trendmicro.scene7.com/is/image/trendmicro/
24 KB
25 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/email-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:7400::17c7:3f60 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
Unknown /
Resource Hash
3a3abfe7b0630828bff7d1f3a6e29c316f1a432e1909877d8c713abf14e43c3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
etag
"adeabd4b80e2b5f6ab0d131473fa84c3"
x-adobe-smart-imaging
0
expires
Thu, 16 Jan 2025 16:01:10 GMT
access-control-allow-origin
*
content-length
24906
date
Thu, 16 Jan 2025 08:49:40 GMT
akamai-grn
0.5c3fc717.1737017380.2092a52
last-modified
Wed, 04 Jan 2023 02:50:40 GMT
content-type
image/webp
server
Unknown
x-akamai-cache
Hit
all-products-console-shot
trendmicro.scene7.com/is/image/trendmicro/
64 KB
64 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/all-products-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:7400::17c7:3f60 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
Unknown /
Resource Hash
293ceaa480bda1594e9f61f6a52858999cd0aad1ef4f5d3eafe7cc559727e41d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
etag
"891ae1c6af5064a7f40d8b2f96a4ea68"
x-adobe-smart-imaging
0
expires
Thu, 16 Jan 2025 16:49:10 GMT
access-control-allow-origin
*
content-length
65306
date
Thu, 16 Jan 2025 08:49:40 GMT
akamai-grn
0.5c3fc717.1737017380.2092a53
last-modified
Mon, 27 Mar 2023 00:57:09 GMT
content-type
image/webp
server
Unknown
x-akamai-cache
Hit
search-script.js
customer.cludo.com/scripts/bundles/
434 KB
77 KB
Script
General
Full URL
https://customer.cludo.com/scripts/bundles/search-script.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.27.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc76e2bacbda983fa3a199533813c1a710a6e200ca96ffe166a70fd30a48bdaa

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"05316fc5ddb1:0"
age
216
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
application/javascript
last-modified
Fri, 03 Jan 2025 16:25:22 GMT
vary
Accept-Encoding
priority
u=2,i=?0
cache-control
max-age=300
cf-ray
902cda81694c5307-LAX
access-control-allow-origin
*
server
cloudflare
x-lb
2
share-more.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/
648 B
734 B
Image
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

mpulse_cdn_cache
HIT
content-encoding
gzip
x-content-type-options
nosniff
mpulse_origin_time
0
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:59:33 GMT
server-timing
cdn-cache; desc=MISS, edge; dur=249, origin; dur=50
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/svg+xml
vary
Accept-Encoding
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; preload
cache-control
max-age=593
content-length
362
x-xss-protection
1;mode=block
server
nginx
printer.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/
409 B
651 B
Image
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

mpulse_cdn_cache
HIT
content-encoding
gzip
x-content-type-options
nosniff
mpulse_origin_time
0
expires
Thu, 16 Jan 2025 08:59:33 GMT
server-timing
cdn-cache; desc=MISS, edge; dur=29, origin; dur=52
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/svg+xml
vary
Accept-Encoding
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; preload
cache-control
max-age=593
x-prod-n-02
Yes
content-length
281
x-xss-protection
1;mode=block
server
nginx
figure1-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
231 KB
231 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure1-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d104f4a3dc6c68998694851ee2d39501ffcf5d6d17dfbab51d095a90b51555b1
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"39aea-5f25cd4396ec0"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
accept-ranges
bytes
content-length
236266
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/jpeg
last-modified
Mon, 16 Jan 2023 07:49:55 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure2-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
70 KB
70 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure2-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d43bf3f6d566ef3739d1649a8f062fd716af0a49bdb702a5a05e945c1c631f02
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"117b4-5f25cd4396ec0"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
accept-ranges
bytes
content-length
71604
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 07:49:55 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure3-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
439 KB
440 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure3-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
dfb75d237b203fc2dc1e0da6b84f91d46d2b64154a0cb1e02ae1b0c1390dfd8f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"6dca6-5f25cd457f340"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
accept-ranges
bytes
content-length
449702
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/jpeg
last-modified
Mon, 16 Jan 2023 07:49:57 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure4-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
91 KB
91 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure4-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9edfbd776662e93024424f6967ca47f2dd9404c59732d07ce2bf4513a1a07178
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"16c54-5f25cd457f340"
x-content-type-options
nosniff
expires
Thu, 16 Jan 2025 08:49:41 GMT
x-prod-n-02
Yes
accept-ranges
bytes
content-length
93268
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 07:49:57 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure5-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
71 KB
71 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure5-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
8be815521cefb2846481580d268b6398f83bd9912872381aadc960e5abd773aa
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"11a9c-5f25f11ccc280"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
accept-ranges
bytes
content-length
72348
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 10:30:18 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure6-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
51 KB
51 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure6-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
0ab3de049ac6807cef16e55327807014f53580a915c19b9de6573d50ce494309
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"ca49-5f25cd4673580"
x-content-type-options
nosniff
expires
Thu, 16 Jan 2025 08:49:41 GMT
x-prod-n-02
Yes
accept-ranges
bytes
content-length
51785
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 07:49:58 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure7-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
202 KB
202 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure7-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
8e93cca45bffb2d9ea9eefff93bfae2ef4a1be8cb972f659922119d190e24c13
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"32718-5f25cd47677c0"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
accept-ranges
bytes
content-length
206616
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/jpeg
last-modified
Mon, 16 Jan 2023 07:49:59 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure8-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
115 KB
115 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure8-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6e85465fef4d3e9f5ece15f7539ac7e1e16ca85a51759e658daedaf35ddf902b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"1ca28-5f25cd485ba00"
x-content-type-options
nosniff
expires
Thu, 16 Jan 2025 08:49:41 GMT
x-prod-n-02
Yes
accept-ranges
bytes
content-length
117288
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/jpeg
last-modified
Mon, 16 Jan 2023 07:50:00 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure9-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
108 KB
108 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure9-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6571b124f7df89a871b1705823b7423a1374e88a83d067a0ef48016ab8a9ee63
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"1ae8b-5f25f11ccc280"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
accept-ranges
bytes
content-length
110219
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 10:30:18 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure10-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
557 KB
558 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure10-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a9cf0193d01d02a18b664e63977b8c09a4a06155b4e67bcb23a2d77e21d39f12
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"8b482-5f25cd4c2c300"
x-content-type-options
nosniff
expires
Thu, 16 Jan 2025 08:49:41 GMT
x-prod-n-02
Yes
accept-ranges
bytes
content-length
570498
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 07:50:04 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure11rev-batloader-q4-abuse-legitimate-tools-javascript-files.jpg.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
190 KB
190 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure11rev-batloader-q4-abuse-legitimate-tools-javascript-files.jpg.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4ed8bb7dcdcc9dab9b0c401967b3b569d220d622e437ed3e51f81472a941658a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"2f815-5f25e80e6a4c0"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
accept-ranges
bytes
content-length
194581
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 09:49:47 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure11-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
107 KB
107 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure11-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
47280f791f7ec5edc4b159189037d4923eeb3a40ecc0761d0a90f800430aa605
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"1ab4f-5f25cd4c2c300"
x-content-type-options
nosniff
expires
Thu, 16 Jan 2025 08:49:41 GMT
x-prod-n-02
Yes
accept-ranges
bytes
content-length
109391
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/jpeg
last-modified
Mon, 16 Jan 2023 07:50:04 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure12-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
60 KB
61 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure12-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1454a3623ac9fea4cb69f09546391cc48687e29dc47552acc70ddd21ba1758d4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"f197-5f25cd4d20540"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:42 GMT
accept-ranges
bytes
content-length
61847
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:41 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 07:50:05 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure13-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
89 KB
90 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure13-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9c0ab3ed574a7b280750e7af3b37b68946ff3d13679d40fa026da8959555ef4c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"16564-5f25cd4d20540"
x-content-type-options
nosniff
expires
Thu, 16 Jan 2025 08:49:41 GMT
x-prod-n-02
Yes
accept-ranges
bytes
content-length
91492
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 07:50:05 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure14-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
249 KB
250 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure14-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c1416e8058f53a779a2fc805eacf0caac90c7531ef5176ded6f4416b19cfe91f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"3e477-5f25cd4e14780"
x-content-type-options
nosniff
expires
Thu, 16 Jan 2025 08:49:41 GMT
x-prod-n-02
Yes
accept-ranges
bytes
content-length
255095
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/jpeg
last-modified
Mon, 16 Jan 2023 07:50:06 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure15-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
110 KB
110 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure15-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6003237222e540f393f0769ae0963d7b0b605417138fd1ff609aef0d51802307
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"1b63f-5f25cd4f089c0"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
accept-ranges
bytes
content-length
112191
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/jpeg
last-modified
Mon, 16 Jan 2023 07:50:07 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure16-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
97 KB
98 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure16-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
fc9d2ff6b9da8d0347563afc64133be94400df79ed9c4add7e54490a8581a5fb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"1852d-5f25cd4f089c0"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
accept-ranges
bytes
content-length
99629
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 07:50:07 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure17-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
80 KB
80 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure17-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
70447df16699ff74ec063f22ece6b059f27c238fc2f82c0210979c0ee93186b4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"13ef9-5f25cd4ffcc00"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
accept-ranges
bytes
content-length
81657
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 07:50:08 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure18-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
1 MB
1 MB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure18-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e22af01ad29df35bff405aa88894a3bd2676d85ffce822c042fcd7524a66dca5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"103fa8-5f25cd52d92c0"
x-content-type-options
nosniff
expires
Thu, 16 Jan 2025 08:49:41 GMT
x-prod-n-02
Yes
accept-ranges
bytes
content-length
1064872
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 07:50:11 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure19-batloader-q4-abuse-legitimate-tools-javascript-files.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
499 KB
500 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure19-batloader-q4-abuse-legitimate-tools-javascript-files.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3139221aee6fb15290a3db13118f8e40d70b6687d9644c13930fe11ff1a8c499
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"7cd50-5f25cd54c1740"
x-content-type-options
nosniff
expires
Thu, 16 Jan 2025 08:49:41 GMT
x-prod-n-02
Yes
accept-ranges
bytes
content-length
511312
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 07:50:13 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure20-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
440 KB
440 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure20-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5a2fbf9733320b653937d13c97cb0c267ad19738c68a55b1414cacd9fe55f198
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"6def6-5f25cd56a9bc0"
x-content-type-options
nosniff
expires
Thu, 16 Jan 2025 08:49:41 GMT
x-prod-n-02
Yes
accept-ranges
bytes
content-length
450294
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/jpeg
last-modified
Mon, 16 Jan 2023 07:50:15 GMT
server
nginx
x-frame-options
SAMEORIGIN
figure21-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/
276 KB
277 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javascript-files-in-q4-2022-attacks/figure21-batloader-q4-abuse-legitimate-tools-javascript-files.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
36b669301f1bd7377494cb03e421f878375f4964a520d7b5c91954131229f617
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
etag
"451ec-5f25cd579de00"
x-content-type-options
nosniff
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
accept-ranges
bytes
content-length
283116
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
image/jpeg
last-modified
Mon, 16 Jan 2023 07:50:16 GMT
server
nginx
x-frame-options
SAMEORIGIN
granite.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/
4 KB
2 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
content-encoding
br
x-content-type-options
nosniff
x-prod-n-02
Yes
content-length
1422
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
application/javascript;charset=utf-8
last-modified
Tue, 10 Dec 2024 22:44:38 GMT
server
Akamai Resource Optimizer
x-frame-options
SAMEORIGIN
clientLibs.min.js
www.trendmicro.com/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/
840 B
592 B
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/clientLibs.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
898241655767777d954a01288720b8487c6bfcaf831a0243b1e19a5cc67906a3
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

mpulse_cdn_cache
HIT
strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
content-encoding
br
x-content-type-options
nosniff
mpulse_origin_time
0
x-prod-n-02
Yes
content-length
304
x-xss-protection
1;mode=block
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
application/javascript;charset=utf-8
last-modified
Thu, 05 Dec 2024 21:53:36 GMT
server
Akamai Resource Optimizer
x-frame-options
SAMEORIGIN
sly.min.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/
18 KB
7 KB
Script
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

content-encoding
br
etag
"48de-56a21837c9c00-gzip"
x-content-type-options
nosniff
expires
Sun, 19 Jan 2025 07:59:29 GMT
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
application/javascript
last-modified
Fri, 06 Dec 2024 23:17:26 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; preload
cache-control
max-age=256189
x-prod-n-02
Yes
accept-ranges
bytes
content-length
6497
x-xss-protection
1;mode=block
server
Akamai Resource Optimizer
jwplayer.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/
81 KB
23 KB
Script
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.220.128.204 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-220-128-204.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

Response headers

mpulse_cdn_cache
HIT
content-encoding
br
etag
"1457a-56a21837c9c00-gzip"
x-content-type-options
nosniff
mpulse_origin_time
0
x-prod-n-01
Yes
expires
Thu, 16 Jan 2025 08:49:41 GMT
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
application/javascript
last-modified
Fri, 06 Dec 2024 06:16:53 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; preload
cache-control
max-age=1
accept-ranges
bytes
content-length
22997
x-xss-protection
1;mode=block
server
Akamai Resource Optimizer
iframe_api
www.youtube.com/
993 B
2 KB
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c0b::88 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
abc0bbd5b809f1bb9ccc92507611893b4abf0c66134377eff4fead2b55bc5367
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

content-encoding
br
origin-trial
AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
x-content-type-options
nosniff
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
expires
Thu, 16 Jan 2025 08:49:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
date
Thu, 16 Jan 2025 08:49:40 GMT
content-type
text/javascript; charset=utf-8
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-security-policy
require-trusted-types-for 'script'
cache-control
private, max-age=0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
x-xss-protection
0
server
ESF
clientlib-trendresearch.min.js
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/
710 KB
143 KB
Script