blog.reversinglabs.com Open in urlscan Pro
2606:2c40::c73c:67e1 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Submission: On July 03 via api (July 3rd 2022, 12:34:22 pm UTC) from DE — Scanned from DE

Summary HTTP 88 Redirects Links 59 Behaviour Indicators

Summary

This website contacted 37 IPs in 2 countries across 31 domains to perform 88 HTTP transactions. The main IP is 2606:2c40::c73c:67e1, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is blog.reversinglabs.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 7th 2022. Valid for: a year.

This is the only time blog.reversinglabs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
30	2606:2c40::c7... 2606:2c40::c73c:67e1	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
2	2a02:26f0:350... 2a02:26f0:3500:16::215:149b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6811:f3cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2606:4700:440... 2606:4700:4400::6812:2128	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	108.138.15.119 108.138.15.119	16509 (AMAZON-02) (AMAZON-02)
1	65.9.66.24 65.9.66.24	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
2	63.134.242.129 63.134.242.129	14992 (CRYSTALTECH) (CRYSTALTECH)
3	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1 1	54.192.235.25 54.192.235.25	16509 (AMAZON-02) (AMAZON-02)
1	184.73.136.239 184.73.136.239	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
4	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2001:4860:480... 2001:4860:4802:34::178	15169 (GOOGLE) (GOOGLE)
1	199.232.188.157 199.232.188.157	54113 (FASTLY) (FASTLY)
3 3	2620:1ec:22::14 2620:1ec:22::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
1	104.244.42.136 104.244.42.136	13414 (TWITTER) (TWITTER)
1	2606:4700::68... 2606:4700::6811:ebcc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:83ab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:45b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:21ab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:e7cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:70b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5505	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:cacc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6813:9a53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
88	37

30 2606:2c40::c73c:67e1 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

blog.reversinglabs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:f3cc (United States)

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700:4400::6812:2128 (United States)

ASN13335 (CLOUDFLARENET, US)

3375217.fs1.hubspotusercontent-na1.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

cookieinfoscript.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.15.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-15-119.fra56.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.66.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-24.fra56.r.cloudfront.net

vidassets.terminus.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.134.242.129 (United States)

ASN14992 (CRYSTALTECH, US)
PTR: www.visitortracklog.com

code.visitor-track.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 15.197.193.217 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.192.235.25 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-54-192-235-25.otp50.r.cloudfront.net

wec-assets.terminus.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.73.136.239 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-184-73-136-239.compute-1.amazonaws.com

wec-assets-api.terminus.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:34::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.188.157 (Munich, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:22::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.136 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:ebcc (United States)

ASN13335 (CLOUDFLARENET, US)

js.usemessages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:83ab (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:45b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:21ab (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:e7cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:70b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5505 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:cacc (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	reversinglabs.com blog.reversinglabs.com	584 KB
8	hubspotusercontent-na1.net 3375217.fs1.hubspotusercontent-na1.net	220 KB
5	hubspot.com app.hubspot.com — Cisco Umbrella Rank: 5854 forms.hubspot.com — Cisco Umbrella Rank: 3073 track.hubspot.com — Cisco Umbrella Rank: 2144	5 KB
5	gstatic.com fonts.gstatic.com	80 KB
5	linkedin.com 3 redirects platform.linkedin.com — Cisco Umbrella Rank: 2750 px.ads.linkedin.com — Cisco Umbrella Rank: 395 www.linkedin.com — Cisco Umbrella Rank: 485 px4.ads.linkedin.com — Cisco Umbrella Rank: 5675	163 KB
4	twitter.com platform.twitter.com — Cisco Umbrella Rank: 677 analytics.twitter.com — Cisco Umbrella Rank: 516 syndication.twitter.com — Cisco Umbrella Rank: 869	134 KB
4	adsrvr.org js.adsrvr.org — Cisco Umbrella Rank: 1332 match.adsrvr.org — Cisco Umbrella Rank: 367 insight.adsrvr.org — Cisco Umbrella Rank: 594	3 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 49	20 KB
3	terminus.services 1 redirects vidassets.terminus.services — Cisco Umbrella Rank: 12849 wec-assets.terminus.services — Cisco Umbrella Rank: 13420 wec-assets-api.terminus.services — Cisco Umbrella Rank: 13371	12 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 155	88 KB
2	visitor-track.com code.visitor-track.com — Cisco Umbrella Rank: 53743	983 B
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 89	97 KB
1	google.de www.google.de — Cisco Umbrella Rank: 5448	548 B
1	google.com www.google.com — Cisco Umbrella Rank: 8	548 B
1	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 54	2 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 126	15 KB
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 3680	924 B
1	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 4450	516 B
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3409	3 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 4068	88 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2069	16 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2061	20 KB
1	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 5004	25 KB
1	usemessages.com js.usemessages.com — Cisco Umbrella Rank: 4780	21 KB
1	t.co t.co — Cisco Umbrella Rank: 455	337 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 632	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 780	3 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 71	1 KB
1	cookieinfoscript.com cookieinfoscript.com — Cisco Umbrella Rank: 76985	4 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 231	28 KB
1	hubspot.net cdn2.hubspot.net — Cisco Umbrella Rank: 6870	2 KB
88	31

	Domain	Requested by
30	blog.reversinglabs.com	blog.reversinglabs.com js.usemessages.com
8	3375217.fs1.hubspotusercontent-na1.net	blog.reversinglabs.com
5	fonts.gstatic.com	fonts.googleapis.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	track.hubspot.com
2	insight.adsrvr.org	js.adsrvr.org
2	forms.hubspot.com	js.hscollectedforms.net js.hsleadflows.net
2	px.ads.linkedin.com	2 redirects
2	platform.twitter.com	blog.reversinglabs.com platform.twitter.com
2	connect.facebook.net	blog.reversinglabs.com connect.facebook.net
2	code.visitor-track.com	blog.reversinglabs.com code.visitor-track.com
2	www.googletagmanager.com	blog.reversinglabs.com js.hsadspixel.net
1	www.google.de
1	www.google.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	www.googletagmanager.com
1	api.hubapi.com	js.hsadspixel.net
1	forms.hsforms.com	blog.reversinglabs.com
1	js.hsadspixel.net	blog.reversinglabs.com
1	js.hsleadflows.net	blog.reversinglabs.com
1	js.hs-banner.com	blog.reversinglabs.com
1	js.hs-analytics.net	blog.reversinglabs.com
1	js.hscollectedforms.net	blog.reversinglabs.com
1	js.usemessages.com	blog.reversinglabs.com
1	syndication.twitter.com	platform.twitter.com
1	analytics.twitter.com	blog.reversinglabs.com
1	t.co	blog.reversinglabs.com
1	px4.ads.linkedin.com	blog.reversinglabs.com
1	www.linkedin.com	1 redirects
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	app.hubspot.com	blog.reversinglabs.com
1	wec-assets-api.terminus.services	blog.reversinglabs.com
1	wec-assets.terminus.services	1 redirects
1	match.adsrvr.org	blog.reversinglabs.com
1	fonts.googleapis.com	blog.reversinglabs.com
1	vidassets.terminus.services	blog.reversinglabs.com
1	js.adsrvr.org	blog.reversinglabs.com
1	cookieinfoscript.com	blog.reversinglabs.com
1	cdnjs.cloudflare.com	blog.reversinglabs.com
1	cdn2.hubspot.net	blog.reversinglabs.com
1	platform.linkedin.com	blog.reversinglabs.com
88	42

This site contains links to these domains. Also see Links.

Domain
www.reversinglabs.com
register.reversinglabs.com
support.reversinglabs.com
rli.reversinglabs.com
www.secure.software
www.bleepingcomputer.com
bazaar.abuse.ch
www.trendmicro.com
twitter.com
blog.cyble.com
www.linkedin.com
www.facebook.com
www.instagram.com
www.youtube.com
cookieinfoscript.com

Subject Issuer	Validity	Valid
blog.reversinglabs.com Cloudflare Inc ECC CA-3	`2022-05-07` - `2023-05-07`	a year	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2022-06-09` - `2023-06-09`	a year	crt.sh
hubspot.net Cloudflare Inc ECC CA-3	`2022-05-06` - `2023-05-06`	a year	crt.sh
hubspotusercontent-na1.net Cloudflare Inc ECC CA-3	`2022-02-24` - `2023-02-23`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.terminus.services Amazon	`2021-11-16` - `2022-12-14`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.visitor-track.com Sectigo RSA Domain Validation Secure Server CA	`2021-09-20` - `2022-10-20`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-04-11` - `2022-07-10`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-20` - `2022-10-19`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2022-03-08` - `2023-03-07`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
syndication.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2022-05-07` - `2023-05-07`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Frame ID: 0C18B50EB0640854C7F94E5C39CB051F
Requests: 85 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.d7fc2fc075c61f6fa34d79a0cbbf1e34.html?origin=https%3A%2F%2Fblog.reversinglabs.com
Frame ID: 5946488A60BA9009EAF1A1B1FAE918D5
Requests: 2 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&upid=8t4axvj&upv=1.1.0
Frame ID: 524C1B6721FFA2E6405243C105D26FE2
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&upid=8t4axvj&upv=1.1.0
Frame ID: 02CAFD32E981AC0DB2D6CEB5A0AC20F8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Smash-and-grab: AstraLocker 2.0 pushes ransomware direct from Office docs

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Lightbox (JavaScript Libraries) Expand

Linkedin (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.linkedin\.com/in\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

88
Requests

98 %
HTTPS

68 %
IPv6

31
Domains

42
Subdomains

37
IPs

2
Countries

1649 kB
Transfer

3724 kB
Size

25
Cookies

59 Outgoing links

These are links going to different origins than the main page.

URL: https://www.reversinglabs.com/reports/flying-blind-software-firms-struggle-to-detect-supply-chain-hacks
Title: Download the report

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/sboms-securing-software-supply-chains
Title: SBOM: Software Security

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/manage-3rd-party-software-risks
Title: Verify Software Supply Chain

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/secure-software-release-processes
Title: Secure Software Build & Release

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/triage-alerts-faster
Title: Triage

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/automate-incident-response
Title: Incident Response

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/siem-soar-automated-static-analysis
Title: SIEM/SOAR

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/ransomware-feed
Title: Ransomware Feed

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/advance-your-malware-lab
Title: Malware Lab

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/hunt-threats-continuously
Title: Threat Hunting

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/sandbox-malware-analysis
Title: Sandbox

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/phishing-attack-prevention
Title: Email

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/edr-malware-detection-integration
Title: EDR

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/solutions/threat-intelligence-integration
Title: Threat Intelligence Platforms

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/products/malware-analysis-platform
Title: Titanium Platform

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/products/software-supply-chain-security
Title: ReversingLabs secure.software

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/products/file-reputation-service
Title: ReversingLabs Threat Intelligence

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/products/malware-threat-hunting-and-investigations
Title: ReversingLabs Threat Analysis & Hunting

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/products/enterprise-scale-file-anlaysis-software
Title: ReversingLabs Elastic Threat Infrastructure

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/products/open-source-yara-rules
Title: Free: Open-Source YARA

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/why-choose-reversinglabs
Title: Why Us

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/reseller-partners
Title: Reseller Partners

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/integration-partners
Title: Integration Partners

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/security-vendors
Title: Security Partners

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/resources
Title: Content

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/conversinglabs
Title: ConversingLabs Podcast

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/demo-videos
Title: Demo Videos

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/learning-with-reversinglabs
Title: Learning with ReversingLabs

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/reversinglabs-threat-intelligence-quiz
Title: Threat Intelligence Quiz

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/company/about-us
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/company/leadership
Title: Leadership

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/company/careers
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/crosspoint-capital-leads-investment-in-software-security-pioneer-reversinglabs
Title: Series B Investment

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/webinars
Title: Webinars

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/events
Title: Events

Search URL Search Domain Scan URL

URL: https://register.reversinglabs.com/ciso-cyber-talk-with-aflac
Title: CISO Cyber Talks

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/rsa-conference-2022
Title: RSA Conference

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/newsroom/press-releases
Title: Press Releases

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/newsroom/news
Title: In the News

Search URL Search Domain Scan URL

URL: https://register.reversinglabs.com/demo
Title: Demo

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/contact-us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://support.reversinglabs.com/hc/en-us/restricted
Title: Support

Search URL Search Domain Scan URL

URL: https://rli.reversinglabs.com/accounts/login/
Title: Login

Search URL Search Domain Scan URL

URL: https://www.secure.software/
Title: secure.software

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/babuk-ransomwares-full-source-code-leaked-on-hacker-forum/
Title: leak of the Babuk ransomware in September 2021

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/dc-police-confirms-cyberattack-after-ransomware-gang-leaks-data/
Title: ransomware attack and data leak

Search URL Search Domain Scan URL

URL: https://bazaar.abuse.ch/browse/signature/AstraLocker/
Title: AstraLocker 2.0

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/en_us/research/21/h/chaos-ransomware-a-dangerous-proof-of-concept.html
Title: Chaos

Search URL Search Domain Scan URL

URL: https://twitter.com/BruteBee/status/1428705093873020930
Title: Ransomware

Search URL Search Domain Scan URL

URL: https://blog.cyble.com/2021/07/05/deep-dive-into-builder-of-notorious-babuk-ransomware/
Title: this article

Search URL Search Domain Scan URL

URL: https://twitter.com/reversinglabs
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/reversinglabs
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.facebook.com/reversinglabs
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/reversinglabs
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/reversinglabs
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.reversinglabs.com/cookie-policy
Title: Cookies

Search URL Search Domain Scan URL

URL: https://cookieinfoscript.com/
Title: cookie script

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 48

https://wec-assets.terminus.services/492173fc-4b58-46c9-a3cc-09a5abedb64b/t.gif?d=5acd0994-6638-4fd9-bed0-5dfdcbe2eb14&s=e3c8e5c7-407a-4fae-81f5-c104e919922a&p=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&cb=1656851656890&t=Smash-and-grab%3A%20AstraLocker%202.0%20pushes%20ransomware%20direct%20from%20Office%20docs&r=&e=page_viewed&u=2d8e570b-ad7f-497b-abd0-eda6b4f8bd89-1656851656890 HTTP 301
https://wec-assets-api.terminus.services/v1/492173fc-4b58-46c9-a3cc-09a5abedb64b/t.gif

Request Chain 59

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1656851657014&url=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1656851657014%26url%3Dhttps%253A%252F%252Fblog.reversinglabs.com%252Fblog%252Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1656851657014&url=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1656851657014&url=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&liSync=true&e_ipv6=AQJbvhYed3xP1gAAAYHEDfK7m8Sy80ZT54LsXw6XArU9rButNhVcY4RvFehv_YZMjUPryFDT

88 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs Show response
blog.reversinglabs.com/blog/ 71 KB
18 KB 101ms
53ms Document
text/html 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / HubSpot

Resource Hash

7ce75ed03aa6183977e623ebe11ac60f1bc0dab6da76cc6e7fb7076abe1209a9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: s-maxage=14400, max-age=0
cf-h2-pushed: </hs/hsstatic/HubspotToolsMenu/static-1.128/js/index.js>,</hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>
cf-ray: 724fa782c9c15b4a-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Sun, 03 Jul 2022 12:34:16 GMT
edge-cache-tag: CT-77621377326,CG-3375217,CG-5901382633,P-3375217,L-11118979719,L-11735000539,CW-10782554896,CW-11119297579,CW-11395370497,CW-11538883136,CW-23776629869,CW-23799638916,CW-28186900061,CW-6520974104,CW-8287382372,E-10528761402,E-10777459487,E-11119463588,E-11190015046,E-11395370929,E-11395383304,E-11708570900,E-21052151416,E-23712622487,E-28203361861,E-38216899954,E-5951651806,E-6021532803,E-6021916068,E-6519964395,PGS-ALL,SW-1,B-5901382633,GC-25875947801,GC-25876057703,GC-26129507391,GC-28186555742
etag: W/"25ce132e22579a0922b76c3565837db8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Sat, 02 Jul 2022 17:06:16 GMT
link: </hs/hsstatic/HubspotToolsMenu/static-1.128/js/index.js>; rel=preload; as=script,</hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tnce6k32E6xzoIQXKxajiWIngf1Anj%2BpGYKRUAMetE09hGJw5U%2FrYcXiU9A7Ugjm0GiPxib2Wc6mn81jf6ExlB9h6KOcKAKh2FFECLeL3jyIywXdQJGCv%2BRI9lmgv4d2%2BfVoyK%2FUNu0YtRN1020hf4q5QT8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-hs-cache-config: BrowserCache-5s-EdgeCache-180s
x-hs-cache-control: s-maxage=14400, max-age=0
x-hs-cf-cache-status: HIT
x-hs-combine-css: Disabled
x-hs-content-campaign-id: f7bff4f7-cfe3-4758-bd25-632f1a21a806
x-hs-content-id: 77621377326
x-hs-hub-id: 3375217
x-hs-prerendered: Sat, 02 Jul 2022 17:06:16 GMT
x-powered-by: HubSpot

GET
H2 200 index.js Show response
blog.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.128/js/ 11 KB
4 KB 43ms
0ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.128/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8b8c8146d6359d62410c5da0c4573717f95f8a2e79fcdf1c3ab242a70d10488

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 347732911156afff87ff95b6d55b9278.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 7773599
x-amz-server-side-encryption: AES256
cf-ray: 724fa78309fd5b4a-FRA
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-encoding: br
last-modified: Fri, 25 Mar 2022 12:04:14 GMT
server: cloudflare
etag: W/"fabb1243bed29fd93cc5e0ce02ce9114"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GX14oqMsVqVDjWXBpO4iaPvfrGc3JI6j1I%2FQhFFWzphCMZsNl86uMAPUO8HqNjiu0CEfaOmJXe1zGjmG5pEvsqoXuBVdql4%2Bwzx0xW9Xo0M%2BXJ12WmJUBGVGTV8SsVd%2BCpxai4uamJkWn%2FmMK6%2FBipBSuIU%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: ye98kzU383wl95_ydpYD.3IraNY6l134
cache-control: public, max-age=31536000
x-amz-cf-pop: DUS51-P2
content-type: application/javascript
x-amz-cf-id: IEE9ZmbJgF53I0lPlIN-GxbmpLUEFckYurqYcNnudXdWCydPJuYhBw==
expires: Mon, 03 Jul 2023 12:34:16 GMT

GET
H2 200 project.js Show response
blog.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
1 KB 30ms
0ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 6642832e0f3e501fb9fdc5f35d4351d8.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 9255843
x-amz-server-side-encryption: AES256
cf-ray: 724fa78309fe5b4a-FRA
x-cache: RefreshHit from cloudfront
x-amz-replication-status: COMPLETED
content-encoding: br
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
server: cloudflare
etag: W/"61ca66de658cab9587e4636894680d5d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7edrJuvfnzYhK79nZUK%2FOzY0tEx7%2Fx1usQ4%2B%2FzJVI5Wh%2F%2ByWoCn%2F0Vl9c2GQPe3%2FMlPVTZ%2BbKby45zFrVPxqEXlnGxmBbClteVXDpWjc6LWMPpAjgwDLb%2FyfqqoAh86jVTf4%2FHr1Gr0FLN8Nii6H9JMxQwc%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
cache-control: public, max-age=31536000
x-amz-cf-pop: AMS54-C1
content-type: application/javascript
x-amz-cf-id: QGpm7pNuMeHHjdOSQvVabr4yyJkQjvNfrf7wMr7R3QfV9nZTL386XA==
expires: Mon, 03 Jul 2023 12:34:16 GMT

GET
H2 200 stickybar.min.css
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/38216899954/1628867245140/Modules/StickyBar/ 4 KB
2 KB 56ms
54ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/38216899954/1628867245140/Modules/StickyBar/stickybar.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3497336ec7ea12302321a9ae41791152eed221c019bed610a8b8fa14b3d336dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis: 1628867245221
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 4ee1745ee3cece0fab563f5a32ba165a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 64
x-hs-alternate-content-type: text/plain
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: DQRW44RX55FA5B8K
x-amz-id-2: N+s54amSPZTeM7pIRe0zcqSDxvq8Cf3NcOZDFxgLG5S4kYvBj+KcOwgRbrCwGo3btQg1nRYLP7g=
last-modified: Fri, 13 Aug 2021 15:07:26 GMT
server: cloudflare
etag: W/"20d2bccf0c241e7bbffb171991a24598"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uXiSKjRei1IvnvQ8SrfStcAMFfyfNCQtMe4p2zQFqngHjQl1%2Fpawx%2BYKhVvMleB9x%2FuzEftoaLo2Nv%2BKbqoxrWeCt1WcjQ97b8m2GB9W1r2w213pujebEujImBnsyBsDe7MiQ2A2LlQ9C9jMT7JpyiEh0GQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: c7F35Q1vBcBLSHfzIY.keFNqjzctPTV8
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7832a1a5b4a-FRA
x-amz-cf-id: cohOzgNzWgiS25y_3nccwv1AwVRR2xo8asy5AwxHgUvzqqyB0Z3HZQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 site-menu.min.css
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11119463588/1628866683213/Redesign_june_2019/Coded_Files/CSS/Components/ 6 KB
2 KB 45ms
43ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11119463588/1628866683213/Redesign_june_2019/Coded_Files/CSS/Components/site-menu.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41ac7f7c2a05d8a7ac157e7b70327e9ac39639c2a1e92bd7d53ef4ac80ce5888

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis: 1628866683280
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 4ee1745ee3cece0fab563f5a32ba165a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 64
x-hs-alternate-content-type: text/plain
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: DQRG5Z7ATS70DD3D
x-amz-id-2: TWpRKaY0NLhjY45aGRzF3gIeOFIpZn2WZFrArz37f21UyvBYwTVLO5fbyHyibaXfkXNqDuvQeSA=
last-modified: Fri, 13 Aug 2021 14:58:04 GMT
server: cloudflare
etag: W/"125299a966355b832b69ef7ea9eb1058"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bLa9lmgtmLi18VjijYnPvOgNdGQT7VYMQMZ4H3cpgXbJXq%2BElYZvLoa%2FfAPlLIY3%2BhzA9hAI9rSyY8kG4vzSKoQ3FOmSQOAesteJdUul1Tny7OktrN%2BykGkQZGRCqWZw%2BbET6GEhZ1A%2F77UZRlTxQrExst0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: cxPHNJ74n_ZvU1wXhXG0xE8bUu81u..8
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7832a1c5b4a-FRA
x-amz-cf-id: Mp2nZbQWpwGWW2J0lba6ppDwx51WIZKwrqDWwNErBN1XQcqbfMsE2Q==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 micromodal.min.css
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395383304/1628866683496/Redesign_june_2019/Coded_Files/CSS/Components/ 4 KB
2 KB 47ms
45ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395383304/1628866683496/Redesign_june_2019/Coded_Files/CSS/Components/micromodal.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e634b615e771259a6dc723ef2cda097c480ad26dc92faa6450c5e4e16e3288a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis: 1628866683533
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 349b149961d8d2361c29d4be4b5847f2.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 64
x-hs-alternate-content-type: text/plain
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: DQRK24Q2W808HXPT
x-amz-id-2: qWoiuN2msIv90tGxW+YXsvwNZNqZhR2s9jbwYyplVEfQkIKivmMd60U6cXRQLYB0ivkTl/wA0ao=
last-modified: Fri, 13 Aug 2021 14:58:04 GMT
server: cloudflare
etag: W/"20c2f66e9f10bed15056fd6b975b8a75"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S83uQvQPnFQ5Ir3aybEZY8T7%2FMbDFTtfWfM4gWwZKvy0JIKI8Kiph6SrHg0C7L8xsRCwlsRtZqXdhFxbfyCBPzWdsiFobRn6kblrGjhydf0dkQ4gz%2B5o6eIKXMnecPifT5FoGTP3H7yDlXp7kV1Gx6ECrP0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: e3VxwMWpNWQvL0ZQahFb1P28o.8Kjgu5
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7832a1d5b4a-FRA
x-amz-cf-id: QDIL0tXFndk97ApEHUKLdfXprB4zQC9sL8Y0BlvTbsnC_8r97X2qvA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.css
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647497/ 610 B
832 B 44ms
41ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647497/module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 249d08c8fde3e1912f9d6d25ff14eed26f4adea29df815b794933eb133f8ec37

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 b9d1b307966c2273bf97ed7c681603da.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1205
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: 22XJJPZSR08YVEJH
x-amz-id-2: 2AQdlBxgrnQ8AaWP9tOxbJjU2irlG/g9MYNY6NRMzd0E+DUIZ0fEYTJkBYAvPyDvqPJJJFWRSuOd1eAs9+I+5A==
last-modified: Fri, 19 Jul 2019 03:07:28 GMT
server: cloudflare
etag: W/"6b50e831aa1329ecfc246611e5b73e07"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=trTgK3lOe7WbRXPc1NlC3UdkBaIBMqzNpVJUhiSx3b7b%2FtwiMnatQsm7QvCd5JgW8imLXxucqoj4Q8RR%2Fg%2BAs%2BdOs5YALzaGs9rNor6DLn%2B3MftY%2B3K6itT9o8u7Wq8f1QUzMVv0umPP2kHJznpMdYX3IRc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: n_rdB5Zjo6jQpLlilRmMi5fLWw35sgNj
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7832a1f5b4a-FRA
x-amz-cf-id: A8Iz_N75Ku6FfSHxDAFVwuHX4MdUu3a5a5bKt5Ja4pyJOFiL8c__MA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 tag-list.min.css
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1628866680959/Modules/Tag_list_-_inline/ 593 B
1 KB 43ms
40ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1628866680959/Modules/Tag_list_-_inline/tag-list.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: beb0dcd50ff2c23c8b9805769aba86b5c19e0de8cb28f6b0d2f4ca85549f3840

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis: 1628866680996
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 199b065e4c1253c9590e1b5e57083906.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 64
x-hs-alternate-content-type: text/plain
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: 30NT4J7H07A8GHJE
x-amz-id-2: zNZ5nJkOgu8q5B7btE5GTktar80nfwnSdB/MUXaFWoS1vpJ0PLAnkuc5bUQmmWsVo3cU5CrO0aU=
last-modified: Fri, 13 Aug 2021 14:58:01 GMT
server: cloudflare
etag: W/"aaa4bc6a5d8baae5c207f0e615a28f24"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5kO9eQRioJblEnui7Iit2hKGvqUW1h6fIOz2OtQ%2FI9YDH1%2FXDlcGbaJ7YM645vkA%2BZBnGZoqb96tM6E29G%2FYls3wz%2FyAWJykpFRnjMbONCCG%2FIjAeGevSZLFcrGoIJbK8eL2YbbydbjMMLQo24XcFQtc2jQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: lm7258yJXwT2Sj8Ju_sWXle7ctvY3AnJ
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7832a205b4a-FRA
x-amz-cf-id: SwEmmRBWr8uqilaBwpz5-SVM_lXmlXUYGDhiYHv0dav5eIWwJ5axAA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 footer-redesign-2019.min.css
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10777459487/1628866681200/Redesign_june_2019/Coded_Files/CSS/Components/ 1 KB
1 KB 45ms
43ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10777459487/1628866681200/Redesign_june_2019/Coded_Files/CSS/Components/footer-redesign-2019.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27215dede1579d37bcf4ab9ef8fc7d968bd02081c4e61d77837a9bb8f6ca9511

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis: 1628866681235
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 199b065e4c1253c9590e1b5e57083906.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1203
x-hs-alternate-content-type: text/plain
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: DQRZVPPAX9380CCM
x-amz-id-2: milc/mftuq2gzROMlSEHmSifqwvIuj7bt3L/ugVMrMDotGhc/eVgARAqbGxhw3KZveRptIXFMfQ=
last-modified: Fri, 13 Aug 2021 14:58:02 GMT
server: cloudflare
etag: W/"74345f5a0d3875bb7f758b06d4778849"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vDApHPSQbaqbUcACaThzhHtTcPb6aIY9MbJppjVHxSJAPCNkIreey2BvLXPte3mx3pTIk%2Fg5j2NctxFs%2BA5dhml09VkHxc1r4DObhwYE4vBMgOAT9BZnnRN4dJ09kUHlXr2nciQNE1Z7T%2B17tJt4aVx10Nc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: KkIg9v6XZx4VO697E4AlyOGL9YPPr5d0
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7832a215b4a-FRA
x-amz-cf-id: fHPMMiy-8-uDK1_MLAIv0bo1Di5JB_mevnXPG5WLIhVKenVwwFwGew==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H/1.1 200
OK in.js Show response
platform.linkedin.com/ 507 KB
159 KB 454ms
7ms Script
text/javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/in.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 1c3e77a8508579f22773af270208521818d6d5ebe0eb52bb3012d5b61be3f8c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-EdgeConnect-Origin-MEX-Latency: 536
Date: Sun, 03 Jul 2022 12:34:16 GMT
Content-Encoding: gzip
NEL: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
X-CDN: AKAM
X-EdgeConnect-MidMile-RTT: 0
Connection: keep-alive
Content-Length: 162498
X-LI-UUID: AAXi5XF5B2ERws7dC83HPQ==
Server: Play
X-Li-Pop: prod-ltx1-x
X-CDN-CLIENT-IP-VERSION: IPV6
Vary: Accept-Encoding
Report-To: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
Content-Type: text/javascript; charset=UTF-8
Cache-Control: public, max-age=3600
X-LI-Proto: http/1.1
X-Li-Fabric: prod-ltx1
Expires: Sun, 3 Jul 2022 13:06:02 GMT

GET
H2 200 layout.min.css
cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1656529285238/hubspot/hubspot_default/shared/responsive/ 5 KB
2 KB 96ms
63ms Stylesheet
text/css 2606:4700::6811:f3cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1656529285238/hubspot/hubspot_default/shared/responsive/layout.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:f3cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4912ee681331bde8c20961cbe6a09ae41fff1b6b53a1b7e54eaa5a2086237921

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis: 1656529286092
date: Sun, 03 Jul 2022 12:34:16 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 322109
x-hs-alternate-content-type: text/plain
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6giZWBSXeYm5SDNvqCeo5FXA%2Bb%2BBhmG1hAhRvIngIPgXroE2MlVqEH9hlue9tdayYKMDojyX0iBQEQN7buykRewOgYhLmQFKPBYXO4kASVoHEew11PVLI5%2FuDZ%2FjhCWdczkuszof2r86%2Fp%2B7Su4%3D"}],"group":"cf-nel","max_age":604800}
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
last-modified: Wed, 29 Jun 2022 19:01:27 GMT
server: cloudflare
etag: W/"46441a9e5bd88d2e2e235b261eec0ff7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7835c389bce-FRA
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 RL-custom.min.css
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1588872217085/Reversinglabs_July2018_Theme/Coded_Files/ 12 KB
4 KB 47ms
45ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1588872217085/Reversinglabs_July2018_Theme/Coded_Files/RL-custom.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c1735eb383eb50ca008fe72ad3d1575c0cfb7cff75b3152d423cd9cdd01a1932

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 2a6e657acb4fd3f6aee2e3da45e44642.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1202
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: DQRZ5XAC7E6P1MZS
x-amz-id-2: EWo+snlwtjAYMbjFb0cEBZ29eBbV21f7z7Z1d31UjQRO/LsxQZely5E0x/ZCGPZd4x4ivF1W6AY=
last-modified: Thu, 07 May 2020 17:23:38 GMT
server: cloudflare
etag: W/"cccb19facfcfebb53e524e5c129805c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bKpzTQ%2BcPvinGDnffaRk7LWmrLV8ttP8s%2BuZiMIlFjtA5hK1wgm%2FKAc6ld4G4FM%2FjNZQQG8irHLe9KMBmMkf1ABWLrFt97sqeKNKCoD1U7w1oOwj%2BcWG1VfQm1kAjhbYIeiY7%2FDZm1ZJw0B15ZYIyWTQyhI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: Du8vgCemGXWmWAWpPCAOlP0Ukc1I74Jw
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7832a225b4a-FRA
x-amz-cf-id: Gckdio0Qln8naNSX1gOhuD1f_KYoDfxtNuXBfS6H3rpk6RX_XSKTYA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 Reversing_Labs_November2018-style.min.css
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1652882430482/Reversing_Labs_November2018_Theme/Coded_Files/ 143 KB
25 KB 50ms
48ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1652882430482/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75749ff8315dd4c7fc5e2e66cf558eb472b876c76a0a42088c0fc91c4bdbf61b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis: 1652882432498
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 920629f47fa586ce02a1a1af8b626578.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1202
x-hs-alternate-content-type: text/plain
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: DQRW1VFAQ9F3H232
x-amz-id-2: tKXZ+JylyTu8Oz+qc9oV4KuRahQY2J+DSSVRACS0EjHHhZlGV/hkgfUt96s9QjWIl8Lai7GPghw=
last-modified: Wed, 18 May 2022 14:00:33 GMT
server: cloudflare
etag: W/"d23ce2b4e9e064571c49c36c8eb2e79f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TpU26cpWQlCMXWVarD1PEtoBt7nkrptIUV4OHmpt2EOa55g7gafuCgWeU%2FhXURMKRDDiPc9KCmHfrciKzZvP35ubY5SIik1o07D7AcDUwtqB6JqVHCV9kwb5as37Omd21%2FNHkKIwZOVW97KWB3cssakP7Nk%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: uiSLUtiZCDv4GjIUyYeuPqBlXt77qD18
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7832a235b4a-FRA
x-amz-cf-id: wN2SehOJeaf82ZIv8LDdRH7qSQ50dUptw4I9Dkw196-tWxq9ulVytA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 site-redesign-june-2019.min.css
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10528761402/1628866684215/Redesign_june_2019/Coded_Files/CSS/Modules/ 12 KB
3 KB 45ms
44ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10528761402/1628866684215/Redesign_june_2019/Coded_Files/CSS/Modules/site-redesign-june-2019.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84967c4e03cea78139700967fe57d0acfd5fbe1002c2d08819ccfd21e095bc4b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis: 1628866684267
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 5630c5d6ce3870273aaf2ed5fe6c2f14.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 64
x-hs-alternate-content-type: text/plain
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: DQRQQZJ3J0Z31GG0
x-amz-id-2: DY24l9KVUPKWn1nGxqMcKumPA/UbY+8C4tZltO9VB4nfX/e/tszMbFcR3036v8IkWKli2r4PZSA=
last-modified: Fri, 13 Aug 2021 14:58:05 GMT
server: cloudflare
etag: W/"7ad492c80dfdc8d4d78c8cee08205b9f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MLHuFh%2Bg1IOvpj4Rg8xxKQpKSb9SiywqeTMDqhmFd68ili28LIbo5c%2F7YGuBNfS589FIOHh7ymnBB%2B3Kt1ymHyYWKaS6%2F3tJlQ7T9v7HQKTX%2FvgCdGDQqCz9lM1%2F84HChOGreLqnQqCNMAY%2Fv5dd4z9Dycg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: XScRDYT44B749k4nfR3f477irCsZic7F
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7832a255b4a-FRA
x-amz-cf-id: FZAs3zfl8hOP3hKLymUib2MCkzBs2R3-vsjTBDUK2tUMgkQsYyO2dQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 simplelightbox.min.css
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021532803/1569840493756/Reversinglabs_July2018_Theme/Coded_Files/ 5 KB
2 KB 43ms
42ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021532803/1569840493756/Reversinglabs_July2018_Theme/Coded_Files/simplelightbox.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c44bc92eb78d7b1596789095812e8c24f5c3f9b4835318cf329204d1efc37abb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 b9d1b307966c2273bf97ed7c681603da.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1201
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: RAE6GNK3A1GK0MG6
x-amz-id-2: JJp2hZ/e2cllfrWiJlIr8Gn3HXY1hiLlb0+6xVHG2xaheQ7/Pcsjw0kF3Eq7OXIVdWQdsyZ65MI=
last-modified: Mon, 30 Sep 2019 10:48:14 GMT
server: cloudflare
etag: W/"9c259f55b65931c5838c0f7cd5f58f93"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rGhtMCH149me7NvF4EFrARsUESZOW7V5OA%2F3l274dRy6lzLxU9ieYMU6qm3eU4S%2FUxPyZI6UXCfnwGnRpiztk3cf0SQe33K0rcVvGRg61%2FUbKfjfy7%2B85RRge7Fgja1uUzOfzHYHpdCYg2UbjGUVaPynOlA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: Y9o3twj1TmNPLtARM7I8GKUA.atzxWnP
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7832a275b4a-FRA
x-amz-cf-id: Vh9VHRKM0pcWIolHQotfdbRCWIRCJ5lJWq8U-WPCeAteSBfXNQLMzw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 blog.min.css
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/23712622487/1628866682579/Coded_files/Modules/ 3 KB
2 KB 53ms
52ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/23712622487/1628866682579/Coded_files/Modules/blog.min.css
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a612c9ad7bdfdfeb71ed257ea676a5bca9db5694ee8a0f0c1f8a96330429ea3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis: 1628866682656
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 bfba2464a75a65b0c6568afe15f68b4c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 64
x-hs-alternate-content-type: text/plain
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: W75K8JP12T8B5S51
x-amz-id-2: UW+h3f9GZd9E+DFBk2p3Mk+kHPi4/GV0HPIEph7gbD8gAw88L3FhFoCiU7oy/W9/OyRQrGA3Lrw=
last-modified: Fri, 13 Aug 2021 14:58:03 GMT
server: cloudflare
etag: W/"86cceae70fe2cace0184968b3abea7a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jl3q3ymAg%2FJpN0zjXQimF3uIBT9aUsCAEtpDxa%2FWijXNJCrl8j%2Boyco9kWCWmBSC48kZ9JxUibNLvXjrt6hUG9NRX7MX8MXEgarvwvSmGg6KciDClCjMUWkZjqrLc6RlwuZKY0DloLr%2BVP6FQx7L%2B9Zkb54%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: Mz.2Pn4CEDs4ZaIeZ_NrZ0_ijfcT5uxW
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7832a285b4a-FRA
x-amz-cf-id: iOkyqZBdTXxVEExMn3pHtB5MAiXiifIyWImDOBN-CnowRczwtNV_tQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 rl-com-logo.svg
blog.reversinglabs.com/hubfs/Reversing_Labs_November%202018/Images/ 3 KB
2 KB 48ms
48ms Image
image/svg+xml 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.reversinglabs.com/hubfs/Reversing_Labs_November%202018/Images/rl-com-logo.svg
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ed697a94ae987ec690170223f411112068b61caf8678788cb4c37347249fd00

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-methods: GET
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 6be461c5a9399007c1540eee90371674.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-meta-cache-tag: F-6517800726,FD-6517800709,P-3375217,FLS-ALL
age: 1313660
edge-cache-tag: F-6517800726,FD-6517800709,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: GE1J6854ZEWCPK40
x-amz-id-2: DXoQcL8PhJRthD6/qqj5n47csxqFMAitWDF7nRj5iUm6ZmaSluu2aC9/V/xfF6eqIXRMmlbBxCo=
last-modified: Wed, 14 Nov 2018 07:33:54 GMT
server: cloudflare
etag: W/"86ace497147ac2cd02198f3cde44219e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xmNn8NjL8YktJjn3qRgflVtpEA6d0iUl%2FpIVWowKWwYI5vfM4PJqtL2DQeMGbYjg739H9lJIdyxeCmU4VP7qIqL4%2BVDvBtOCp49jS5O69HBF95LI44QqTG4mx6I4ayGcDbvpvaVZq1cgj8w50XPInJaiVIg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-version-id: BUsncvg3SahbgModZfK7dQUIXXLSPFen
x-amz-cf-pop: FRA56-P7
cf-ray: 724fa7863ce25b4a-FRA
x-amz-cf-id: Erydnoao3BBEtAdp7nY45XsjP7nQ0OSP2Xra_d0p9GzRTtJ3m0npmw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 Joseph_Edwards.jpg
blog.reversinglabs.com/hubfs/ 30 KB
31 KB 36ms
35ms Image
image/jpeg 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.reversinglabs.com/hubfs/Joseph_Edwards.jpg
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd31c0fcae5f15bff494e99b37fc50834aceef91b8c6ac49b9bf29d5194e052d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-cache-tag: F-77693693277,P-3375217,FLS-ALL
age: 425137
x-amz-server-side-encryption: AES256
edge-cache-tag: F-77693693277,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-request-id: S3D1225DQB4G3BED
cf-bgj: imgq:85,h2pri
etag: "dde93ddf326a8e562fc7114ff038ca76"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
x-amz-meta-created-unix-time-millis: 1656424729138
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 85ca8c4198fb707d10ecc2a784a315be.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA56-P7
x-hs-alternate-content-type: text/plain
cf-polished: origSize=33237, status=webp_bigger
x-cache: Miss from cloudfront
x-amz-meta-index-tag: all
content-length: 30520
x-amz-id-2: YHpzI2U0xcjdHXIxhnbN1HM9hmXf2nmBAPC8uSlJuesqeKa6lAJobLzmIkcfh7JosNEshZaw7p8=
last-modified: Tue, 28 Jun 2022 13:58:50 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2BCCq1qleNNKAt7ptrSbGgF2mT67H0QX%2FQfvSuBMiYaATrUzxK2jlk8P6Ky8vfMMvEmfknxXV3IdHcXug%2BNm%2FW5Q9T4XbdQkvKMKID%2Bm24VQdtH4Vt%2BPhbBsIkoHHmStvGW%2BRUxAS2DF6fOFLxIeZZpioMk%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: nOOSc3KxG2_QXTW7wghRjtEYI9a0z9lL
accept-ranges: bytes
cf-ray: 724fa7864cf75b4a-FRA
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-cf-id: zVUyt1KVa5EViNelFmIunX0xPcW718stnPH8a89D23SPBT_AVBJveg==

GET
H2 200 Flag_of_NATO.1400.png
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ 20 KB
20 KB 144ms
110ms Image
image/png 2606:4700:4400::6812:2128
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/Flag_of_NATO.1400.png?width=480&name=Flag_of_NATO.1400.png
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60b35617b60f5fe8ef7051bea1a6e904cee349368227d51896c87cf33fccaf4d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 a12c29ca3e64ac2015cf4f6c9099b8ce.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 189057
x-amz-server-side-encryption: AES256
edge-cache-tag: F-77974186137,P-3375217,FLS-ALL
x-amz-storage-class: INTELLIGENT_TIERING
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-length: 19982
last-modified: Thu, 30 Jun 2022 17:38:36 GMT
server: cloudflare
etag: "fcb81a3f8e7dbeffe383ab5cfd74acf8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
cf-ray: 724fa7867905903a-FRA
x-amz-cf-id: d6Ehw7OdB1F7ReaJwSZahgUEfA9BfOWjv-e0KFVebfFgtzcaUnXGTQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 ConversingLabs%20Featured%20Image-01.png
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ConversingLabs/ 82 KB
83 KB 122ms
89ms Image
image/png 2606:4700:4400::6812:2128
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ConversingLabs/ConversingLabs%20Featured%20Image-01.png?width=480&name=ConversingLabs%20Featured%20Image-01.png
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44f00ad44f0a2b3147df86caf6911b20510316f7807f16e567fc81d37c71c2ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 de349bd2105a0a744704f391ff854e62.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 385214
x-amz-server-side-encryption: AES256
edge-cache-tag: F-71540281481,FD-69168798251,P-3375217,FLS-ALL
x-amz-storage-class: INTELLIGENT_TIERING
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-length: 83844
last-modified: Thu, 23 Jun 2022 17:42:15 GMT
server: cloudflare
etag: "812a59050253b000c413a93ea335dd5e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
cf-ray: 724fa7867906903a-FRA
x-amz-cf-id: gFwLZhQdinNdyS6cRU4a5KttuK_nEi2XBdoCVzI_6xt5Qu3-KdgSWw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 rsaconference-trust-zero-trust-roundtable.jpg
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ 28 KB
28 KB 136ms
103ms Image
image/jpeg 2606:4700:4400::6812:2128
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/rsaconference-trust-zero-trust-roundtable.jpg?width=480&name=rsaconference-trust-zero-trust-roundtable.jpg
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7dd5b6144da74dff71897fd2664818dba760b4b5076cdc997fcb9469e7ca655

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 2ca1a2664d288773b443dc5e52a8b5b8.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 371407
x-amz-server-side-encryption: AES256
edge-cache-tag: F-76329873537,P-3375217,FLS-ALL
x-amz-storage-class: INTELLIGENT_TIERING
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-length: 28849
last-modified: Tue, 14 Jun 2022 17:29:53 GMT
server: cloudflare
etag: "9d08740a166ab5f06e7f1b5eb1951c1f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: *
cf-bgj: h2pri
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
cf-ray: 724fa7867907903a-FRA
x-amz-cf-id: TNt2zWAHd4LZL1MNKP-cOu4Igfnw3FoqiWjClatWT5oWtfbR4emmdA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
28 KB 35ms
17ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2026838
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27938
timing-allow-origin: *
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "603e8adc-15d9d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dkYWVLQo3eTLY%2BlsKASXviwTozmOOjSRR8OeoXvmcuIQp4XeY0K2EEEmOB5akrmbFJ%2B%2FArvE0uCXSwnbzc0pPDYyOlS2SRJHFYgB2QCKy8oMsZ6P0%2FP0UTg2qbh1gmxGtnOWaGwT0EPMQvRx1Nf2ZL6S"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 724fa783df269a15-FRA
expires: Fri, 23 Jun 2023 12:34:16 GMT

GET
H2 200 simple-lightbox-min.js Show response
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021916068/1569840500063/Reversinglabs_July2018_Theme/Coded_Files/ 7 KB
3 KB 32ms
32ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021916068/1569840500063/Reversinglabs_July2018_Theme/Coded_Files/simple-lightbox-min.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6dc97993d7e4803aeb35d0e9a24f0393eceb43de5f7ff0f0e437f1b05aea4e2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 cea67f5ca1b497624430e599aa6b7c62.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3271
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: Q3XJZFGZHGBS7Q6V
x-amz-id-2: GDRmFMFW9A9wgZX6BfNP2/56pVlGnfU2xW4oNSLXotv0amyB0kVnWpWfI/g56mr0Q27O5JAl8dc=
last-modified: Mon, 30 Sep 2019 10:48:21 GMT
server: cloudflare
etag: W/"d02c339064b8d2b370bc4e18fa6ae421"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6ut9Pf14Wd2gbGXfQJyxDCeUJUz5DYlUdOxsUTgxECPJcaSNMjJMlThdwUuMieZsj94fvbmc1JrkRAmq1%2FjZF5NIHvnqpDnyRKIjVyKaNt2TSWqSP2ghK32VQkfmFCG90Xe4SkR0RJVy0v0wQ8fsK9wLWZI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: FsEJuIr7CYCWLWb_isdf3JLdbLwDP7p.
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7840adf5b4a-FRA
x-amz-cf-id: kXqs1Pab5p5g2m0HrwiZYRKVxfm-G-BfJGrV-5uSfb4dJLZButbwJQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 rd-2019-main.min.js Show response
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11190015046/1639664698263/Redesign_june_2019/Coded_Files/JS/ 2 KB
2 KB 30ms
30ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11190015046/1639664698263/Redesign_june_2019/Coded_Files/JS/rd-2019-main.min.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 589ec6096d83ed322d2e1cf7b85f978ecfe80dc19aab6ac106ef5e2352e32269

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis: 1639664698586
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 de349bd2105a0a744704f391ff854e62.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3268
x-hs-alternate-content-type: text/plain
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: Q3KS773Q7W28V35M
x-amz-id-2: MOtX0oc+XNNaPAju2PqQg9jQfEjfhZwHngKxUYyzpAPrkQNWnQFndli+nYgzvkHmbKR5hXxCsD4=
last-modified: Thu, 16 Dec 2021 14:24:59 GMT
server: cloudflare
etag: W/"b2a254916a67659b4df42aa3c333359a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3up7c69%2FarLDu%2B3E7eX61GKaxzhtnM3%2B5Wc1CBJgv%2Fkl5ZBr3ftWN7O%2BvkfzYvLX2qhisdoW6IttfFYInRoPga1JimZavcTfFRnR9F5vUBfLlaHg2V83m1eUsMLtK3L1E352iOXuyBGFinmol8fmGsdsXyE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: I5.cidQ.vGRls6iGZkmuPTBztEr2IVdj
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7843b145b4a-FRA
x-amz-cf-id: JnK3NLGLpWwVset34WGlAgZ5FFlQjf5vlnr2IpGUUtRHA-4HlURl6A==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 jscookie.min.js Show response
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/28203361861/1586494134457/Redesign_june_2019/Coded_Files/JS/ 1 KB
1 KB 34ms
34ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/28203361861/1586494134457/Redesign_june_2019/Coded_Files/JS/jscookie.min.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc595999f7c46e3f7a293c86fcc256c35467e9947bf0051464628416f1db14f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 979084a90b32fe3f5fdc377fb6e67b76.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3291
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: Q3KSG5N0DY4H73QW
x-amz-id-2: EwmYVKt6HFSki4K9uBQK+gJk5y0OIdZSlOYOAtMKUXdMVCrT/bcLJFpLa8ynD4DVaV9HvtqwUJk=
last-modified: Fri, 10 Apr 2020 04:48:55 GMT
server: cloudflare
etag: W/"93c12b195cd05418a85b4eafc15c92fb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LU8DagFwXNFKskS0zOzoxjYjbRmavow1%2BEz73lqDyHRaL0aBiWSLs5z7BLwpszA%2F8ggJ7SpyvXSHZte6fEk%2F6n7SFLjfRbN1bmvyMd55a66Ct7TtQBmK9SZy6JQZECwgWHw5WOJpf7U01DswRz8PE5IVtkU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: _PdfjdMgm8.M2DiCSVpcYFrpWe519SIO
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7846b3c5b4a-FRA
x-amz-cf-id: rkj1Y4LOejV7E_zBFELhAiWRup0171E9OdFoM3wnK9O1UCJhuijSJQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 tiny-slider.min.js Show response
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/21052151416/1577281626952/Redesign_june_2019/Custom_Modules/Sliders/JS/ 31 KB
13 KB 32ms
32ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/21052151416/1577281626952/Redesign_june_2019/Custom_Modules/Sliders/JS/tiny-slider.min.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 37eae8190baecf55f16575bf754238976116ad37b55f81e27db05743461cd507

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 349b149961d8d2361c29d4be4b5847f2.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3268
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: D7X53943Y9K4FSN7
x-amz-id-2: W+XxoTwOqv8oWEUusjvdhhONi0xeqsRRL9K9FVzp7zcxdua8Ny+jaRArOnMQBVmRjBLgWYlkl6g=
last-modified: Wed, 25 Dec 2019 13:47:07 GMT
server: cloudflare
etag: W/"6603e5d1b1eded8b550dc3ef7fbe687d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aRo700uYXF15RxtCpSIe%2FDZp94Ca%2F%2BHbKq40ym3R9LyGazL19SIRo%2BxJqZdGu4Ku7a1PFg3o%2FwtbQ6nKslnbRw0m905WZ0mz0kadfXBOS2jmueLnJVLLYbMTgD0xGcCwl0fW62MNmKQ7d0GHUHIGLHlK4P0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: a_gzCem69enGGi103.H.X02BRl8OY0mV
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa784ab6c5b4a-FRA
x-amz-cf-id: bbnpj-wpTJEejFrW8XnVncCkDDhowQPnJvCxGmvpaoS0mphaaYxcIg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 module_28186900061_StickyBar.min.js Show response
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/28186900061/1628257298901/ 1 KB
2 KB 36ms
36ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/28186900061/1628257298901/module_28186900061_StickyBar.min.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f35c317df74c5ceaca83bc620ab17f68e882a21e5378933002f20aae3af0517f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis: 1628257298901
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 615f410a3a080a335933e9fa08c15260.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3263
x-hs-alternate-content-type: text/plain
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: D7X4JQWH62TP5M5T
x-amz-id-2: qS4NcYA3/sAzDSAqzEG2Lwa7lADBqwpyJHdPDl2QR3/9C1Hidng7MtYs5HkwwXTWcZJBTamPcl0=
last-modified: Fri, 06 Aug 2021 13:41:39 GMT
server: cloudflare
etag: W/"05f529f2d7b3ca476f37bdcf0b96ef7e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y4ET%2BCL%2F04gsE9F7Q4NumshLFrD4i2x5LBINvegZzGtbf9ymqAd3hdBfNrIIfaSBlgKLU3SLer4amZpoa3f%2FOxWaFytZr%2BmuyTz%2BiIudxly07gg8ro2glpT4NMz4Q3wgi5rioAHteVp9%2Fg2x3zGXbTI7Yrs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: 4GQmixH65wy8hzU_wU.Hiat0EZMIniLc
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa784eba45b4a-FRA
x-amz-cf-id: epgYSSZkGdnw6XgG97jN9HmR7mM7b1YAWOJSloRA7eo4-LJiILdGLA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 micromodal.js Show response
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395370929/1569840498778/Redesign_june_2019/Coded_Files/JS/ 5 KB
3 KB 38ms
38ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395370929/1569840498778/Redesign_june_2019/Coded_Files/JS/micromodal.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9b277f813652ab4fc3476fe4b9771d2d29e10204caef39416ad8d30e45fc5a2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 199b065e4c1253c9590e1b5e57083906.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3264
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: 9G6NGKGS9AD1ZJV4
x-amz-id-2: gqrubfe1yQJP4ezhXIdytX2aNuUMcB+3MJNW3S9MRc/SQ2BXMRz68ZrnympWTvs7yPMfXNQ9xEU=
last-modified: Mon, 30 Sep 2019 10:48:19 GMT
server: cloudflare
etag: W/"84194eded494d011e2828f00329b15c6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f%2BanywoGB46Kf4TdytpfLPakkWgplfid9LeF30KK6WGMTDHvKjKPVBDy9yEch7BG0Pbq78hNu5Y23ktAfzlXCK%2F3sueny420gwTXnvi7OfZpdZ3%2FgcmwMyJs57vIpTtwcdWSP7bQeAFzjMnEBVmDfpk3fuA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: 3FilIB6THj7cvPLh93UnKYXf5w_lQZsq
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7851be85b4a-FRA
x-amz-cf-id: vMH4aMCpwdXzmh_zHBUYinE0EbihYxa86HP1P2_qBXoOp07bt4hUiA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.js Show response
blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647431/ 3 KB
2 KB 30ms
30ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647431/module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 130eb7bbe1dca232b6636767637e6bdc2a35fc2d412db3a601593d79c1d743a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 4a66fbee8ce857225d1bddf53b79420c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2018
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: 8G15ZVZG7RY1X1EG
x-amz-id-2: a2uDEj6aHVoTcVWMhG763RCmfiCXHaJUZypMWiy7kwusRpFgNywsxDkn7XqoQi4vXSX9B4ly+pg=
last-modified: Fri, 19 Jul 2019 03:07:28 GMT
server: cloudflare
etag: W/"c27b7b6ea1f66fa47d64742279aee97a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7LgB7LwpvjeQPwj8fnyc%2Fma9qnNeGoRg%2Blbpg0l0CkMxVcl9YEfdcVY2ZMYybLqT25s8y6yvFzpF%2FCT8WOrLxvOFm18iXJPGpQs4p7gOxpJa3iQv9FV68KMIQsb8H4%2F4oZ7P9osh3KDpN2VhaWjMQolv0Ck%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-version-id: uYaggxrRRLpm1_Oqgp40jmGQ7KENtM4f
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7855c1c5b4a-FRA
x-amz-cf-id: Xg3ISSsr3tIdXIiBXO6WFwzZh_K4eMik3IFIjn2nQrY0Wi6_HSaUKA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 3375217.js Show response
blog.reversinglabs.com/hs/scriptloader/ 3 KB
1 KB 421ms
420ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/hs/scriptloader/3375217.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27dd472678efb842d72ada8c920d853f768e1c40ac3c62d57d4d8eb4cc8fd72e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: EXPIRED
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 403be5b7-9365-4b7f-b71f-e9d4c6587541
last-modified: Sun, 03 Jul 2022 12:32:30 GMT
server: cloudflare
x-trace: 2B5952752068549FE55F7BA17D6A2834168193FF23000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2qcHIwd9Ph9hIgzmj67dgZMsRJeDoyNXkiL5c5MSB%2BqMrU%2Fy8%2BoAoS3bS6xrzENpPnFFy%2BSDdiBANo%2BPGns40Hys3g5RSBqQ%2F0zhQsZMwT37hRByek5qDepzJ7IYHrpyHeImiiX2iB3szEQ7f5uC5DXw074%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://blog.reversinglabs.com
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 724fa7864cf85b4a-FRA
expires: Sun, 03 Jul 2022 12:35:17 GMT

GET
H2 200 cookieinfo.min.js Show response
cookieinfoscript.com/js/ 7 KB
4 KB 33ms
16ms Script
application/x-javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cookieinfoscript.com/js/cookieinfo.min.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4533
x-amz-meta-cb-modifiedtime: Wed, 07 Apr 2021 11:38:58 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: BJYNM9TRAHEVJ86G
x-amz-id-2: R+V/RaQ6pimEHQF65O6hh7evjoCn6aTt9KSDyLwiJrVXEezGJGqXSYpu9mXZmLSVT0SM1pdMXh8=
last-modified: Wed, 07 Apr 2021 11:39:17 GMT
server: cloudflare
etag: W/"d15d93068c1121f63008407d339bd819"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=irilcEFLGI4C%2FGIcCrVvqUvpDHBBCJOcfyBjNO%2FrXnBTTmSCwZiEPsudOf0xHMXcRQz%2F4DAyNNM8B%2BpGBLTFGtfxe6Jc0PHHsZ1SS%2BZphKhUV4yarHSCcFDFdw3S4KwsG4ras5VmG%2BhESBEbe1K1BKWtoA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: max-age=2678400
cf-ray: 724fa785af61bbe5-FRA

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 35ms
7ms Script
application/x-javascript 108.138.15.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.15.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-15-119.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 03 Jul 2022 00:31:56 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
Age: 43341
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA56-P7
X-Amz-Cf-Id: sVw3bgt1BDEhPi5-q7Y3e9O33uwcwo6VOHjaErk0y6DAh7mBEUstgg==

GET
H2 200 t.js Show response
vidassets.terminus.services/492173fc-4b58-46c9-a3cc-09a5abedb64b/ 35 KB
12 KB 48ms
12ms Script
application/javascript 65.9.66.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://vidassets.terminus.services/492173fc-4b58-46c9-a3cc-09a5abedb64b/t.js

Requested by

Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.66.24 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-66-24.fra56.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

9178d19c46b5a36fc8d4de24aa7fef3b62e7f69c259f4e81ee3f2d5aba263216

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:02:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1877
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Thu, 23 Jun 2022 17:58:18 GMT
server: nginx/1.10.3 (Ubuntu)
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript;charset=utf-8
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control: public, s-maxage=2700
x-amz-cf-pop: FRA56-C1
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id: FRjJJ4tAG3FoK_gGc8ObuZxYuilJIvN6Sz92cupos9xbeuSTK5ws-A==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 149 KB
54 KB 127ms
45ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Requested by

Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

88cf3f1179617354f59936ef982f428957c08ff78aa5b5656b33929d69fde3ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55119
x-xss-protection: 0
last-modified: Sun, 03 Jul 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 03 Jul 2022 12:34:16 GMT

GET
H2 200 css
fonts.googleapis.com/ 15 KB
1 KB 143ms
59ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Requested by

Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1652882430482/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3f324aa4ab522a6879525cae1bb4e10fb0edaed434f27ee581c0ffba75bd5ed8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1652882430482/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 03 Jul 2022 12:34:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 03 Jul 2022 12:34:16 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 03 Jul 2022 12:34:16 GMT

GET
H2 200 hero_bg_small_2019.jpg
blog.reversinglabs.com/hubfs/images_redesign_2019/ 21 KB
22 KB 54ms
54ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.reversinglabs.com/hubfs/images_redesign_2019/hero_bg_small_2019.jpg
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 716dcc9643502eb35aa1f08b4805ec1f377daad3e67c11f9d00d65c6fc6336cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-methods: GET
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-meta-cache-tag: F-11448703956,FD-11023975807,P-3375217,FLS-ALL
age: 676498
cf-polished: qual=85, origFmt=jpeg, origSize=95096
edge-cache-tag: F-11448703956,FD-11023975807,P-3375217,FLS-ALL
content-disposition: inline; filename="hero_bg_small_2019.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-request-id: 1DK4ZD9BGFR79VKT
x-amz-id-2: Kev4baABMMzQPJf2FaEW9kWKVhDL/3LvHAKjMMwTx+xLAWOFMu0o3qNFtYMX+gux2LkUvghpvDY=
x-cache: RefreshHit from cloudfront
accept-ranges: bytes
last-modified: Sat, 20 Jul 2019 18:01:05 GMT
server: cloudflare
etag: "1f3df8332048ad0295bff3a1c64cc9a4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KjwZ%2FMxT6sbVi45h9AeJxJ5Httdm77NOZiufZIeOBjc6Y2oBtXAUhZx%2BhXfClLHxVqNUAQpwkcCc2IxTtrs76HqBUgHQb3IhAB8tpAGsWOYQBR8Fj5d2BvW7hCjN0%2BVo3r8UaG0cnI%2BjedJFDP3kCDChGJs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cf-bgj: imgq:85,h2pri
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-version-id: a5PUnngJgc3ZEsbtfbAJjo5eXZD8MNrM
x-amz-cf-pop: FRA50-C1
content-length: 21652
cf-ray: 724fa7873dcd5b4a-FRA
x-amz-cf-id: LEe-3M1yKiWBQC_sa2KQQ6vB_6u5eSxtesCvaKJ9V8ifiNKhZOea8w==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 119ms
37ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 16:12:47 GMT
x-content-type-options: nosniff
age: 505289
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Jun 2023 16:12:47 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 128ms
46ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 11:07:47 GMT
x-content-type-options: nosniff
age: 523589
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Jun 2023 11:07:47 GMT

GET
H2 200 rl-icons.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversing_Labs_November%202018/Font/ 4 KB
5 KB 126ms
94ms Font
application/font-woff 2606:4700:4400::6812:2128
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversing_Labs_November%202018/Font/rl-icons.woff
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1652882430482/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9103cd19fa0db417520474c8682d15529708804e7d5dcee981c8a19a7c083875

Request headers

Referer: https://blog.reversinglabs.com/
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 1d9f9231888e03b204a8691cc95e7c60.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-6528836102,FD-6528836052,P-3375217,FLS-ALL
age: 50243
x-amz-server-side-encryption: AES256
edge-cache-tag: F-6528836102,FD-6528836052,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: 81PZG6NSQNNAWE3J
x-amz-id-2: 1m7bGU/imwjWNYCAKzzLtLegmx1+xl56lezZwVYXdVQaa5y+4W94yl0qGFjD0VTM2o5Ya4nw9hw=
last-modified: Fri, 24 Apr 2020 14:40:36 GMT
server: cloudflare
etag: W/"97ca286c0b94878b6b2adf44559b6265"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-version-id: 7Fg3.Df2IKZXcjymNQNOrpeZRI7DlXZ.
x-amz-cf-pop: TXL52-C1
cf-ray: 724fa7877e159049-FRA
x-amz-cf-id: WFPj9aj9IEKKzchpfaZKglW43HZRpt9tq-8RDyWDyocZgH-e8PCnYw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 TungstenNarrow-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
21 KB 130ms
98ms Font
application/font-woff 2606:4700:4400::6812:2128
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/TungstenNarrow-Medium.woff
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1652882430482/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e

Request headers

Referer: https://blog.reversinglabs.com/
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
age: 50243
edge-cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: A5MKWH2ADC46WZRP
x-amz-id-2: sr3Y1zo6Iu++fL9Yxs0rK85Jut4dnEMDMEEOyxihDZq4iwq9U1/pgIitAgZDOHAYKhLu7nD6Wio=
last-modified: Tue, 18 Jun 2019 15:58:22 GMT
server: cloudflare
etag: W/"650100235aa1598769f1744ec1674c39"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-version-id: HmXdIK8Bc_0fkfivtLAcWmXE077h5rsG
x-amz-cf-pop: TXL52-C1
cf-ray: 724fa7877e1c9049-FRA
x-amz-cf-id: KQCf2E7ZeuyL0qyxnitomnDtBpEpEfLErAF6nPz2MLuexj0bsfXL1w==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 157ms
77ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 11:47:17 GMT
x-content-type-options: nosniff
age: 521219
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Jun 2023 11:47:17 GMT

GET
H2 200 Tungsten-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 19 KB
20 KB 141ms
109ms Font
application/font-woff 2606:4700:4400::6812:2128
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Medium.woff
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1652882430482/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84240275eed2746f9d66bb0a5f46915d74ba6a7c6e210ba4634a16e03ca54270

Request headers

Referer: https://blog.reversinglabs.com/
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 a57d5819527c444e16b1875e3bd28970.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
age: 50244
edge-cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: 9XXBRM2DPC2CPTJ4
x-amz-id-2: cKEJ+h2hU6oxmX0DKK/1re0gJy9zG61Gk6vN+ekOB9aZwYKQisSTiUCId9/umvZXrNkyri72ydM=
last-modified: Tue, 18 Jun 2019 15:58:23 GMT
server: cloudflare
etag: W/"e62b1278f1fdeb9765b266aa18905620"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-version-id: 8RS6BKpEUu5kELkbXI3oOka23XcEIvrY
x-amz-cf-pop: TXL52-C1
cf-ray: 724fa7877e189049-FRA
x-amz-cf-id: -VX-Cum0rvAC8Fs3AZT6_OQ7mVpISvBwEmJiHAwhJf7ZTsg_hFFHRg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 168ms
88ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 29 Jun 2022 08:44:49 GMT
x-content-type-options: nosniff
age: 359367
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Jun 2023 08:44:49 GMT

GET
H2 200 KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
fonts.gstatic.com/s/roboto/v30/ 17 KB
17 KB 180ms
100ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 15:18:14 GMT
x-content-type-options: nosniff
age: 508562
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17508
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Jun 2023 15:18:14 GMT

GET
H2 200 smashed-window-astrolocker.jpg
blog.reversinglabs.com/hs-fs/hubfs/ 37 KB
38 KB 36ms
35ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.reversinglabs.com/hs-fs/hubfs/smashed-window-astrolocker.jpg?width=1280&name=smashed-window-astrolocker.jpg
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fcc8f262b680a237e1131c2c91cd6804004e994db21c98ae3e418853bb08abf4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

age: 425141
x-amz-server-side-encryption: AES256
edge-cache-tag: F-77694694567,P-3375217,FLS-ALL
x-amz-replication-status: PENDING
content-disposition: inline; filename="smashed-window-astrolocker.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
cf-bgj: imgq:85,h2pri
etag: "a76477cda1c8cbd34d9095974eabed54"
vary: Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1656426059899
content-type: image/webp
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 b9d1b307966c2273bf97ed7c681603da.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-P1
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=185100
x-cache: RefreshHit from cloudfront
x-amz-meta-index-tag: all
content-length: 38154
last-modified: Tue, 28 Jun 2022 14:21:00 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fsT%2F5Zs%2ByJNZ61ab9IglVKdJ%2Fb0UPzBMd3ehVWwLMdP6ylzZxSAM6fbqIZGPYRBxvvF9fm0o9%2B0PUyYqQCeeyQebMIqQbS0Z0MpxRaF3r2idzRLBkr8FB70%2F9dTcBnY2XLLcGL%2Fny88nl2xFhkrMhfSZH2M%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 724fa7878e025b4a-FRA
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-cf-id: ZFLCyG1YQKdObQlUNExsd8NtGgTFJURAQrIWlHsA0gKMRm4D-npmsg==

GET
H2 200 AstraLocker-UnknownPublisher.png
blog.reversinglabs.com/hs-fs/hubfs/ 308 KB
309 KB 36ms
35ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.reversinglabs.com/hs-fs/hubfs/AstraLocker-UnknownPublisher.png?width=1620&name=AstraLocker-UnknownPublisher.png
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf5180580367cd0ffed7dc3ac8bd32e0b172c2f8bbc0f757ed99991cb0f2940b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

age: 63
x-amz-server-side-encryption: AES256
edge-cache-tag: F-77685311888,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="AstraLocker-UnknownPublisher.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
cf-bgj: imgq:85,h2pri
etag: "60efb7264a6e56def41766ab3cd81385"
vary: Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1656423300103
content-type: image/webp
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 5630c5d6ce3870273aaf2ed5fe6c2f14.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-P1
x-hs-alternate-content-type: text/plain
cf-polished: origFmt=png, origSize=604433
x-cache: RefreshHit from cloudfront
x-amz-meta-index-tag: all
content-length: 315386
last-modified: Tue, 28 Jun 2022 13:35:01 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xw9hUvgCSzlgY33dIx%2BDZzFIKr5fOmWJIRpgDctfPTYFNBd2h0G9rkW5hndgrCOcIafYdZT9gUZJRDbxbYcVFEKJR8oSou%2FA7waXDyVtLnurZjpF3R6k88l7o5GE7pDomOuqWAjcmhH1TdpsFcc7yTwODsg%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 724fa7878e035b4a-FRA
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-cf-id: TXmGFBKagpHgF7s36mP9mJbsLE2zT2h1bdIYinR9N8yt5Zn6Yv-CVQ==

GET
H2 200 VM-Warning.png
blog.reversinglabs.com/hs-fs/hubfs/ 86 KB
87 KB 55ms
54ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.reversinglabs.com/hs-fs/hubfs/VM-Warning.png?width=1288&name=VM-Warning.png
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d2b2e64648028c0f4b7da490e3ccf6bba1c2000280836f8e249a3e428497b63

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

age: 63
x-amz-server-side-encryption: AES256
edge-cache-tag: F-77685575201,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="VM-Warning.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
cf-bgj: imgq:85,h2pri
etag: "101a2a7bce8e98f6f7028041c1e52d12"
vary: Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1656423402060
content-type: image/webp
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 bfba2464a75a65b0c6568afe15f68b4c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-P1
x-hs-alternate-content-type: text/plain
cf-polished: origFmt=png, origSize=157596
x-cache: RefreshHit from cloudfront
x-amz-meta-index-tag: all
content-length: 87726
last-modified: Tue, 28 Jun 2022 13:36:43 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FRr%2FZ3lg%2Bs%2Be3Ufj60D8i9fjIVZR0DJqKhOGs4wIp3fVUBk8dHU1h2XQjFp6FRiHGEmF05dgDMRkbpsNgiGi%2FRbR26ws153A4uUlLgvSbQVIqKT70mDsOq6cNolIF2oSantsNT7G91wGrSELLEJhKU2QzGw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 724fa7878e045b4a-FRA
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-cf-id: XvBZJUJj1gFuxfUwmu8Pw9rMxwd8gjMm5lKANHxeBXZvMXR5iOWssA==

GET
H/1.1 200
OK VisitorTrack2.js Show response
code.visitor-track.com/ 358 B
661 B 753ms
146ms Script
application/javascript 63.134.242.129
CRYSTALTECH

General

Check archive.org

Show headers Download Go to

Full URL: https://code.visitor-track.com/VisitorTrack2.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 63.134.242.129 , United States, ASN14992 (CRYSTALTECH, US),
Reverse DNS: www.visitortracklog.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: a969e5f8c4950230af86fcc3fa95485eb505cb6c58574146b87115ee6bd7bfdf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 03 Jul 2022 12:34:16 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 Apr 2019 22:27:51 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "3214e76daf3d41:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 355

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
265 B 101ms
31ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=id17evj&ttd_tpi=1&ttd_puid=492173fc-4b58-46c9-a3cc-09a5abedb64b|5acd0994-6638-4fd9-bed0-5dfdcbe2eb14
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Jul 2022 12:34:16 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

t.gif
wec-assets-api.terminus.services/v1/492173fc-4b58-46c9-a3cc-09a5abedb64b/
Redirect Chain

https://wec-assets.terminus.services/492173fc-4b58-46c9-a3cc-09a5abedb64b/t.gif?d=5acd0994-6638-4fd9-bed0-5dfdcbe2eb14&s=e3c8e5c7-407a-4fae-81f5-c104e919922a&p=https%3A%2F%2Fblog.reversinglabs.com%...
https://wec-assets-api.terminus.services/v1/492173fc-4b58-46c9-a3cc-09a5abedb64b/t.gif

43 B
153 B

300ms
98ms

Image
image/gif

184.73.136.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wec-assets-api.terminus.services/v1/492173fc-4b58-46c9-a3cc-09a5abedb64b/t.gif

Requested by

Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs

Protocol

Server

184.73.136.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-184-73-136-239.compute-1.amazonaws.com

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
strict-transport-security: max-age=31536000
content-length: 43
vary: Origin
content-type: image/gif

Redirect headers

date: Sun, 03 Jul 2022 12:31:25 GMT
via: 1.1 74d50eedd5298169754bf0835ac2cece.cloudfront.net (CloudFront)
server: awselb/2.0
age: 172
x-cache: Hit from cloudfront
content-type: text/html
location: https://wec-assets-api.terminus.services:443/v1/492173fc-4b58-46c9-a3cc-09a5abedb64b/t.gif
x-amz-cf-pop: OTP50-C1
content-length: 134
x-amz-cf-id: yc3jaVjOw6xRwfk_DCp5s_3RMrhr_2mn_s5ekBLwtobU-WtW_Cjdqw==

GET
H2 200 all.js Show response
connect.facebook.net/en_GB/ 3 KB
2 KB 32ms
7ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js

Requested by

Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

efc779b65d1bf5836f71be76b94db94fc2605b6d028fd8fe92ed25064e6e1983

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: sESTFG9SWgg1FIS6++yb5A==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1686
x-fb-rlafr: 0
x-fb-debug: kAWM2tbqoVheyzWB6JIcNPSEB7R33LJRBSw0pcqihXWMgeZCSuWHcNvFddDqw02kgcfW8OKa8/Bau81gp5lWgA==
x-fb-trip-id: 686109401
x-fb-content-md5: 5f6c8e745e4b001d7c40853b751369b1
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sun, 03 Jul 2022 12:34:16 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "59f3b505662d5ff42a5442068c8240e5"
timing-allow-origin: *
priority: u=3,i
expires: Sun, 03 Jul 2022 12:52:59 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 97 KB
29 KB 60ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6772) /
Resource Hash: dccafac57a7fcedce0d95d35007b502104f45b82f43f052159c370258ef13a53

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 03 Jul 2022 12:34:16 GMT
Content-Encoding: gzip
Age: 1268
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=,edge;dur=1
Content-Length: 29459
x-tw-cdn: VZ
Last-Modified: Thu, 02 Jun 2022 18:12:37 GMT
Server: ECS (frb/6772)
Etag: "5d21dece96ce474f5f1ac122cbdef6eb+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H2 204 has-permission Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
762 B 230ms
198ms Script
text/plain 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission?portalId=3375217&callback=jsonpHandler

Requested by

Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.128/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-hs-worker-debug-mode: false
server: cloudflare
x-hubspot-correlation-id: b6b99b3f-4d44-43df-90a7-f3ebf7a199f4
x-trace: 2B0A5003245153BF5A4380BBD786FD451D08BD39AF000000000000000000
date: Sun, 03 Jul 2022 12:34:17 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
cf-cache-status: DYNAMIC
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://exceptions.hubspot.com/csp/reports?cfRay=724fa787d8a69016&resource=unknown"}]}
cache-control: max-age=0
access-control-allow-credentials: true
cf-ray: 724fa787d8a69016-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 99ms
30ms Script
text/javascript 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 5367
date: Sun, 03 Jul 2022 11:04:49 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Sun, 03 Jul 2022 13:04:49 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 38ms
7ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 03 Jul 2022 12:34:16 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=72374
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 55 KB
15 KB 51ms
12ms Script
application/javascript 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: aa6959acd3d64822ef7379e437fce6b84a5cd3169003e955e2fffbdb2526d086

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
content-encoding: gzip
last-modified: Thu, 16 Jun 2022 16:20:35 GMT
etag: "f345fa1999011d396bda3b2c6fafc302+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 15166
x-served-by: cache-iad-kiad7000144-IAD, cache-muc13959-MUC

GET
H2 200 Tungsten-Book.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
21 KB 56ms
56ms Font
application/font-woff 2606:4700:4400::6812:2128
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Book.woff
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1652882430482/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a5131ba88c40e02e211f48163838569b854a383f19817b94db2f4e83f5d044d

Request headers

Referer: https://blog.reversinglabs.com/
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 f66aaf2d9f6a8e65595a1e24d5f18bcc.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-11651164052,FD-5926386258,P-3375217,FLS-ALL
age: 50243
edge-cache-tag: F-11651164052,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: RD19RH5P6HJ7EETB
x-amz-id-2: 3YChA27Efg/jYDnLgdRzHSYhiph6jRvICf7nG5HpOt5Rl+ONSBzuubNlGqS5+JUIwJ7jrk5siNs=
last-modified: Sun, 28 Jul 2019 19:57:28 GMT
server: cloudflare
etag: W/"ab8a234e214dd3506e9fada6b6eafdca"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-version-id: DhZpSF_okm4kqA3d5rsX6px.W1gW4AHr
x-amz-cf-pop: TXL52-C1
cf-ray: 724fa787be689049-FRA
x-amz-cf-id: o4dSmCu-tZQjYCdaVVReoCfkvQhLmy_28t8dpczwHo9AjQ7wVD5M3Q==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 Tungsten-Light.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
22 KB 50ms
50ms Font
application/font-woff 2606:4700:4400::6812:2128
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Light.woff
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1652882430482/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ac9f879f23b53c0856f5a719a5d2913f2890b5e06b60a8879945c245080fc52

Request headers

Referer: https://blog.reversinglabs.com/
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
via: 1.1 8e2919534da029bb37f64b265b219372.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-11651159874,FD-5926386258,P-3375217,FLS-ALL
age: 50243
edge-cache-tag: F-11651159874,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
content-encoding: br
x-amz-request-id: 9XX1XDK265PW5JJQ
x-amz-id-2: 5MaTn6ERDi1qL1ejAAW8u6TQXKQP8z37B/PZ34HDP+L+P8fUD8wrLmXo9+RwuBp4PXvethscNXI=
last-modified: Sun, 28 Jul 2019 19:57:28 GMT
server: cloudflare
etag: W/"100aa5d32672286f544f73831e764ee1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-version-id: oZWO71JPrAMaAkHUdMvYTNjF0GR2Ck4O
x-amz-cf-pop: TXL52-C1
cf-ray: 724fa787ce729049-FRA
x-amz-cf-id: jV9RHZBzLcTkymmI5JsCjfSzE3o9jKjb5bRqGiHPOPBjgHwikRKt_g==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 all.js Show response
connect.facebook.net/en_GB/ 302 KB
85 KB 20ms
8ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js?hash=8f2fdd5c88c57fa697ecba6d5f3077e0

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/all.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d8bb49d76bb427a9a5ee963b46cf89a592f357b5a5d07bd91f8df1face6a2da5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: wP29h/hObjhLoHqknXk4mw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 87451
x-fb-rlafr: 0
x-fb-debug: vDfXHDpFQBxTysvFKfMgzzAGKsK/TSDoFtvGdeEhYt+KqCBzbBvhbJu6WxwEfcmEEy2OSKBceQKvkhq7Rb1JGQ==
x-fb-content-md5: 778606c86fe316327fbe213b451b5573
x-frame-options: DENY
date: Sun, 03 Jul 2022 12:34:16 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "a19a8db6f1b157870977cc1f80d204e0"
timing-allow-origin: *
priority: u=3,i
expires: Mon, 03 Jul 2023 11:10:27 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1656851657014&url=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1656851657014%26url%3Dhttps%253A%252F%252Fblog.reversinglabs.com%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1656851657014&url=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1656851657014&url=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-doc...

0
266 B

175ms
129ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1656851657014&url=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&liSync=true&e_ipv6=AQJbvhYed3xP1gAAAYHEDfK7m8Sy80ZT54LsXw6XArU9rButNhVcY4RvFehv_YZMjUPryFDT
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:16 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 1445A3AF5804473EAD7063205E2CEEB9 Ref B: FRAEDGE1517 Ref C: 2022-07-03T12:34:17Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXi5dZ+okmGz5Mmy9KLXw==
x-li-fabric: prod-lva1

Redirect headers

date: Sun, 03 Jul 2022 12:34:16 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 4D78B6707F784751B53E49D1F741052F Ref B: VIEEDGE3121 Ref C: 2022-07-03T12:34:17Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1656851657014&url=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&liSync=true&e_ipv6=AQJbvhYed3xP1gAAAYHEDfK7m8Sy80ZT54LsXw6XArU9rButNhVcY4RvFehv_YZMjUPryFDT
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXi5dZ79ZZ07jAQQHmkIA==

GET
H/1.1 200
OK widget_iframe.d7fc2fc075c61f6fa34d79a0cbbf1e34.html Show response
platform.twitter.com/widgets/ Frame 5946 319 KB
104 KB 7ms
7ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.d7fc2fc075c61f6fa34d79a0cbbf1e34.html?origin=https%3A%2F%2Fblog.reversinglabs.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67AA) /
Resource Hash: c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 421423
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105433
Content-Type: text/html; charset=utf-8
Date: Sun, 03 Jul 2022 12:34:17 GMT
Etag: "8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified: Thu, 02 Jun 2022 18:01:40 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/67AA)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=,edge;dur=1
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ

GET
H2 200 adsct
t.co/i/ 43 B
337 B 730ms
117ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=a3dde6bc-8e04-4239-812f-ef2fa4c46782&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=2ae87f71-9583-4a48-b4d3-66c30d4e1bf6&tw_document_href=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=07cai&type=javascript&version=2.4.12

Requested by

Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-response-time: 111
date: Sun, 03 Jul 2022 12:34:16 GMT
server: tsa_o
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 7e14a7cc44f6e3700a4606097ba93b200b7550df8560b0293cb0aa4f9d149852
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
355 B 228ms
116ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=a3dde6bc-8e04-4239-812f-ef2fa4c46782&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=2ae87f71-9583-4a48-b4d3-66c30d4e1bf6&tw_document_href=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=07cai&type=javascript&version=2.4.12

Requested by

Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-response-time: 110
date: Sun, 03 Jul 2022 12:34:17 GMT
server: tsa_o
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 4234d05f94474b51a4e7f6e8b219d69353917db9a9955f057fbfe51e278003e5
content-length: 43

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 96ms
36ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=332630037&t=pageview&_s=1&dl=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&ul=en-us&de=UTF-8&dt=Smash-and-grab%3A%20AstraLocker%202.0%20pushes%20ransomware%20direct%20from%20Office%20docs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1260795359&gjid=193759911&cid=548120493.1656851657&tid=UA-32828290-1&_gid=958367747.1656851657&_r=1&gtm=2wg6t0MKL9P8B&z=1606890864

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 03 Jul 2022 12:34:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 5946 512 B
522 B 582ms
125ms Fetch
application/json 104.244.42.136
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=6609388a863e8cceaff45f0241806210e6192055

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.d7fc2fc075c61f6fa34d79a0cbbf1e34.html?origin=https%3A%2F%2Fblog.reversinglabs.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

a15f95e938fbfd9ffef12a20682cdb3eebc3cfefa4843ceab38d0ff1a612cbda

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-response-time: 118
date: Sun, 03 Jul 2022 12:34:17 GMT
content-encoding: gzip
last-modified: Sun, 03 Jul 2022 12:34:17 GMT
server: tsa_o
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: 887597b70f33e2d394ffe1a1b564a9f0677dbf91f1e3bfcbde850eff68450143
content-length: 241

GET
H2 200 conversations-embed.js Show response
js.usemessages.com/ 72 KB
21 KB 56ms
23ms Script
application/javascript 2606:4700::6811:ebcc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.usemessages.com/conversations-embed.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:ebcc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 098f1a1400af17ccadd35f423d47cc1eab1e8e814f73a98c3bd034e4dea62c08

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
via: 1.1 aa6e16f47d6a0519f52b8dcfca2d841a.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 506
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=conversations-embed/static-1.10317/bundles/project.js&cfRay=724f9b2e49ae5c85-FRA
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
content-encoding: br
last-modified: Tue, 28 Jun 2022 08:24:15 UTC
server: cloudflare
etag: W/"ec888afa280a584d80fa2e4a6e695475"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: MC1MujafCIKhor0u_m.Zxaddp4B8ErnC
cache-control: max-age=600
x-hs-cache-status: HIT
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7893dc89b57-FRA
x-amz-cf-id: i76q_2MKAKQ-m18-fqlDF4SEZBxAcykFaI0LL4VN7o1nQ35UoFngmA==
x-hs-target-asset: conversations-embed/static-1.10317/bundles/project.js

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 72 KB
25 KB 59ms
28ms Script
application/javascript 2606:4700::6811:83ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hscollectedforms.net/collectedforms.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:83ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8309531b6b2107c16edd77efa774374f935a7924a84c7bae72973f19b962e0e5

Request headers

Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
via: 1.1 cea67f5ca1b497624430e599aa6b7c62.cloudfront.net (CloudFront)
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
cf-cache-status: HIT
age: 80438
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=collected-forms-embed-js/static-1.278/bundles/project.js&cfRay=7247fbba2f408fe0-IAD
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-encoding: br
cf-ray: 724fa7892ad7bbf2-FRA
last-modified: Thu, 19 May 2022 12:56:36 UTC
server: cloudflare
etag: W/"9bdc82a581dc188ff306ce5ac3c3e170"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: w6kD440dVLHBLSxXlQNkz9NYzxhkbh3c
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=0
x-hs-cache-status: MISS
x-amz-cf-pop: IAD89-P1
content-type: application/javascript; charset=utf-8
x-amz-cf-id: qe2xfbgdgodf-IMHaDz0rGUgXd8I7u6-Cp1p_Ey7ucN6P5i6RgK7ww==
x-hs-target-asset: collected-forms-embed-js/static-1.278/bundles/project.js

GET
H2 200 3375217.js Show response
js.hs-analytics.net/analytics/1656851400000/ 62 KB
20 KB 64ms
29ms Script
text/javascript 2606:4700::6811:45b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1656851400000/3375217.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:45b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8bbac923800b8fa88df465e6c7d59cb4e09ad2eac12c42a5b54fbd5aeff01da

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
content-encoding: br
cf-cache-status: HIT
age: 172
x-amz-server-side-encryption: AES256
x-amz-request-id: WGZQSHBXD5BWVVX6
x-amz-id-2: IKA/sWpr8vWXgDN+JwddkxqEUV/pHv4q3hCAtOB7HuWQ8dft5AJQfmruhTydu1wq1qJCzeDXR3Q=
last-modified: Tue, 14 Jun 2022 15:10:35 GMT
server: cloudflare
etag: W/"5b72217c751348834615755e1f1b39d5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
x-amz-version-id: null
cf-ray: 724fa7893ae65b3e-FRA
expires: Sun, 03 Jul 2022 12:36:25 GMT

GET
H2 200 3375217.js Show response
js.hs-banner.com/ 60 KB
16 KB 60ms
25ms Script
text/javascript 2606:4700:4400::6812:21ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/3375217.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:21ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 116f0348d85f772797147df6f967e3dd5f8042b50397ec3c03ece955bb7ff050

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
content-encoding: br
cf-cache-status: HIT
age: 35
x-amz-server-side-encryption: AES256
content-type: text/javascript; charset=UTF-8
access-control-max-age: 604800
x-amz-request-id: 6GCWAQJMHRKPF9T4
x-amz-id-2: XL4tkrQHJj4IairlCdLEqbhofT1kak1XEl+a3Is1u/lil18OcZsGd1nqAG7jrSGsSgXFsDOhHEk=
timing-allow-origin: *
last-modified: Fri, 27 May 2022 15:43:28 GMT
server: cloudflare
etag: W/"f0584aa453bdd67fa914519b79af0c02"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-amz-version-id: .puaw1QxrZh95t7r5xYa.CY5EtcyiQkg
access-control-allow-origin: https://www.reversinglabs.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
cf-ray: 724fa7893b799a00-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires: Sun, 03 Jul 2022 12:38:42 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 547 KB
88 KB 53ms
34ms Script
application/javascript 2606:4700::6811:e7cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsleadflows.net/leadflows.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:e7cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd03eda5317d9d62243195e41b4b52d55640561480d2682fcf6daf9b90987434

Request headers

Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Origin: https://blog.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
via: 1.1 615f410a3a080a335933e9fa08c15260.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 41460
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=lead-flows-js/static-1.1092/bundle/main/lead-flows-release.js&cfRay=724bb3564d499a3b-IAD
x-cache: Hit from cloudfront
access-control-max-age: 3000
x-amz-replication-status: COMPLETED
content-encoding: br
cf-ray: 724fa7892a569a21-FRA
last-modified: Tue, 14 Jun 2022 09:22:35 UTC
server: cloudflare
etag: W/"4d9060d46ded886725fdadd2918d8827"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
x-amz-version-id: Ln2dBnu66WcBGVnZb6Z.xnR7vFzaf.57
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=0
x-hs-cache-status: MISS
x-amz-cf-pop: IAD89-P1
content-type: application/javascript; charset=utf-8
x-amz-cf-id: AOO1oNFyXQFDVpwRMd9hGXlQv607I4Sew4uDjtbBWBNcO1Pc-u9pDA==
x-hs-target-asset: lead-flows-js/static-1.1092/bundle/main/lead-flows-release.js

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 5 KB
3 KB 55ms
20ms Script
application/javascript 2606:4700::6811:70b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsadspixel.net/fb.js
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:70b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62eff55da34fb881e5f26498f4c572a8810f8fb1953e8e00c24df6a05deb2747

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
via: 1.1 7afe17509cf46af31fd4ba3c3d932fa6.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 448
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=adsscriptloaderstatic/static-1.287/bundles/pixels-release.js&cfRay=724f9c98f815bb7f-FRA
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
content-encoding: br
last-modified: Thu, 30 Jun 2022 02:09:15 UTC
server: cloudflare
etag: W/"1b16fc147ec853ab9d82a3c0efe75b77"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: dONne1FcPXm8F7qFk63xAz5e_hNw5LhN
cache-control: max-age=600
x-hs-cache-status: HIT
x-amz-cf-pop: IAD89-P1
cf-ray: 724fa7898a15bb71-FRA
x-amz-cf-id: k9AyGDrbo3c7Le1AXnh6XPVxx1DEnRzMhTszcbabsN0zAQiscreb8Q==
x-hs-target-asset: adsscriptloaderstatic/static-1.287/bundles/pixels-release.js

GET
H2 200 widget Show response
blog.reversinglabs.com/_hcms/livechat/ 340 B
1 KB 180ms
180ms XHR
application/json 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.reversinglabs.com/_hcms/livechat/widget?portalId=3375217&conversations-embed=static-1.10317&mobile=false&messagesUtk=b6928a99a99a43bcb2eef5785df2a3bc&traceId=b6928a99a99a43bcb2eef5785df2a3bc

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

94a1be30df2f2f15eb2fed750eca74ec60d4d6f554ee50334bce0ce9db69bd3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
accept-language: de-DE,de;q=0.9
X-HubSpot-Messages-Uri: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 02671922-9eee-48ba-97e1-56edbd5bc73e
server: cloudflare
x-trace: 2B2288C0DF57B9692E6FAC0E5D77DAA73079641526000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d4LKIzwsIsbghy5hJxXXDlkz213cMeB8L7Wk1q5XH%2F18JO%2FqZPNYIVHrQANpqYP8IHqwdF0AZw9Y%2FGyg3xoVx9kYlhtQyFBFcAdjrVMJhFebj7bDaiLwhNs22jYzkRCNRNi1tO2Aie8mhI8UJ6ChhAdrhEc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=utf-8
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
cf-ray: 724fa7897fb65b4a-FRA
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

GET
H2 200 json Show response
forms.hubspot.com/collected-forms/v1/config/ 115 B
1 KB 197ms
165ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/collected-forms/v1/config/json?portalId=3375217&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: c209a25e-0f04-4baf-9073-3662e68a5925
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fiW2rQXICrw7sMknMqDgq4bzxd%2FHLTKUFOyJYmYUbAFPmOIshWZzpiGAhEUyAfeVCfIWbBsDi8Bn3SdndWyOnejlytCGgkl1Y3P19uT2rmU9D1GG1GtjcfGfs2GG5SZ%2FWf1jsGHk5fpoWAgzeLlO"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.reversinglabs.com
x-robots-tag: none
access-control-allow-credentials: false
cf-ray: 724fa789cabf5b9e-FRA
access-control-allow-headers: *

GET
H2 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
516 B 165ms
133ms Image
image/gif 2606:4700::6810:5505
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5505 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
x-hubspot-correlation-id: 014f4d84-5203-4c29-a15d-3a456d60f449
cf-ray: 724fa78b09709b76-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 35
server: cloudflare
x-trace: 2B3AB81F3161DADA35514614E0A528D24F1CCE66E3000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none

GET
H/1.1 200
OK vt2.aspx Show response
code.visitor-track.com/ 0
322 B 147ms
147ms Script
text/javascript 63.134.242.129
CRYSTALTECH

General

Check archive.org

Show headers Download Go to

Full URL: https://code.visitor-track.com/vt2.aspx?v=6&id=110888&r=&u=https%3A//blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Requested by: Host: code.visitor-track.com
URL: https://code.visitor-track.com/VisitorTrack2.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 63.134.242.129 , United States, ASN14992 (CRYSTALTECH, US),
Reverse DNS: www.visitortracklog.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 03 Jul 2022 12:34:16 GMT
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Length: 0
Content-Type: text/javascript

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame 524C 0
181 B 52ms
37ms Document
text/html 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&upid=8t4axvj&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-type: text/html
date: Sun, 03 Jul 2022 12:34:17 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame 02CA 0
181 B 44ms
31ms Document
text/html 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&upid=8t4axvj&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-type: text/html
date: Sun, 03 Jul 2022 12:34:17 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 37ms
37ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=332630037&t=pageview&_s=1&dl=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&ul=en-us&de=UTF-8&dt=Smash-and-grab%3A%20AstraLocker%202.0%20pushes%20ransomware%20direct%20from%20Office%20docs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAEABAAAAAC~&jid=1893059254&gjid=1850866348&cid=548120493.1656851657&tid=UA-32828290-1&_gid=958367747.1656851657&_r=1&_slc=1&z=307272809

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 03 Jul 2022 12:34:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixel/ 67 B
924 B 189ms
157ms XHR
application/json 2606:4700::6811:cacc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixel/json?portalId=3375217

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:cacc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aba43a2f3d0af8618f96387996f22eeacbb19e61315e1de7513be0276f987fae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: e2a36ee6-0d15-4ca8-9681-7e5503922346
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
x-trace: 2B2ECAFDABD78294397C9C4F2B9A2F84C3F5221323000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z5wC%2FXlJ7MWD1VokYVtcRPlZDf%2FfIacCWkhOxo45gZ%2BhpTRyj6QjJvoNKOZGmDajeab4Yc03s23Ec%2B9c66W63NdeJrP%2BHS%2FbmfXTmqeh4tJGX3YPEPxUGNTSjBZMRf%2BuUmJHAXqusbXhEp30"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.reversinglabs.com
access-control-allow-credentials: false
cf-ray: 724fa78d7ce1bbbc-FRA
access-control-allow-headers: *

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
501 B 134ms
133ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2760707843&v=1.1&a=3375217&pi=77621377326&ct=blog-post&ccu=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&cpi=77621377326&cgi=5901382633&lpi=77621377326&lvi=77621377326&lvc=en&pu=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&t=Smash-and-grab%3A+AstraLocker+2.0+pushes+ransomware+direct+from+Office+docs&cts=1656851657806&vi=6c8a30fd18671948c49bf1f797a55057&nc=true&u=60854195.6c8a30fd18671948c49bf1f797a55057.1656851657803.1656851657803.1656851657803.1&b=60854195.1.1656851657803&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: d5188e7e-c61b-46f6-be97-18fa96265b7c
cf-ray: 724fa78d4aef9016-FRA
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wqW5XCCoipRqcso3TpkHeCH1eYlaeXC4QtEzDobiYasB8cyD5ZXI8VBp3WlPMyZFXBKO5KmKe47nEgFloiUayE%2BAUxceFQz%2FCxyh6DTHgTPwBrajummWaNewHUf88CkkLO7RyImc57ALg6w1T%2BUt"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
x-robots-tag: none

GET
H3 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 2 KB
2 KB 169ms
154ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3375217&utk=6c8a30fd18671948c49bf1f797a55057&__hstc=60854195.6c8a30fd18671948c49bf1f797a55057.1656851657803.1656851657803.1656851657803.1&__hssc=60854195.1.1656851657803&contentId=77621377326&currentUrl=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5ce094dcd9502358a429f85c3709174d297b727cc36da4720b08913f6e50a2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:17 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: a0cad5b6-b270-497d-b907-dc40827d80ab
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-robots-tag: none
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mbBEXC45zFrvA3ahQyrCjlweVbogF0v2ZwMMuvaDgKmcqYGllWYz4fjXKRC%2F65ao1SDmFOeDn84gqpelF9CQ6%2F5XgXeb4QH5FMJYGZO4jNehrN3Y2IEn%2FjcXA66gOPJ7xPAJwNXOJV2Kx%2FKIIp7x"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.reversinglabs.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
cf-ray: 724fa78d78969a17-FRA
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent

GET
H3 200 __ptq.gif
track.hubspot.com/ 45 B
742 B 157ms
137ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=93f04e45-34f2-4dc5-90c4-21315c8dc6f4&lfi=670826&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2760707843&v=1.1&a=3375217&pi=77621377326&ct=blog-post&ccu=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&cpi=77621377326&cgi=5901382633&lpi=77621377326&lvi=77621377326&lvc=en&pu=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&t=Smash-and-grab%3A+AstraLocker+2.0+pushes+ransomware+direct+from+Office+docs&cts=1656851657995&vi=6c8a30fd18671948c49bf1f797a55057&nc=true&u=60854195.6c8a30fd18671948c49bf1f797a55057.1656851657803.1656851657803.1656851657803.1&b=60854195.1.1656851657803&cc=15

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:18 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: ebfc314f-d11e-45df-8fed-051c033dd442
cf-ray: 724fa78e9b675bdd-FRA
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qIKR1Oqvq36o73UUr6a6WGlLxTrDyEojEKHlaa3Zy6%2BniH6%2FbGNHFmkDnRLqJrOCsgK4T%2BxbN3ffsQxhi4Y8t7nrih3Wc%2BWQWJVnKkwuE%2B1sFSYX2g3V9IfRAQxDXX55ixMSNnLThRcNN%2FoWMinj"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
x-robots-tag: none

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 129ms
52ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-970567826

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1a14cd0f8d0b18174b22fedf6f236919a8054841fc44ec04f6ff736f37a155a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:18 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43989
x-xss-protection: 0
last-modified: Sun, 03 Jul 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 03 Jul 2022 12:34:18 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 40 KB
15 KB 120ms
47ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-970567826

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

00e67a6bb1601297c954a9c6438eb956f4ca87253683fb348d1bda64cee7d1ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 12:34:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15163
x-xss-protection: 0
server: cafe
etag: 11137310801552021614
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 03 Jul 2022 12:34:18 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/ 2 KB
2 KB 134ms
52ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/?random=1656851658305&cv=9&fst=1656851658305&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa6t0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&tiba=Smash-and-grab%3A%20AstraLocker%202.0%20pushes%20ransomware%20direct%20from%20Office%20docs&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4996f006d130c16e961b99b90d3fd17f44d20a2292034c40e81183f958f97d41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Jul 2022 12:34:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1105
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/970567826/ 42 B
548 B 146ms
52ms Image
image/gif 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/970567826/?random=1656851658305&cv=9&fst=1656849600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa6t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&tiba=Smash-and-grab%3A%20AstraLocker%202.0%20pushes%20ransomware%20direct%20from%20Office%20docs&async=1&fmt=3&is_vtc=1&random=2757619162&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Jul 2022 12:34:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/970567826/ 42 B
548 B 143ms
58ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/970567826/?random=1656851658305&cv=9&fst=1656849600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa6t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.reversinglabs.com%2Fblog%2Fsmash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs&tiba=Smash-and-grab%3A%20AstraLocker%202.0%20pushes%20ransomware%20direct%20from%20Office%20docs&async=1&fmt=3&is_vtc=1&random=2757619162&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Jul 2022 12:34:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 perf Show response
blog.reversinglabs.com/_hcms/ 2 B
423 B 160ms
159ms XHR
text/plain 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.reversinglabs.com/_hcms/perf
Requested by: Host: blog.reversinglabs.com
URL: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/json

Response headers

cf-ray: 724fa79ffcf25b4a-FRA
date: Sun, 03 Jul 2022 12:34:20 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-hubspot-correlation-id: f3df5c31-69ff-426f-8301-6739495709e8
x-trace: 2B5194270D5603E7943BF18F79A9589FF770541EC9000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LOnYd3APhcjVx7dWDu37ofy9U8%2BcH9yx5GLSvx9Zx4pOnnzGxceSZzObGvn5tTTsYF0MVNoC9eb71U09V%2BlZQlOYrz3vqvOzmyrQy3CbVRdEzylzYWGqCuymkCdXXpAKaNNzmg7LgebDXEDPSoeAzRZ1hO8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
access-control-allow-credentials: false
x-robots-tag: none
content-length: 2

Verdicts & Comments Add Verdict or Comment

99 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.blog.reversinglabs.com/	1969-12-31 23:59:59	Name: __cfruid Value: 05f51c553a54e48ca6841c54e62d7320b49ce970-1656851656
blog.reversinglabs.com/	1970-01-20 12:59:47	Name: d-a8e6 Value: 5acd0994-6638-4fd9-bed0-5dfdcbe2eb14
blog.reversinglabs.com/	1970-01-20 04:14:12	Name: s-9da4 Value: e3c8e5c7-407a-4fae-81f5-c104e919922a
.reversinglabs.com/	1970-01-20 21:45:23	Name: _ga Value: GA1.2.548120493.1656851657
.reversinglabs.com/	1970-01-20 04:15:38	Name: _gid Value: GA1.2.958367747.1656851657
.reversinglabs.com/	1970-01-20 04:14:11	Name: _gat_UA-32828290-1 Value: 1
.hubspot.com/	1970-01-20 04:14:13	Name: __cf_bm Value: h3Dq7w_Hs7wIeIzT79njEzQZGRkeL1H7Vw28Xp0n4Qw-1656851657-0-Ack8nc9JeeHVKgya5VPixs7J1mdPSO4uEOukVobZqDCMsuRmgoDUwC9p7TWBkW7gkk814S9HvM5YdGjUukXfNwU=
.linkedin.com/	1970-01-20 04:57:23	Name: UserMatchHistory Value: AQLrmgUnSXI2ggAAAYHEDfGro6fHi0-y19iGrSEUc53ajCUyHAyPGzTrbA7FC8oJDHScMqkeJKRQmw
.linkedin.com/	1970-01-20 04:57:23	Name: AnalyticsSyncHistory Value: AQI9Sw53lxFnZAAAAYHEDfGrw8MtQmKIeMyJJmBifZgtgtMwejU1zfDLSiBaJaJUKPg4vTB7Oup0zbDWTMrSBg
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 21:46:05	Name: bcookie Value: "v=2&0b2d75fc-5c7e-4152-8ec0-6601d65dc7de"
.linkedin.com/	1970-01-20 04:15:38	Name: lidc Value: "b=VGST05:s=V:r=V:a=V:p=V:g=2519:u=1:x=1:i=1656851657:t=1656938057:v=2:sig=AQH0B2mLLF7EEmplbG3AO0S7ncXrqrug"
.twitter.com/	1970-01-20 21:45:23	Name: personalization_id Value: "v1_aNqNIrxfvCmqSj67EfucSg=="
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 21:46:05	Name: bscookie Value: "v=1&202207031234173ab1642a-7dce-4977-87c6-489c17115b4cAQE6vQ_9pH6Kx0A0JR7Vr0h0u8fqYd7f"
.linkedin.com/	1970-01-20 21:41:02	Name: li_gc Value: MTswOzE2NTY4NTE2NTc7MjswMjHDhASOhofB5fS3F+IVEbu3Lwho4uHfq03r/1wo0mYi7g==
.t.co/	1970-01-20 21:45:23	Name: muc_ads Value: b42ded11-37f7-4ec9-a055-2ffdfb616b57
code.visitor-track.com/	1970-01-22 00:03:38	Name: cke110888 Value: 7/3/2022 8:34:17 AM
.reversinglabs.com/	1970-01-20 04:14:11	Name: _gat Value: 1
.reversinglabs.com/	1970-01-20 08:33:23	Name: __hstc Value: 60854195.6c8a30fd18671948c49bf1f797a55057.1656851657803.1656851657803.1656851657803.1
.reversinglabs.com/	1970-01-20 08:33:23	Name: hubspotutk Value: 6c8a30fd18671948c49bf1f797a55057
.reversinglabs.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.reversinglabs.com/	1970-01-20 04:14:13	Name: __hssc Value: 60854195.1.1656851657803
.reversinglabs.com/	1970-01-20 06:23:47	Name: _gcl_au Value: 1.1.1173466416.1656851658
.doubleclick.net/	1970-01-20 04:14:12	Name: test_cookie Value: CheckForPermission

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3375217.fs1.hubspotusercontent-na1.net
analytics.twitter.com
api.hubapi.com
app.hubspot.com
blog.reversinglabs.com
cdn2.hubspot.net
cdnjs.cloudflare.com
code.visitor-track.com
connect.facebook.net
cookieinfoscript.com
fonts.googleapis.com
fonts.gstatic.com
forms.hsforms.com
forms.hubspot.com
googleads.g.doubleclick.net
insight.adsrvr.org
js.adsrvr.org
js.hs-analytics.net
js.hs-banner.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsleadflows.net
js.usemessages.com
match.adsrvr.org
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
px4.ads.linkedin.com
snap.licdn.com
static.ads-twitter.com
syndication.twitter.com
t.co
track.hubspot.com
vidassets.terminus.services
wec-assets-api.terminus.services
wec-assets.terminus.services
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
104.244.42.136
104.244.42.5
104.244.42.67
108.138.15.119
13.107.42.14
142.250.185.98
15.197.193.217
184.73.136.239
199.232.188.157
2001:4860:4802:34::178
2606:2800:234:59:254c:406:2366:268c
2606:2c40::c73c:67e1
2606:4700:4400::6812:2128
2606:4700:4400::6812:21ab
2606:4700::6810:5505
2606:4700::6811:180e
2606:4700::6811:45b0
2606:4700::6811:70b0
2606:4700::6811:83ab
2606:4700::6811:cacc
2606:4700::6811:e7cc
2606:4700::6811:ebcc
2606:4700::6811:f3cc
2606:4700::6813:9a53
2606:4700::6813:9b53
2620:1ec:22::14
2a00:1450:4001:80b::2004
2a00:1450:4001:80b::200a
2a00:1450:4001:812::2003
2a00:1450:4001:828::2003
2a00:1450:4001:829::2008
2a00:1450:4001:831::2002
2a02:26f0:3500:16::215:149b
2a03:2880:f01c:216:face:b00c:0:3
2a06:98c1:3121::3
54.192.235.25
63.134.242.129
65.9.66.24
00e67a6bb1601297c954a9c6438eb956f4ca87253683fb348d1bda64cee7d1ca
098f1a1400af17ccadd35f423d47cc1eab1e8e814f73a98c3bd034e4dea62c08
0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f
116f0348d85f772797147df6f967e3dd5f8042b50397ec3c03ece955bb7ff050
130eb7bbe1dca232b6636767637e6bdc2a35fc2d412db3a601593d79c1d743a5
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
1a14cd0f8d0b18174b22fedf6f236919a8054841fc44ec04f6ff736f37a155a5
1a5131ba88c40e02e211f48163838569b854a383f19817b94db2f4e83f5d044d
1c3e77a8508579f22773af270208521818d6d5ebe0eb52bb3012d5b61be3f8c7
249d08c8fde3e1912f9d6d25ff14eed26f4adea29df815b794933eb133f8ec37
27215dede1579d37bcf4ab9ef8fc7d968bd02081c4e61d77837a9bb8f6ca9511
27dd472678efb842d72ada8c920d853f768e1c40ac3c62d57d4d8eb4cc8fd72e
3497336ec7ea12302321a9ae41791152eed221c019bed610a8b8fa14b3d336dc
37eae8190baecf55f16575bf754238976116ad37b55f81e27db05743461cd507
3ac9f879f23b53c0856f5a719a5d2913f2890b5e06b60a8879945c245080fc52
3f324aa4ab522a6879525cae1bb4e10fb0edaed434f27ee581c0ffba75bd5ed8
41ac7f7c2a05d8a7ac157e7b70327e9ac39639c2a1e92bd7d53ef4ac80ce5888
44f00ad44f0a2b3147df86caf6911b20510316f7807f16e567fc81d37c71c2ef
4912ee681331bde8c20961cbe6a09ae41fff1b6b53a1b7e54eaa5a2086237921
4996f006d130c16e961b99b90d3fd17f44d20a2292034c40e81183f958f97d41
4ed697a94ae987ec690170223f411112068b61caf8678788cb4c37347249fd00
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
589ec6096d83ed322d2e1cf7b85f978ecfe80dc19aab6ac106ef5e2352e32269
60b35617b60f5fe8ef7051bea1a6e904cee349368227d51896c87cf33fccaf4d
62eff55da34fb881e5f26498f4c572a8810f8fb1953e8e00c24df6a05deb2747
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e
716dcc9643502eb35aa1f08b4805ec1f377daad3e67c11f9d00d65c6fc6336cf
75749ff8315dd4c7fc5e2e66cf558eb472b876c76a0a42088c0fc91c4bdbf61b
7ce75ed03aa6183977e623ebe11ac60f1bc0dab6da76cc6e7fb7076abe1209a9
8309531b6b2107c16edd77efa774374f935a7924a84c7bae72973f19b962e0e5
84240275eed2746f9d66bb0a5f46915d74ba6a7c6e210ba4634a16e03ca54270
84967c4e03cea78139700967fe57d0acfd5fbe1002c2d08819ccfd21e095bc4b
88cf3f1179617354f59936ef982f428957c08ff78aa5b5656b33929d69fde3ab
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
9103cd19fa0db417520474c8682d15529708804e7d5dcee981c8a19a7c083875
9178d19c46b5a36fc8d4de24aa7fef3b62e7f69c259f4e81ee3f2d5aba263216
94a1be30df2f2f15eb2fed750eca74ec60d4d6f554ee50334bce0ce9db69bd3a
9a612c9ad7bdfdfeb71ed257ea676a5bca9db5694ee8a0f0c1f8a96330429ea3
9d2b2e64648028c0f4b7da490e3ccf6bba1c2000280836f8e249a3e428497b63
9e634b615e771259a6dc723ef2cda097c480ad26dc92faa6450c5e4e16e3288a
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a15f95e938fbfd9ffef12a20682cdb3eebc3cfefa4843ceab38d0ff1a612cbda
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a969e5f8c4950230af86fcc3fa95485eb505cb6c58574146b87115ee6bd7bfdf
aa6959acd3d64822ef7379e437fce6b84a5cd3169003e955e2fffbdb2526d086
aba43a2f3d0af8618f96387996f22eeacbb19e61315e1de7513be0276f987fae
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1
bc595999f7c46e3f7a293c86fcc256c35467e9947bf0051464628416f1db14f0
beb0dcd50ff2c23c8b9805769aba86b5c19e0de8cb28f6b0d2f4ca85549f3840
c1735eb383eb50ca008fe72ad3d1575c0cfb7cff75b3152d423cd9cdd01a1932
c44bc92eb78d7b1596789095812e8c24f5c3f9b4835318cf329204d1efc37abb
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
c9b277f813652ab4fc3476fe4b9771d2d29e10204caef39416ad8d30e45fc5a2
cf5180580367cd0ffed7dc3ac8bd32e0b172c2f8bbc0f757ed99991cb0f2940b
d6dc97993d7e4803aeb35d0e9a24f0393eceb43de5f7ff0f0e437f1b05aea4e2
d8bb49d76bb427a9a5ee963b46cf89a592f357b5a5d07bd91f8df1face6a2da5
d8bbac923800b8fa88df465e6c7d59cb4e09ad2eac12c42a5b54fbd5aeff01da
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dccafac57a7fcedce0d95d35007b502104f45b82f43f052159c370258ef13a53
dd03eda5317d9d62243195e41b4b52d55640561480d2682fcf6daf9b90987434
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5ce094dcd9502358a429f85c3709174d297b727cc36da4720b08913f6e50a2c
e7dd5b6144da74dff71897fd2664818dba760b4b5076cdc997fcb9469e7ca655
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efc779b65d1bf5836f71be76b94db94fc2605b6d028fd8fe92ed25064e6e1983
f35c317df74c5ceaca83bc620ab17f68e882a21e5378933002f20aae3af0517f
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f8b8c8146d6359d62410c5da0c4573717f95f8a2e79fcdf1c3ab242a70d10488
fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60
fcc8f262b680a237e1131c2c91cd6804004e994db21c98ae3e418853bb08abf4
fd31c0fcae5f15bff494e99b37fc50834aceef91b8c6ac49b9bf29d5194e052d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

blog.reversinglabs.com Open in urlscan Pro 2606:2c40::c73c:67e1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

88 Requests

98 %HTTPS

68 %IPv6

31 Domains

42 Subdomains

37 IPs

2 Countries

1649 kBTransfer

3724 kBSize

25 Cookies

59 Outgoing links

Redirected requests

88 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.reversinglabs.com Open in urlscan Pro
2606:2c40::c73c:67e1 Public Scan

Screenshot
Live screenshot

Full Image

88
Requests

98 %
HTTPS

68 %
IPv6

31
Domains

42
Subdomains

37
IPs

2
Countries

1649 kB
Transfer

3724 kB
Size

25
Cookies

88 HTTP transactions
1 data transactions