urlscan.io logo urlscan.io
SecurityTrails logo

forums.malwarebytes.com Open in urlscan Pro
54.230.93.28  Public Scan

Go To Rescan Add Verdict Report
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Submission: On June 17 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 18 IPs in 4 countries across 18 domains to perform 40 HTTP transactions. The main IP is 54.230.93.28, located in Seattle, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is forums.malwarebytes.com.
TLS certificate: Issued by Amazon on October 19th 2018. Valid for: a year.
This is the only time forums.malwarebytes.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 54.230.93.28 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
15 2600:9000:200... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 3 2a00:1450:400... 15169 (GOOGLE)
3 2a03:2880:f01... 32934 (FACEBOOK)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 151.101.1.2 54113 (FASTLY)
1 2 52.30.162.218 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 54.172.190.168 14618 (AMAZON-AES)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 54.230.93.98 16509 (AMAZON-02)
1 54.230.93.86 16509 (AMAZON-02)
2 2 52.213.182.66 16509 (AMAZON-02)
1 54.230.93.112 16509 (AMAZON-02)
1 34.95.92.78 15169 (GOOGLE)
40 18
4    54.230.93.28 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-93-28.fra2.r.cloudfront.net
forums.malwarebytes.com
1    2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
15    2600:9000:200c:3600:1e:ebe7:1480:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
content.invisioncic.com
1    2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
3    2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
3    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net
2    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
bat.bing.com
1    151.101.1.2 (United States)

ASN54113 (FASTLY - Fastly, US)
a.quora.com
2    52.30.162.218 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-30-162-218.eu-west-1.compute.amazonaws.com
ads.avocet.io
2    2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
1    2a00:1450:400c:c0a::9c (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
1    2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
1    2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
1    54.172.190.168 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-172-190-168.compute-1.amazonaws.com
q.quora.com
2    2a03:2880:f11c:8083:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
www.facebook.com
1    54.230.93.98 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-93-98.fra2.r.cloudfront.net
scripts.demandbase.com
1    54.230.93.86 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-93-86.fra2.r.cloudfront.net
api.company-target.com
2    52.213.182.66 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-213-182-66.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
1    54.230.93.112 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-93-112.fra2.r.cloudfront.net
segments.company-target.com
1    34.95.92.78 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 78.92.95.34.bc.googleusercontent.com
id.rlcdn.com
Domain Requested by
15 content.invisioncic.com forums.malwarebytes.com
4 forums.malwarebytes.com forums.malwarebytes.com
www.google-analytics.com
3 connect.facebook.net forums.malwarebytes.com
connect.facebook.net
3 www.google-analytics.com 1 redirects forums.malwarebytes.com
2 match.prod.bidr.io 2 redirects
2 www.facebook.com forums.malwarebytes.com
connect.facebook.net
2 fonts.gstatic.com www.google-analytics.com
2 ads.avocet.io 1 redirects forums.malwarebytes.com
2 bat.bing.com forums.malwarebytes.com
1 id.rlcdn.com forums.malwarebytes.com
1 segments.company-target.com forums.malwarebytes.com
1 api.company-target.com scripts.demandbase.com
1 scripts.demandbase.com forums.malwarebytes.com
1 q.quora.com forums.malwarebytes.com
1 www.google.de forums.malwarebytes.com
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 a.quora.com forums.malwarebytes.com
1 www.googletagmanager.com forums.malwarebytes.com
1 fonts.googleapis.com forums.malwarebytes.com
40 20
Subject Issuer Validity Valid
forums.malwarebytes.org
Amazon		 2018-10-19 -
2019-11-19		 a year crt.sh
*.googleapis.com
Google Internet Authority G3		 2019-05-21 -
2019-08-13		 3 months crt.sh
content.invisioncic.com
Amazon		 2018-10-10 -
2019-11-10		 a year crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-05-21 -
2019-08-13		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-06-06 -
2019-09-04		 3 months crt.sh
www.bing.com
Microsoft IT TLS CA 5		 2017-07-20 -
2019-07-10		 2 years crt.sh
*.quora.com
DigiCert SHA2 Secure Server CA		 2018-08-15 -
2019-11-26		 a year crt.sh
*.avocet.io
Amazon		 2018-08-03 -
2019-09-03		 a year crt.sh
*.google.com
Google Internet Authority G3		 2019-05-21 -
2019-08-13		 3 months crt.sh
www.google.de
Google Internet Authority G3		 2019-05-21 -
2019-08-13		 3 months crt.sh
*.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2018-09-20 -
2020-11-19		 2 years crt.sh
*.company-target.com
Go Daddy Secure Certificate Authority - G2		 2017-08-18 -
2019-08-18		 2 years crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2019-04-24 -
2020-04-23		 a year crt.sh

This page contains 2 frames:

Primary Page: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Frame ID: 59D910116D90694316985927A9E75EF5
Requests: 58 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 3708944DB6C5C0008568E29BC4A68046
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /php\/?([\d.]+)?/i
Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Overall confidence: 100%
Detected patterns
  • headers server /\(Amazon\)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
  • headers server /\(Amazon\)/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
  • html /<!-- (?:End )?Google Tag Manager -->/i

Page Statistics

40
Requests

100 %
HTTPS

55 %
IPv6

18
Domains

20
Subdomains

18
IPs

4
Countries

635 kB
Transfer

2355 kB
Size

11
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 40
  • https://ads.avocet.io/s?add=5b8e9b462be173e55d6569fc&ty=j HTTP 302
  • https://ads.avocet.io/s?add=5b8e9b462be173e55d6569fc&bounce=true&ty=j
Request Chain 47
  • https://www.google-analytics.com/r/collect?v=1&_v=j76&a=2143275215&t=pageview&_s=1&dl=https%3A%2F%2Fforums.malwarebytes.com%2Ftopic%2F248314-adobe-acedll-backdoorremcos%2F&ul=en-us&de=UTF-8&dt=Adobe%20ace.dll%20Backdoor.Remcos%20-%20File%20Detections%20-%20Malwarebytes%20Forums&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=1674543655&gjid=747110242&cid=375216633.1560778106&tid=UA-3347303-10&_gid=30574921.1560778106&_r=1&z=1864703604 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-3347303-10&cid=375216633.1560778106&jid=1674543655&_gid=30574921.1560778106&gjid=747110242&_v=j76&z=1864703604 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=375216633.1560778106&jid=1674543655&_v=j76&z=1864703604 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=375216633.1560778106&jid=1674543655&_v=j76&z=1864703604&slf_rd=1&random=3571016962
Request Chain 54
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AAMnF066DysAACFSTJ_QKQ

40 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/ 		338 KB
29 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.93.28 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-93-28.fra2.r.cloudfront.net
Software
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.29 / PHP/7.1.29
Resource Hash
8c65118fc7f32af81b7be8f2ceac3f039d87b1f1f1d1ee74dd1f4556646e9974
Security Headers
Name Value
X-Frame-Options sameorigin
X-Xss-Protection 0

Request headers

:method
GET
:authority
forums.malwarebytes.com
:scheme
https
:path
/topic/248314-adobe-acedll-backdoorremcos/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
content-type
text/html;charset=UTF-8
content-length
29118
date
Mon, 17 Jun 2019 13:28:26 GMT
server
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.29
x-powered-by
PHP/7.1.29
set-cookie
SimpleSAMLSessionID=9746e3d15804dccf980969276baba511; path=/; HttpOnly ips4_IPSSessionFront=ann8tjnb8qv5jvn15q7fgnkg7v; path=/; secure; HttpOnly ips4_guestTime=1560778106; path=/; secure; HttpOnly
expires
Mon, 17 Jun 2019 13:43:26 GMT
cache-control
max-age=900, public
pragma
public
x-ips-loggedin
0
content-encoding
gzip
x-xss-protection
0
x-frame-options
sameorigin
x-ips-cached-response
Mon, 17 Jun 2019 13:16:54 GMT
last-modified
Mon, 17 Jun 2019 13:16:54 GMT
vary
cookie,Accept-Encoding
x-cache
Miss from cloudfront
via
1.1 d2625240b33e8b85b3cbea9bb40abb10.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2
x-amz-cf-id
Y-_7kR6puUkohJhUQ841AeB6kFZ3Xqr3FMPGKk9xF04YHvw3fPozHg==
css
fonts.googleapis.com/ 		14 KB
922 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
e65d975421a7b00dfd4e5081843f6990b632dd6e7d36ac5d1fb78cf8d5d3308a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://forums.malwarebytes.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 17 Jun 2019 13:28:26 GMT
server
ESF
access-control-allow-origin
*
date
Mon, 17 Jun 2019 13:28:26 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Mon, 17 Jun 2019 13:28:26 GMT
341e4a57816af3ba440d891ca87450ff_framework.css.6ba7ddfaad0794590d43d8f7dea96728.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		242 KB
45 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/341e4a57816af3ba440d891ca87450ff_framework.css.6ba7ddfaad0794590d43d8f7dea96728.css.gz?v=a90d54f478
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6ae7e26bd0c7f7f6055ee53fb899f13b1e405f3c7dc28db6889e394c19ed61f9

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 05 Jun 2019 17:14:37 GMT
content-encoding
gzip
last-modified
Wed, 05 Jun 2019 17:13:16 GMT
server
AmazonS3
age
1023230
etag
"a849b5c84ad85e61168457e09d6b9429"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
45388
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
FLtRtIjvpTjftCtXuX66KU38HwRrxdzuH5qYg02wNc7ugILX9sdkGw==
05e81b71abe4f22d6eb8d1a929494829_responsive.css.2ba1c056011b1a1f6de547592de6bd9f.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		39 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/05e81b71abe4f22d6eb8d1a929494829_responsive.css.2ba1c056011b1a1f6de547592de6bd9f.css.gz?v=a90d54f478
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b93ec34dd2b61dbf35968eb2e3190fb8925e5346cbc553cd3abb00a65462fd62

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 05 Jun 2019 17:14:37 GMT
content-encoding
gzip
last-modified
Wed, 05 Jun 2019 17:13:16 GMT
server
AmazonS3
age
1023230
etag
"f84b82c1090237c4e87b594f548e2eb0"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
6947
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
lURjqyyxGFcrFoqFt3zcBASLZioOzYaQ3P0cLtU_3HvuPJ6GDCj_Sw==
90eb5adf50a8c640f633d47fd7eb1778_core.css.83e1e486c74dde2cc6f37831ca303a5c.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		17 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/90eb5adf50a8c640f633d47fd7eb1778_core.css.83e1e486c74dde2cc6f37831ca303a5c.css.gz?v=a90d54f478
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
67fa2b1feb9214b6164fbfc808a3a571012295a87137a053d6853d5e3020b708

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 05 Jun 2019 17:14:37 GMT
content-encoding
gzip
last-modified
Wed, 05 Jun 2019 17:13:16 GMT
server
AmazonS3
age
1023230
etag
"29877684149502c52e4d37a265f70bac"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
4255
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
NS3is2e2Xoi8zazeE-8Id5QO_OzB6vdloBwWHNPAfMlT7dAS1jcOKw==
5a0da001ccc2200dc5625c3f3934497d_core_responsive.css.39e3c1d6616395aaa4cbb4d0518e4308.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/5a0da001ccc2200dc5625c3f3934497d_core_responsive.css.39e3c1d6616395aaa4cbb4d0518e4308.css.gz?v=a90d54f478
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
159308ebb6cd30326aa68872f9a327c7b99ec1a2d167d509ff333bec2e098b79

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 05 Jun 2019 17:14:36 GMT
content-encoding
gzip
last-modified
Wed, 05 Jun 2019 17:13:16 GMT
server
AmazonS3
age
1023231
etag
"13f5acdedbe072ab728bfa6a66911ac5"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
861
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
T3wDjccy6hyspamB6UfH-yngMPz0I735HbjSxhcxU-9q2GaVAW9-uA==
62e269ced0fdab7e30e026f1d30ae516_forums.css.748deb46b35619a29f665762520381a2.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		9 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/62e269ced0fdab7e30e026f1d30ae516_forums.css.748deb46b35619a29f665762520381a2.css.gz?v=a90d54f478
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f60e704278243c82c28bc263d0ad6f0fbda6f71099c6e72b799e0b719dba5d50

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 05 Jun 2019 17:14:37 GMT
content-encoding
gzip
last-modified
Wed, 05 Jun 2019 17:13:21 GMT
server
AmazonS3
age
1023230
etag
"c5c0ecf9e679269ae395745b4bc18968"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
2318
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
xIKAZvuvwxumCK_1bp4rMjZhHG-fOYgobqks1GjC-VO5wyRyrehw5Q==
76e62c573090645fb99a15a363d8620e_forums_responsive.css.97636a07bc265470b73121b6cf4deb2a.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/76e62c573090645fb99a15a363d8620e_forums_responsive.css.97636a07bc265470b73121b6cf4deb2a.css.gz?v=a90d54f478
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f0bec4e20bc4af56f95159be1e6dd93c1150eae46e1aabd71db1b5d937af44bb

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 05 Jun 2019 17:14:37 GMT
content-encoding
gzip
last-modified
Wed, 05 Jun 2019 17:13:22 GMT
server
AmazonS3
age
1023230
etag
"9fb695e8d405bd590a1236d4ccfd0c07"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
1463
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
CJ3Ap-nUgx5udU_ksu9TlP6O3TnQXQVFpNsNf13k7GX-JYq8K5xwJA==
258adbb6e4f3e83cd3b355f84e3fa002_custom.css.b2a9873b30375999b32a4fe05278b4fb.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		421 B
661 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/258adbb6e4f3e83cd3b355f84e3fa002_custom.css.b2a9873b30375999b32a4fe05278b4fb.css.gz?v=a90d54f478
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b205e1f29eb67183b5c3008c3de8446373fe9bfcfed7b08ab0f1ec84ab81e28c

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 05 Jun 2019 17:14:37 GMT
content-encoding
gzip
last-modified
Wed, 05 Jun 2019 17:13:21 GMT
server
AmazonS3
age
1023230
etag
"331987caa62d2971f39e2db1d41f034b"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
293
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
LpG-ozBuOsX-a1GHWss2w_J9Lo36D-vggEYUsSXQeIr0tfbd9UJ9nw==
gtm.js
www.googletagmanager.com/ 		129 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
64ebb03b21b95717182cb69a716ae68e55d1adffab56cf06097e16c087d775c8
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 17 Jun 2019 13:28:26 GMT
content-encoding
br
last-modified
Thu, 13 Jun 2019 17:57:39 GMT
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
32151
x-xss-protection
0
expires
Mon, 17 Jun 2019 13:28:26 GMT
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ce2a4529dcbbc7e3252d1dd0c3296f7ed24d2078550a120678319def3b6d8823

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
be8ac08c52cf934773a4cdf37b2cc2c2fbdc9bb150dc2aa4b1aa5750cbf9bac0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1cb63eb6ae84e843eeb7faee1c74f138d71033b9f86bdfbd01a015d8db9a8b4b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2c38dcd9d7f538e33221bd60440f0e2b4c2c4d55659f250bc8bda3f5021a2904

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5214659485e3c8fa52d4136833c137b6d59aaba117354f931d1faa2a8035be87

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e797d2f1c05ddbf610bdead3fdf31d6fc7c41c25384aa231f78f3f926561e021

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
200aace718c613768ef69624a9ddc8f4ca5b3cf08f3b7fde2d6a37cd060d7db9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
58bde59e40debc2af060644ddc080ef12782f0707f86aa7f364f7b8bbd5dc055

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7f759e4139b8aef838a7702c06abc250c95409905c69025d2b7de4ca57c5685

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0f0061d1d23d6031ae646f122bb53c6ef16a1e851b4418d7f4972a52c5aaba5e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
59772704619f5b8fb4fec419fae70ffaa4515bd43cb99dc0379e8e485f132390

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6065f3f1cf33dcf6f5c38a416204e0c65f3efdbd6172a68e8aaffe8d8a4e90c8

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1453866b09805fb0385d36399df8712732d1a79769e1dc817b9dccb24d8d468f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
686d5450a8f423e984d013b696d0cdd838624d2772854b6a6ce5219f5ee03cc2

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
52a4db3382f53de7e4591f969d32a39111d326bafd661748853cf81dbd81f180

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
312269e67a8fb9aac2fc6fbb087ae80d61e491d91a37deae06c7e7694bf6f360

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a2d37ed961f70b8ce884b94aaaee1c5e61c25442702f9aa174f87e2a9b681048

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
howler.core.min.js
forums.malwarebytes.com/applications/core/interface/howler/ 		25 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://forums.malwarebytes.com/applications/core/interface/howler/howler.core.min.js?v=a90d54f478
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.93.28 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-93-28.fra2.r.cloudfront.net
Software
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.29 /
Resource Hash
6e82fac3e6fe3d4a6a1ca85954bfa835f8d49f85a95cbd8c51d3a01537bcd9f8

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 17 Jun 2019 13:28:26 GMT
content-encoding
gzip
last-modified
Tue, 05 Mar 2019 12:46:41 GMT
server
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.29
x-amz-cf-pop
FRA2
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/javascript
status
200
cache-control
max-age=31536000, public
x-amz-cf-id
XPRTe-1E2fEQ4F5W4mjcFYbKkcNnsZc7rzFjNdcZrn49dYTHv7iANg==
via
1.1 d2625240b33e8b85b3cbea9bb40abb10.cloudfront.net (CloudFront)
root_library.js.ae862fea3f9c4bcffb0babe494230385.js.gz
content.invisioncic.com/Mmalware/javascript_global/ 		365 KB
121 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_global/root_library.js.ae862fea3f9c4bcffb0babe494230385.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
37da679dae9dcbb9d05773aea1dcfaf6a4b1b1c123b70cb706b31b4114e9de0d

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 14 Jun 2019 22:03:33 GMT
content-encoding
gzip
last-modified
Fri, 14 Jun 2019 22:03:24 GMT
server
AmazonS3
age
228294
etag
"363b323a50846137e80fa6ff98c237ba"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
123435
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
q_wlyjmbRUVVnj-IqGBEYspfrHwot_CKwmbEWr3f6HGtBrMUZvaPvg==
root_js_lang_1.js.0215b411d957f60dcfbf52b09459ae1b.js.gz
content.invisioncic.com/Mmalware/javascript_global/ 		90 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_global/root_js_lang_1.js.0215b411d957f60dcfbf52b09459ae1b.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f9277bb87d53d016ba4039e4b3f5d37f72a9bfd5f9a045347f4651cb5f2dabd2

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 14 Jun 2019 22:03:33 GMT
content-encoding
gzip
last-modified
Fri, 14 Jun 2019 22:03:22 GMT
server
AmazonS3
age
228294
etag
"4c7a9cdc6176b2ea482e32d439b252db"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
28274
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
v9qdUNnNQV-ScJC3vZOgutJly9ZWI46MnvxLXDpX4QHEiCygsQpffg==
root_framework.js.46bafddd4db08f7084e9f3afc43ee943.js.gz
content.invisioncic.com/Mmalware/javascript_global/ 		390 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_global/root_framework.js.46bafddd4db08f7084e9f3afc43ee943.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5c0b8f8ceccd0a8ce7f980ec4fc2cb4f700d542e08654b419b5b6ea89da2c50f

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 14 Jun 2019 22:03:33 GMT
content-encoding
gzip
last-modified
Fri, 14 Jun 2019 22:03:23 GMT
server
AmazonS3
age
228294
etag
"fddc1814713fba0a2d215f71ca2cf6dc"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
91720
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
SEEZX_R7YsIVNTMAxU25JWjzjv_R5pDgbEdzg7P6-1CEjsVvIRnqbg==
global_global_core.js.6742c56a10996ea9170d0bff7b11299c.js.gz
content.invisioncic.com/Mmalware/javascript_core/ 		34 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_core/global_global_core.js.6742c56a10996ea9170d0bff7b11299c.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bcaaf20ac6ef417373cc644239886d33074acf1ce9a96dea972012e76d753ae2

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 14 Jun 2019 22:03:33 GMT
content-encoding
gzip
last-modified
Fri, 14 Jun 2019 22:03:24 GMT
server
AmazonS3
age
228294
etag
"5b9563da005df168ba5d88f4e8e189c8"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
8284
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
_XRXpCyFnqxnAKDnYfH-5O1pxUvPIdbbwp2JDqV--qj93B0fh42WZw==
root_front.js.5ec3103312482e59099590840e27c556.js.gz
content.invisioncic.com/Mmalware/javascript_global/ 		100 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_global/root_front.js.5ec3103312482e59099590840e27c556.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
db27a9a2397c8f1aa6e7cc67e01d5f4fd8480a9118db49a1e509502427187a15

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 14 Jun 2019 22:03:33 GMT
content-encoding
gzip
last-modified
Fri, 14 Jun 2019 22:03:26 GMT
server
AmazonS3
age
228294
etag
"a3ca30d0bdff072b3dfc0ca3cf165c93"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
22098
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
9pteq40HDKh-gU5yGxMlO1Hp4le1KmVYRL0akfCXtGPVc6tuwE6GTw==
front_front_topic.js.0d2c779566b2abd9987bc24b4b7ececa.js.gz
content.invisioncic.com/Mmalware/javascript_forums/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_forums/front_front_topic.js.0d2c779566b2abd9987bc24b4b7ececa.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8ebfaf5d9b1e7bbb4c771ff350b691bcfcabe0eeea0257db821be87013fb0997

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 14 Jun 2019 22:03:33 GMT
content-encoding
gzip
last-modified
Fri, 14 Jun 2019 22:03:26 GMT
server
AmazonS3
age
228294
etag
"3804c2672345ff377fdba0a8bbe516b5"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
916
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
8ZhEnh-oVE90QZzzX5_aA2a260xqoihGxoG2T0wBCv5YQzZp88azfQ==
front_front_core.js.1ae2d64de04d370a7da407681d59573e.js.gz
content.invisioncic.com/Mmalware/javascript_core/ 		26 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_core/front_front_core.js.1ae2d64de04d370a7da407681d59573e.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a4ba928e1711d52c3252307d1f2eb0a0b6f36cd4389516ffa4bdcd78588a0b4e

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 14 Jun 2019 22:03:33 GMT
content-encoding
gzip
last-modified
Fri, 14 Jun 2019 22:03:30 GMT
server
AmazonS3
age
228294
etag
"aae3abb426964a62f6aa4c62820087d2"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
6336
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
iDjY-U1bdZfMpB9P07IMQ69chNeJoXfDCDyobZthySfuctFmlvy2ZA==
root_map.js.06f023413fd4fabc45417030a2dabd93.js.gz
content.invisioncic.com/Mmalware/javascript_global/ 		2 KB
996 B 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_global/root_map.js.06f023413fd4fabc45417030a2dabd93.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:3600:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fa5af2e7c80262aa4ab129f055e2b8bef17e4c15f6e2b5f7502d74e78560f2c8

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 15 Jun 2019 21:38:36 GMT
content-encoding
gzip
last-modified
Sat, 15 Jun 2019 21:38:12 GMT
server
AmazonS3
age
143391
etag
"1b34f2b2ac7dff6107a53a9d04b977d5"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2
accept-ranges
bytes
content-length
620
via
1.1 a2289d8b15b881db1c42086062568883.cloudfront.net (CloudFront)
x-amz-cf-id
AARrwZqNFZb3-wxkSRmkzt6voXme_IB7S9Uky8GhgjL-KkDfWQtR9g==
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0c4cd720167fdc33a83dc8275730e25bd41c2d83b0540c39bb3eb9105945ec64

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8f88cb7a1cd4134f5d616b9fca90b9069fa16c162b7ae66ba1b500c490b41dd2
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 21 May 2019 23:53:44 GMT
server
Golfe2
age
1802
date
Mon, 17 Jun 2019 12:58:24 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17595
expires
Mon, 17 Jun 2019 14:58:24 GMT
fbevents.js
connect.facebook.net/en_US/ 		53 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
657f79c4d5a6ea502202651151811d195b49cf9cf22fd7f8edaeefe2f8cc8fc4
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
content-length
16120
x-xss-protection
0
pragma
public
x-fb-debug
Ksn5QEr3JGrR7TLT18ZLUX9udRdfXY2B7YXjdniYo9ONCfZLiCxDhS2VMhBYgNCOrpaFNPgQk5Ccp81jUCrlyg==
date
Mon, 17 Jun 2019 13:28:26 GMT
x-frame-options
DENY
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
bat.js
bat.bing.com/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
134d9689dd766fbea01b7b16563704e655883a93b76f55a6acf999f67510f8b5

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 17 Jun 2019 13:28:25 GMT
content-encoding
gzip
last-modified
Tue, 28 May 2019 20:50:22 GMT
x-msedge-ref
Ref A: 1B1980D5BAA74ABC9DBCAEADD7256A2C Ref B: VIEEDGE0711 Ref C: 2019-06-17T13:28:26Z
access-control-allow-origin
*
etag
"03b90f79615d51:0"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
7104
qevents.js
a.quora.com/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.quora.com/qevents.js
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.2 , United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bc8f028bc9cf52473a5950065ffbfec78b928fa5d01feeb85f57bd685442b854

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
pgDa9kc8qtkAn9MEyH9qaqyrC653nHan
content-encoding
gzip
age
4530
x-cache
HIT
status
200
date
Mon, 17 Jun 2019 13:28:26 GMT
content-length
3703
x-amz-id-2
qh/hX1W762fGfyckKLFh04jQIq9SlDys+qocTnasYXdI5IzBCZz/jg8dhvwXaCFJyE1iBcMtg7A=
x-served-by
cache-hhn1529-HHN
last-modified
Fri, 24 May 2019 02:19:28 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1558664366/ctime:1558664365/gid:1000000/gname:employee/md5:bef10a8274525e30ae5d4b917056fd85/mode:33188/mtime:1149709104/uid:1000230/uname:xiao
x-timer
S1560778106.394600,VS0,VE0
etag
"bef10a8274525e30ae5d4b917056fd85"
vary
Accept-Encoding
x-amz-request-id
F3984DEAC7B6FCDB
via
1.1 varnish
cache-control
max-age=7200
accept-ranges
bytes
content-type
binary/octet-stream
x-cache-hits
4076
s
ads.avocet.io/
Redirect Chain
  • https://ads.avocet.io/s?add=5b8e9b462be173e55d6569fc&ty=j
  • https://ads.avocet.io/s?add=5b8e9b462be173e55d6569fc&bounce=true&ty=j
0
394 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.avocet.io/s?add=5b8e9b462be173e55d6569fc&bounce=true&ty=j
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.30.162.218 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-30-162-218.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 17 Jun 2019 13:28:26 GMT
Connection
keep-alive
Content-Type
application/javascript
Content-Length
0
P3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

Location
/s?add=5b8e9b462be173e55d6569fc&bounce=true&ty=j
Date
Mon, 17 Jun 2019 13:28:26 GMT
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
79
P3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
1480959392203028
connect.facebook.net/signals/config/ 		228 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1480959392203028?v=2.8.51&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
b45fdce25329db456d15157ccdf9f075c10f979c786d96371ef933a010b7c560
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
content-length
61415
x-xss-protection
0
pragma
public
x-fb-debug
YFMMBtEfXwAv9TmmiDkgSqXKFi9UeXkQbondORzyNimIni5811c4lRPX1Z88TJJyQC4KPK1GH3yGo/t9Kq06ow==
date
Mon, 17 Jun 2019 13:28:26 GMT
x-frame-options
DENY
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/gif
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v19/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v19/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i
Origin
https://forums.malwarebytes.com

Response headers

date
Sun, 02 Jun 2019 04:36:10 GMT
x-content-type-options
nosniff
last-modified
Mon, 25 Mar 2019 20:13:33 GMT
server
sffe
age
1327936
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11016
x-xss-protection
0
expires
Mon, 01 Jun 2020 04:36:10 GMT
fontawesome-webfont.woff2
forums.malwarebytes.com/applications/core/interface/font/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://forums.malwarebytes.com/applications/core/interface/font/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.93.28 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-93-28.fra2.r.cloudfront.net
Software
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.29 /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://content.invisioncic.com/Mmalware/css_built_18/341e4a57816af3ba440d891ca87450ff_framework.css.6ba7ddfaad0794590d43d8f7dea96728.css.gz?v=a90d54f478
Origin
https://forums.malwarebytes.com

Response headers

date
Mon, 17 Jun 2019 13:28:26 GMT
via
1.1 d2625240b33e8b85b3cbea9bb40abb10.cloudfront.net (CloudFront)
last-modified
Tue, 05 Mar 2019 12:46:41 GMT
server
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.29
x-amz-cf-pop
FRA2
etag
"12d68-5835843c68e40"
x-cache
Miss from cloudfront
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
77160
x-amz-cf-id
-uA6XFkay4IsDTgoi6xziGQr91Vvx9Cw0V3IRdW0KQByDQcT4BVZew==
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v19/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v19/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i
Origin
https://forums.malwarebytes.com

Response headers

date
Sun, 02 Jun 2019 16:28:51 GMT
x-content-type-options
nosniff
last-modified
Mon, 25 Mar 2019 20:14:03 GMT
server
sffe
age
1285175
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11020
x-xss-protection
0
expires
Mon, 01 Jun 2020 16:28:51 GMT
icomoon.woff
forums.malwarebytes.com/applications/core/interface/font/ 		3 KB
3 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://forums.malwarebytes.com/applications/core/interface/font/icomoon.woff?v=-29n77j
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.93.28 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-93-28.fra2.r.cloudfront.net
Software
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.29 /
Resource Hash
c4dc92b008688c213242cfaf0cbe2bfd0fc689326a7b878cbc1cfa8afd87b763

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://content.invisioncic.com/Mmalware/css_built_18/341e4a57816af3ba440d891ca87450ff_framework.css.6ba7ddfaad0794590d43d8f7dea96728.css.gz?v=a90d54f478
Origin
https://forums.malwarebytes.com

Response headers

date
Mon, 17 Jun 2019 13:28:26 GMT
via
1.1 d2625240b33e8b85b3cbea9bb40abb10.cloudfront.net (CloudFront)
last-modified
Tue, 05 Mar 2019 12:46:41 GMT
server
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.29
x-amz-cf-pop
FRA2
etag
"a74-5835843c68e40"
x-cache
Miss from cloudfront
status
200
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
2676
x-amz-cf-id
IkeHofD6Yy23-faU1JsKcIpgqt4p9ijbYGrBBPpHQcD5JuzkrP0Y_A==
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j76&a=2143275215&t=pageview&_s=1&dl=https%3A%2F%2Fforums.malwarebytes.com%2Ftopic%2F248314-adobe-acedll-backdoorremcos%2F&ul=en-us&de=UTF-8&dt=Adob...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-3347303-10&cid=375216633.1560778106&jid=1674543655&_gid=30574921.1560778106&gjid=747110242&_v=j76&z=1864703604
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=375216633.1560778106&jid=1674543655&_v=j76&z=1864703604
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=375216633.1560778106&jid=1674543655&_v=j76&z=1864703604&slf_rd=1&random=3571016962
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=375216633.1560778106&jid=1674543655&_v=j76&z=1864703604&slf_rd=1&random=3571016962
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jun 2019 13:28:26 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 17 Jun 2019 13:28:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=375216633.1560778106&jid=1674543655&_v=j76&z=1864703604&slf_rd=1&random=3571016962
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
q.quora.com/_/ad/64fab857ca52427587d3bd14a8d437b7/ 		43 B
481 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://q.quora.com/_/ad/64fab857ca52427587d3bd14a8d437b7/pixel?j=1&u=https%3A%2F%2Fforums.malwarebytes.com%2Ftopic%2F248314-adobe-acedll-backdoorremcos%2F&tag=ViewContent&ts=1560778106507
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.172.190.168 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-172-190-168.compute-1.amazonaws.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 17 Jun 2019 13:28:26 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
X-Q-Stat
81,f52c496fa59d1174d0abce63ce8e0007,10.0.4.142,13386,185.130.184.117,,17029139802,1,1560778106.874,0.002,,.,0,0,0.000,0.000,-,0,0,326,339,169,10,26847,,,,,,,
Content-Type
image/gif
0
bat.bing.com/action/ 		0
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=4072696&Ver=2&mid=efe1bf0f-79cb-2dd8-5f33-75abacb17f0e&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Adobe%20ace.dll%20Backdoor.Remcos%20-%20File%20Detections%20-%20Malwarebytes%20Forums&p=https%3A%2F%2Fforums.malwarebytes.com%2Ftopic%2F248314-adobe-acedll-backdoorremcos%2F&r=&evt=pageLoad&msclkid=N&rn=153409
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
pragma
no-cache
date
Mon, 17 Jun 2019 13:28:25 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: E50F8824C66F49C7A231356038F3370B Ref B: VIEEDGE0711 Ref C: 2019-06-17T13:28:26Z
access-control-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
inferredEvents.js
connect.facebook.net/signals/plugins/ 		1 KB
895 B 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.8.51
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
cd1c301a8e7960a1786e2a959226b0b78b56dbea284bd114265f1662d6ca280e
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
content-length
772
x-xss-protection
0
pragma
public
x-fb-debug
ZcN7sasci0ht8sfFG955cDaDcm8+OzqyC9+3UcoFWvFLBR7c7/n2T62zooQjg8kVF4Cd44t55qUXPgay/r5CzQ==
date
Mon, 17 Jun 2019 13:28:26 GMT
x-frame-options
DENY
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
322 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1480959392203028&ev=ViewContent&dl=https%3A%2F%2Fforums.malwarebytes.com%2Ftopic%2F248314-adobe-acedll-backdoorremcos%2F&rl=&if=false&ts=1560778106707&sw=1600&sh=1200&v=2.8.51&r=stable&ec=0&o=30&fbp=fb.1.1560778106706.974090541&it=1560778106376&coo=false&rqm=GET
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 17 Jun 2019 13:28:26 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Mon, 17 Jun 2019 13:28:26 GMT
HWyTnY16.min.js
scripts.demandbase.com/ 		57 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://scripts.demandbase.com/HWyTnY16.min.js
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.93.98 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-93-98.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ef6906e2c2b9abcd71afd8c5b378f7cb0c39f07e99d27950da2286dff57feb8c

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
fQs4zTyvErIjdtMg.4Z_3nZ9cCZaoba3
content-encoding
gzip
last-modified
Fri, 14 Jun 2019 20:05:26 GMT
server
AmazonS3
age
2179
date
Mon, 17 Jun 2019 12:52:47 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-pop
FRA2
x-amz-cf-id
6T-YRm2OC-gjxjVQeL19SY9k2VdAGBDCs_rCt0Pq7i7T403WiQDMLg==
via
1.1 e72ed739d85b0c5633dfd1f214a1adca.cloudfront.net (CloudFront)
ip.json
api.company-target.com/api/v2/ 		438 B
955 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fforums.malwarebytes.com%2Ftopic%2F248314-adobe-acedll-backdoorremcos%2F&page_title=Adobe%20ace.dll%20Backdoor.Remcos%20-%20File%20Detections%20-%20Malwarebytes%20Forums&key=5527c2aa519592df7d44a24d0105731b&src=tag
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/HWyTnY16.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.93.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-93-86.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
321e370d72b883e156cd94f828ee2e866fcf2d8d949ed51ff8a39cdd55ff3b59

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Origin
https://forums.malwarebytes.com

Response headers

date
Mon, 17 Jun 2019 13:28:26 GMT
content-encoding
gzip
x-amz-cf-pop
FRA2
x-cache
Miss from cloudfront
status
200
access-control-max-age
1728000
request-id
ee5e6481-bf0f-45c1-819b-d27d81f03ef4
content-length
250
x-amz-cf-id
PAF4WkNJyviY6J_7mjXAO9JklL4PV52F5VubfbxL8Bc32-3te4Mkow==
pragma
no-cache
access-control-allow-origin
https://forums.malwarebytes.com
server
nginx
vary
Accept-Encoding, Origin
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 ae322f9f82b436687f3bcaf36433b2bb.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
identification-source
STANDARD
expires
Sun, 16 Jun 2019 13:28:26 GMT
log
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AAMnF066DysAACFSTJ_QKQ
26 B
666 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segments.company-target.com/log?vendor=choca&user_id=AAMnF066DysAACFSTJ_QKQ
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.93.112 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-93-112.fra2.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 17 Jun 2019 13:28:27 GMT
Via
1.1 a907498188cf5fbb13fb98b2dcde84cd.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA2
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Connection
keep-alive
Content-Length
26
X-Amz-Cf-Id
7dGNlrHgLjciHb9823cUyzuGirObmSiV0P8BmF3d2IVMAHnGQbg2-A==

Redirect headers

location
https://segments.company-target.com/log?vendor=choca&user_id=AAMnF066DysAACFSTJ_QKQ
Date
Mon, 17 Jun 2019 13:28:26 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
464526.gif
id.rlcdn.com/ 		0
62 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/464526.gif
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.92.78 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
78.92.95.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Mon, 17 Jun 2019 13:28:26 GMT
via
1.1 google
alt-svc
clear
collect
www.google-analytics.com/ 		35 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j76&a=2143275215&t=event&ni=1&_s=2&dl=https%3A%2F%2Fforums.malwarebytes.com%2Ftopic%2F248314-adobe-acedll-backdoorremcos%2F&ul=en-us&de=UTF-8&dt=Adobe%20ace.dll%20Backdoor.Remcos%20-%20File%20Detections%20-%20Malwarebytes%20Forums&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aHBAAEAB~&jid=&gjid=&cid=375216633.1560778106&tid=UA-3347303-10&_gid=30574921.1560778106&cd2=(Non-Company%20Visitor)&cd3=SOHO&cd4=(Non-Company%20Visitor)&cd5=(Non-Company%20Visitor)&cd6=(Non-Company%20Visitor)&cd7=(Non-Company%20Visitor)&cd8=(Non-Company%20Visitor)&cd9=(Non-Company%20Visitor)&cd10=(Non-Company%20Visitor)&cd11=Frankfurt%20am%20Main&cd12=HE&cd13=(Non-Company%20Visitor)&cd14=(Non-Company%20Visitor)&cd15=(Non-Company%20Visitor)&cd16=(Non-Company%20Visitor)&cd17=DE&cd18=(Non-Company%20Visitor)&z=1633600290
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 03 Jun 2019 07:59:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1229331
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ Frame 3708 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
POST
:authority
www.facebook.com
:scheme
https
:path
/tr/
content-length
39462
pragma
no-cache
cache-control
no-cache
origin
https://forums.malwarebytes.com
upgrade-insecure-requests
1
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/
accept-encoding
gzip, deflate, br
cookie
fr=0og0r108UyUdeMJiY..BdB5V6...1.0.BdB5V6.
Origin
https://forums.malwarebytes.com
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://forums.malwarebytes.com/topic/248314-adobe-acedll-backdoorremcos/

Response headers

status
200
content-type
text/plain
access-control-allow-origin
https://forums.malwarebytes.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-length
0
server
proxygen-bolt
date
Mon, 17 Jun 2019 13:28:27 GMT

Verdicts & Comments Add Verdict or Comment

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| dataLayer object| google_tag_manager function| postscribe number| hshInterval string| GoogleAnalyticsObject function| ga function| getVariable boolean| cp function| fbq function| _fbq object| uetq function| qp boolean| ipsDebug string| CKEDITOR_BASEPATH object| ipsSettings object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| HowlerGlobal object| Howler function| Howl function| Sound function| UET object| Debug undefined| ips function| _ function| $ function| jQuery function| EvEmitter function| imagesLoaded object| Mustache object| jstz function| recaptcha2Callback undefined| escapeRegExp object| ipsJavascriptMap function| ctSetCookie function| ctMouseStopData function| ctKeyStopStopListening object| d number| ctTimeMs boolean| ctMouseEventTimerFlag string| ctMouseData number| ctMouseDataCounter number| ctMouseReadInterval number| ctMouseWriteDataInterval function| ctFunctionMouseMove function| ctFunctionFirstKey function| __extends object| Demandbase object| __db function| DBSegment undefined| demandbaseMarketoFormId

11 Cookies

Domain/Path Name / Value
forums.malwarebytes.com/ Name: ct_fkp_timestamp
Value: 0
forums.malwarebytes.com/ Name: ct_ps_timestamp
Value: 1560778106
.malwarebytes.com/ Name: _fbp
Value: fb.1.1560778106706.974090541
forums.malwarebytes.com/ Name: ct_pointer_data
Value: 0
.malwarebytes.com/ Name: _gid
Value: GA1.2.30574921.1560778106
.malwarebytes.com/ Name: _gat
Value: 1
forums.malwarebytes.com/ Name: SimpleSAMLSessionID
Value: 9746e3d15804dccf980969276baba511
.malwarebytes.com/ Name: _ga
Value: GA1.2.375216633.1560778106
forums.malwarebytes.com/ Name: ct_timezone
Value: 0
forums.malwarebytes.com/ Name: ips4_guestTime
Value: 1560778106
forums.malwarebytes.com/ Name: ips4_IPSSessionFront
Value: ann8tjnb8qv5jvn15q7fgnkg7v

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options sameorigin
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.quora.com
ads.avocet.io
api.company-target.com
bat.bing.com
connect.facebook.net
content.invisioncic.com
fonts.googleapis.com
fonts.gstatic.com
forums.malwarebytes.com
id.rlcdn.com
match.prod.bidr.io
q.quora.com
scripts.demandbase.com
segments.company-target.com
stats.g.doubleclick.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
151.101.1.2
2600:9000:200c:3600:1e:ebe7:1480:93a1
2620:1ec:c11::200
2a00:1450:4001:808::200e
2a00:1450:4001:80b::2008
2a00:1450:4001:815::2003
2a00:1450:4001:818::2003
2a00:1450:4001:81c::2004
2a00:1450:4001:81c::200a
2a00:1450:400c:c0a::9c
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
34.95.92.78
52.213.182.66
52.30.162.218
54.172.190.168
54.230.93.112
54.230.93.28
54.230.93.86
54.230.93.98
0c4cd720167fdc33a83dc8275730e25bd41c2d83b0540c39bb3eb9105945ec64
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
0f0061d1d23d6031ae646f122bb53c6ef16a1e851b4418d7f4972a52c5aaba5e
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
134d9689dd766fbea01b7b16563704e655883a93b76f55a6acf999f67510f8b5
1453866b09805fb0385d36399df8712732d1a79769e1dc817b9dccb24d8d468f
159308ebb6cd30326aa68872f9a327c7b99ec1a2d167d509ff333bec2e098b79
1cb63eb6ae84e843eeb7faee1c74f138d71033b9f86bdfbd01a015d8db9a8b4b
200aace718c613768ef69624a9ddc8f4ca5b3cf08f3b7fde2d6a37cd060d7db9
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c38dcd9d7f538e33221bd60440f0e2b4c2c4d55659f250bc8bda3f5021a2904
312269e67a8fb9aac2fc6fbb087ae80d61e491d91a37deae06c7e7694bf6f360
321e370d72b883e156cd94f828ee2e866fcf2d8d949ed51ff8a39cdd55ff3b59
37da679dae9dcbb9d05773aea1dcfaf6a4b1b1c123b70cb706b31b4114e9de0d
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
5214659485e3c8fa52d4136833c137b6d59aaba117354f931d1faa2a8035be87
52a4db3382f53de7e4591f969d32a39111d326bafd661748853cf81dbd81f180
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
58bde59e40debc2af060644ddc080ef12782f0707f86aa7f364f7b8bbd5dc055
59772704619f5b8fb4fec419fae70ffaa4515bd43cb99dc0379e8e485f132390
5c0b8f8ceccd0a8ce7f980ec4fc2cb4f700d542e08654b419b5b6ea89da2c50f
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
6065f3f1cf33dcf6f5c38a416204e0c65f3efdbd6172a68e8aaffe8d8a4e90c8
64ebb03b21b95717182cb69a716ae68e55d1adffab56cf06097e16c087d775c8
657f79c4d5a6ea502202651151811d195b49cf9cf22fd7f8edaeefe2f8cc8fc4
67fa2b1feb9214b6164fbfc808a3a571012295a87137a053d6853d5e3020b708
686d5450a8f423e984d013b696d0cdd838624d2772854b6a6ce5219f5ee03cc2
6ae7e26bd0c7f7f6055ee53fb899f13b1e405f3c7dc28db6889e394c19ed61f9
6e82fac3e6fe3d4a6a1ca85954bfa835f8d49f85a95cbd8c51d3a01537bcd9f8
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8c65118fc7f32af81b7be8f2ceac3f039d87b1f1f1d1ee74dd1f4556646e9974
8ebfaf5d9b1e7bbb4c771ff350b691bcfcabe0eeea0257db821be87013fb0997
8f88cb7a1cd4134f5d616b9fca90b9069fa16c162b7ae66ba1b500c490b41dd2
a2d37ed961f70b8ce884b94aaaee1c5e61c25442702f9aa174f87e2a9b681048
a4ba928e1711d52c3252307d1f2eb0a0b6f36cd4389516ffa4bdcd78588a0b4e
a7f759e4139b8aef838a7702c06abc250c95409905c69025d2b7de4ca57c5685
b205e1f29eb67183b5c3008c3de8446373fe9bfcfed7b08ab0f1ec84ab81e28c
b45fdce25329db456d15157ccdf9f075c10f979c786d96371ef933a010b7c560
b93ec34dd2b61dbf35968eb2e3190fb8925e5346cbc553cd3abb00a65462fd62
bc8f028bc9cf52473a5950065ffbfec78b928fa5d01feeb85f57bd685442b854
bcaaf20ac6ef417373cc644239886d33074acf1ce9a96dea972012e76d753ae2
be8ac08c52cf934773a4cdf37b2cc2c2fbdc9bb150dc2aa4b1aa5750cbf9bac0
c4dc92b008688c213242cfaf0cbe2bfd0fc689326a7b878cbc1cfa8afd87b763
cd1c301a8e7960a1786e2a959226b0b78b56dbea284bd114265f1662d6ca280e
ce2a4529dcbbc7e3252d1dd0c3296f7ed24d2078550a120678319def3b6d8823
db27a9a2397c8f1aa6e7cc67e01d5f4fd8480a9118db49a1e509502427187a15
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e65d975421a7b00dfd4e5081843f6990b632dd6e7d36ac5d1fb78cf8d5d3308a
e797d2f1c05ddbf610bdead3fdf31d6fc7c41c25384aa231f78f3f926561e021
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6906e2c2b9abcd71afd8c5b378f7cb0c39f07e99d27950da2286dff57feb8c
f0bec4e20bc4af56f95159be1e6dd93c1150eae46e1aabd71db1b5d937af44bb
f60e704278243c82c28bc263d0ad6f0fbda6f71099c6e72b799e0b719dba5d50
f9277bb87d53d016ba4039e4b3f5d37f72a9bfd5f9a045347f4651cb5f2dabd2
fa5af2e7c80262aa4ab129f055e2b8bef17e4c15f6e2b5f7502d74e78560f2c8