分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| URL | win7-sp1-x64-hpdapp01-1 | 2020-02-16 16:38:43 | 2020-02-16 16:40:59 | 136 秒 |
魔盾分数
10.0
危险的
URL详细信息
| URL |
|---|
| URL专业沙箱检测 -> https://www.lanzous.com/i9ec5oj |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| www.lanzous.com |
A 117.91.192.226 CNAME www.lanzous.com.scdn8cui.com |
|
| s95.cnzz.com |
CNAME all.cnzz.com.danuoyi.tbcache.com A 101.89.124.234 CNAME c.cnzz.com |
|
| z4.cnzz.com |
CNAME z.cnzz.com A 203.119.129.115 CNAME z.gds.cnzz.com |
|
| c.cnzz.com |
摘要
登录查看详细行为信息WHOIS 信息
Name: None
Country: CN
State: Shan Dong
City: None
ZIP Code: None
Address: None
Orginization: None
Domain Name(s):
LANZOUS.COM
lanzous.com
Creation Date:
2018-02-25 02:24:45
Updated Date:
2020-02-10 08:37:05
2019-08-05 05:04:57
Expiration Date:
2021-02-25 02:24:45
Email(s):
DomainAbuse@service.aliyun.com
Registrar(s):
Alibaba Cloud Computing (Beijing) Co., Ltd.
Name Server(s):
F1G1NS1.DNSPOD.NET
F1G1NS2.DNSPOD.NET
Referral URL(s):
None
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49161 | 101.89.124.234 s95.cnzz.com | 443 |
| 192.168.122.201 | 49162 | 101.89.124.234 s95.cnzz.com | 443 |
| 192.168.122.201 | 49160 | 117.91.192.226 www.lanzous.com | 443 |
| 192.168.122.201 | 49164 | 117.91.192.226 www.lanzous.com | 443 |
| 192.168.122.201 | 49163 | 203.119.129.115 z4.cnzz.com | 443 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49310 | 192.168.122.1 | 53 |
| 192.168.122.201 | 49608 | 192.168.122.1 | 53 |
| 192.168.122.201 | 51856 | 192.168.122.1 | 53 |
| 192.168.122.201 | 64912 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| www.lanzous.com |
A 117.91.192.226 CNAME www.lanzous.com.scdn8cui.com |
|
| s95.cnzz.com |
CNAME all.cnzz.com.danuoyi.tbcache.com A 101.89.124.234 CNAME c.cnzz.com |
|
| z4.cnzz.com |
CNAME z.cnzz.com A 203.119.129.115 CNAME z.gds.cnzz.com |
|
| c.cnzz.com |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49161 | 101.89.124.234 s95.cnzz.com | 443 |
| 192.168.122.201 | 49162 | 101.89.124.234 s95.cnzz.com | 443 |
| 192.168.122.201 | 49160 | 117.91.192.226 www.lanzous.com | 443 |
| 192.168.122.201 | 49164 | 117.91.192.226 www.lanzous.com | 443 |
| 192.168.122.201 | 49163 | 203.119.129.115 z4.cnzz.com | 443 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49310 | 192.168.122.1 | 53 |
| 192.168.122.201 | 49608 | 192.168.122.1 | 53 |
| 192.168.122.201 | 51856 | 192.168.122.1 | 53 |
| 192.168.122.201 | 64912 | 192.168.122.1 | 53 |
HTTP 请求
未发现HTTP请求.
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
| Timestamp | Source IP | Source Port | Destination IP | Destination Port | Version | Issuer | Subject | Fingerprint |
|---|---|---|---|---|---|---|---|---|
| 2020-02-16 16:39:16.957976+0800 | 192.168.122.201 | 49161 | 101.89.124.234 | 443 | TLS 1.2 | C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=CN, ST=ZheJiang, L=HangZhou, O=Alibaba (China) Technology Co., Ltd., CN=*.cnzz.com | ea:c2:dc:77:b7:5a:65:f3:c9:5e:7f:a1:ab:79:da:95:dc:e2:ca:cc |
| 2020-02-16 16:39:17.715195+0800 | 192.168.122.201 | 49163 | 203.119.129.115 | 443 | TLS 1.2 | C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=CN, ST=ZheJiang, L=HangZhou, O=Alibaba (China) Technology Co., Ltd., CN=*.cnzz.com | 9c:2b:8f:7e:cb:08:54:ed:74:b2:2a:d8:eb:ff:2b:f2:44:c3:a2:f8 |
| 2020-02-16 16:39:16.266271+0800 | 192.168.122.201 | 49160 | 117.91.192.226 | 443 | TLS 1.2 | C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2 | OU=Domain Control Validated, CN=*.lanzous.com | 8f:eb:10:33:c0:d7:12:6b:8e:11:03:ec:34:db:07:80:98:31:82:b6 |
| 2020-02-16 16:39:17.602506+0800 | 192.168.122.201 | 49162 | 101.89.124.234 | 443 | TLS 1.2 | C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=CN, ST=ZheJiang, L=HangZhou, O=Alibaba (China) Technology Co., Ltd., CN=*.cnzz.com | ea:c2:dc:77:b7:5a:65:f3:c9:5e:7f:a1:ab:79:da:95:dc:e2:ca:cc |
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 20.176 seconds )
- 15.569 Suricata
- 1.827 NetworkAnalysis
- 1.317 VirusTotal
- 1.312 Static
- 0.138 AnalysisInfo
- 0.008 BehaviorAnalysis
- 0.005 Memory
Signatures ( 0.183 seconds )
- 0.029 md_domain_bl
- 0.023 antiav_detectreg
- 0.018 md_url_bl
- 0.011 anomaly_persistence_autorun
- 0.011 antiav_detectfile
- 0.007 infostealer_ftp
- 0.006 ransomware_extensions
- 0.006 ransomware_files
- 0.005 antianalysis_detectreg
- 0.005 infostealer_bitcoin
- 0.005 infostealer_im
- 0.004 tinba_behavior
- 0.004 disables_browser_warn
- 0.004 network_torgateway
- 0.003 rat_nanocore
- 0.003 cerber_behavior
- 0.003 antivm_vbox_files
- 0.003 geodo_banking_trojan
- 0.003 infostealer_mail
- 0.003 md_bad_drop
- 0.002 betabot_behavior
- 0.002 bot_drive
- 0.002 browser_security
- 0.001 network_tor
- 0.001 ursnif_behavior
- 0.001 kazybot_behavior
- 0.001 kibex_behavior
- 0.001 shifu_behavior
- 0.001 antianalysis_detectfile
- 0.001 antidbg_devices
- 0.001 antivm_parallels_keys
- 0.001 antivm_xen_keys
- 0.001 banker_zeus_mutex
- 0.001 bot_drive2
- 0.001 browser_addon
- 0.001 disables_system_restore
- 0.001 disables_windows_defender
- 0.001 maldun_malicious_drop_executable_file_to_temp_folder
- 0.001 ie_martian_children
- 0.001 maldun_network_blacklist
- 0.001 rat_spynet
- 0.001 stealth_hide_notifications
- 0.001 stealth_modify_uac_prompt
- 0.001 whois_create
Reporting ( 0.742 seconds )
- 0.742 ReportHTMLSummary
| Task ID | 511679 |
|---|---|
| Mongo ID | 5e4900352f8f2e0dfc6c66e9 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号