分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| URL | win7-sp1-x64-shaapp03-1 | 2020-11-26 13:30:51 | 2020-11-26 13:32:54 | 123 秒 |
魔盾分数
0.0
正常的
URL详细信息
| URL |
|---|
| URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
摘要
登录查看详细行为信息WHOIS 信息
Name: Domain Administrator
Country: US
State: California
City: San Jose
ZIP Code: 95110
Address: 345 Park Avenue
Orginization: Adobe Inc.
Domain Name(s):
ADOBE.COM
adobe.com
Creation Date:
1986-11-17 05:00:00
Updated Date:
2020-04-17 23:01:12
2020-07-07 09:07:47
Expiration Date:
2021-05-17 01:48:14
2021-05-17 00:00:00
Email(s):
abuse@comlaude.com
dns-admin@adobe.com
Registrar(s):
NOM-IQ Ltd dba Com Laude
Name Server(s):
A1-217.AKAM.NET
A10-64.AKAM.NET
A13-65.AKAM.NET
A26-66.AKAM.NET
A28-67.AKAM.NET
A7-64.AKAM.NET
ADOBE-DNS-01.ADOBE.COM
ADOBE-DNS-03.ADOBE.COM
ADOBE-DNS-04.ADOBE.COM
ADOBE-DNS-05.ADOBE.COM
a1-217.akam.net
a10-64.akam.net
a13-65.akam.net
a26-66.akam.net
a28-67.akam.net
a7-64.akam.net
adobe-dns-01.adobe.com
Referral URL(s):
None
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49159 | 23.218.94.155 acroipm.adobe.com | 80 |
| 192.168.122.201 | 49160 | 23.218.94.163 acroipm.adobe.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 53125 | 192.168.122.1 | 53 |
| 192.168.122.201 | 56270 | 192.168.122.1 | 53 |
| 192.168.122.201 | 59401 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49159 | 23.218.94.155 acroipm.adobe.com | 80 |
| 192.168.122.201 | 49160 | 23.218.94.163 acroipm.adobe.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 53125 | 192.168.122.1 | 53 |
| 192.168.122.201 | 56270 | 192.168.122.1 | 53 |
| 192.168.122.201 | 59401 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip | GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: */* Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: acroipm.adobe.com Connection: Keep-Alive |
| URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip | GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: */* If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 16.533 seconds )
- 10.752 Suricata
- 4.456 NetworkAnalysis
- 1.248 Static
- 0.071 AnalysisInfo
- 0.004 BehaviorAnalysis
- 0.002 Memory
Signatures ( 1.452 seconds )
- 1.371 md_url_bl
- 0.013 md_domain_bl
- 0.011 antiav_detectreg
- 0.005 anomaly_persistence_autorun
- 0.005 antiav_detectfile
- 0.005 infostealer_ftp
- 0.004 geodo_banking_trojan
- 0.004 ransomware_extensions
- 0.004 ransomware_files
- 0.003 infostealer_bitcoin
- 0.003 infostealer_im
- 0.002 tinba_behavior
- 0.002 rat_nanocore
- 0.002 antianalysis_detectreg
- 0.002 antivm_vbox_files
- 0.002 disables_browser_warn
- 0.002 infostealer_mail
- 0.002 network_torgateway
- 0.001 betabot_behavior
- 0.001 cerber_behavior
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_security
- 0.001 maldun_malicious_drop_executable_file_to_temp_folder
- 0.001 ie_martian_children
- 0.001 md_bad_drop
- 0.001 rat_spynet
- 0.001 stealth_modify_uac_prompt
Reporting ( 0.465 seconds )
- 0.465 ReportHTMLSummary
| Task ID | 591661 |
|---|---|
| Mongo ID | 5fbf3e1e7e769a09e1a4df9b |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号