分析任务

分析类型 虚拟机标签 开始时间 结束时间 持续时间
URL win7-sp1-x64-shaapp01-1 2017-12-15 19:09:19 2017-12-15 19:11:37 138 秒

魔盾分数

1.05

正常的

URL详细信息

URL
URL专业沙箱检测 -> http://www.znyshurufa.com/

登录查看威胁特征

运行截图


访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
104.17.178.200 美国
106.39.162.247 中国
106.75.62.179 中国
117.18.237.29 亚洲太平洋地区
183.136.212.50 中国
23.48.201.8 荷兰
65.55.186.113 美国

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
www.znyshurufa.com A 106.75.62.179
hm.baidu.com 未知 CNAME hm.e.shifen.com
A 106.39.162.247
s2.symcb.com CNAME ocsp-ds.ws.symantec.com.edgekey.net
CNAME e8218.dscb1.akamaiedge.net
A 23.5.251.27
www.microsoft.com CNAME e1863.ca2.s.tl88.net
CNAME www.microsoft.com-c-2.edgekey.net.globalredir.akadns.net
CNAME www.microsoft.com-c-2.edgekey.net
A 183.136.212.50
data.tvdownload.microsoft.com A 65.55.186.113
CNAME data.tvdownload.windowsmedia.com.akadns.net
ocsp.msocsp.com CNAME hostedocsp.globalsign.com
CNAME ocsp.globalsign.cloud
A 104.17.178.200
A 104.17.177.200
A 104.17.179.200
A 104.17.175.200
A 104.17.176.200
cdn.epg.tvdownload.microsoft.com A 23.48.201.8
CNAME cdn.epg.tvdownload.windowsmedia.com.akadns.net
CNAME a1683.d.akamai.net
CNAME cdn.epg.tvdownload.microsoft.com.edgesuite.net
A 23.48.201.33
ocsp.digicert.com CNAME cs9.wac.phicdn.net
A 117.18.237.29

摘要

登录查看详细行为信息

WHOIS 信息

Name: li song
Country: CN
State: shang hai
City: shang hai
ZIP Code: 200000
Address: jin gao lu 1 6 1 7 long 1 9 1 hao

Orginization: li song
Domain Name(s):
    ZNYSHURUFA.COM
    znyshurufa.com
Creation Date:
    2016-06-28 01:38:34
Updated Date:
    2017-07-12 06:08:05
    2017-07-12 06:08:06
Expiration Date:
    2019-06-28 01:38:34
Email(s):
    abuse@ename.com
    lisongsir@gmail.com

Registrar(s):
    eName Technology Co.,Ltd.
Name Server(s):
    F1G1NS1.DNSPOD.NET
    F1G1NS2.DNSPOD.NET
    f1g1ns1.dnspod.net
    f1g1ns2.dnspod.net
Referral URL(s):
    None
防病毒引擎/厂商 网站安全分析
CLEAN MX Clean Site
MalwarePatrol Clean Site
ZDB Zeus Clean Site
Tencent Clean Site
Netcraft Unrated Site
desenmascara_me Clean Site
PhishLabs Unrated Site
Zerofox Clean Site
K7AntiVirus Clean Site
SecureBrain Clean Site
Virusdie External Site Scan Clean Site
SCUMWARE_org Clean Site
Quttera Clean Site
AegisLab WebGuard Clean Site
MalwareDomainList Clean Site
ZeusTracker Clean Site
zvelo Clean Site
Google Safebrowsing Clean Site
Kaspersky Clean Site
BitDefender Clean Site
Certly Clean Site
G-Data Clean Site
C-SIRT Clean Site
OpenPhish Clean Site
Malware Domain Blocklist Clean Site
VX Vault Clean Site
Webutation Clean Site
Trustwave Clean Site
Web Security Guard Clean Site
Dr_Web Clean Site
ADMINUSLabs Clean Site
Malwarebytes hpHosts Clean Site
Opera Clean Site
AlienVault Clean Site
Emsisoft Clean Site
Malc0de Database Clean Site
Phishtank Clean Site
Malwared Clean Site
Avira Clean Site
CyberCrime Clean Site
Antiy-AVL Clean Site
Forcepoint ThreatSeeker Clean Site
FraudSense Clean Site
malwares_com URL checker Clean Site
Comodo Site Inspector Clean Site
Malekal Clean Site
ESET Clean Site
Sophos Unrated Site
Yandex Safebrowsing Clean Site
Spam404 Clean Site
Nucleon Clean Site
Sucuri SiteCheck Clean Site
Blueliv Clean Site
ZCloudsec Clean Site
AutoShun Unrated Site
ThreatHive Clean Site
FraudScore Clean Site
Rising Clean Site
URLQuery Unrated Site
StopBadware Unrated Site
Fortinet Clean Site
ZeroCERT Clean Site
Baidu-International Clean Site
securolytics Clean Site

进程树


iexplore.exe, PID: 1756, 上一级进程 PID: 300
iexplore.exe, PID: 2280, 上一级进程 PID: 1756

访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
104.17.178.200 美国
106.39.162.247 中国
106.75.62.179 中国
117.18.237.29 亚洲太平洋地区
183.136.212.50 中国
23.48.201.8 荷兰
65.55.186.113 美国

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49184 104.17.178.200 ocsp.msocsp.com 80
192.168.122.201 49169 106.39.162.247 hm.baidu.com 443
192.168.122.201 49161 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49166 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49170 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49171 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49172 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49173 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49174 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49175 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49177 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49194 117.18.237.29 ocsp.digicert.com 80
192.168.122.201 49182 183.136.212.50 www.microsoft.com 80
192.168.122.201 49186 183.136.212.50 www.microsoft.com 80
192.168.122.201 49193 203.69.138.230 80
192.168.122.201 49192 23.48.201.8 cdn.epg.tvdownload.microsoft.com 80
192.168.122.201 49178 23.5.251.27 s2.symcb.com 80
192.168.122.201 49179 23.5.251.27 s2.symcb.com 80
192.168.122.201 49181 23.5.251.27 s2.symcb.com 80
192.168.122.201 49183 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49185 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49187 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49188 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49189 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49190 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49191 65.55.186.113 data.tvdownload.microsoft.com 443

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 49782 192.168.122.1 53
192.168.122.201 51023 192.168.122.1 53
192.168.122.201 51070 192.168.122.1 53
192.168.122.201 51694 192.168.122.1 53
192.168.122.201 52576 192.168.122.1 53
192.168.122.201 53294 192.168.122.1 53
192.168.122.201 54275 192.168.122.1 53
192.168.122.201 55072 192.168.122.1 53
192.168.122.201 59418 192.168.122.1 53
192.168.122.201 59795 192.168.122.1 53
192.168.122.201 62669 192.168.122.1 53
192.168.122.201 64810 192.168.122.1 53

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
www.znyshurufa.com A 106.75.62.179
hm.baidu.com 未知 CNAME hm.e.shifen.com
A 106.39.162.247
s2.symcb.com CNAME ocsp-ds.ws.symantec.com.edgekey.net
CNAME e8218.dscb1.akamaiedge.net
A 23.5.251.27
www.microsoft.com CNAME e1863.ca2.s.tl88.net
CNAME www.microsoft.com-c-2.edgekey.net.globalredir.akadns.net
CNAME www.microsoft.com-c-2.edgekey.net
A 183.136.212.50
data.tvdownload.microsoft.com A 65.55.186.113
CNAME data.tvdownload.windowsmedia.com.akadns.net
ocsp.msocsp.com CNAME hostedocsp.globalsign.com
CNAME ocsp.globalsign.cloud
A 104.17.178.200
A 104.17.177.200
A 104.17.179.200
A 104.17.175.200
A 104.17.176.200
cdn.epg.tvdownload.microsoft.com A 23.48.201.8
CNAME cdn.epg.tvdownload.windowsmedia.com.akadns.net
CNAME a1683.d.akamai.net
CNAME cdn.epg.tvdownload.microsoft.com.edgesuite.net
A 23.48.201.33
ocsp.digicert.com CNAME cs9.wac.phicdn.net
A 117.18.237.29

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49184 104.17.178.200 ocsp.msocsp.com 80
192.168.122.201 49169 106.39.162.247 hm.baidu.com 443
192.168.122.201 49161 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49166 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49170 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49171 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49172 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49173 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49174 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49175 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49177 106.75.62.179 www.znyshurufa.com 80
192.168.122.201 49194 117.18.237.29 ocsp.digicert.com 80
192.168.122.201 49182 183.136.212.50 www.microsoft.com 80
192.168.122.201 49186 183.136.212.50 www.microsoft.com 80
192.168.122.201 49193 203.69.138.230 80
192.168.122.201 49192 23.48.201.8 cdn.epg.tvdownload.microsoft.com 80
192.168.122.201 49178 23.5.251.27 s2.symcb.com 80
192.168.122.201 49179 23.5.251.27 s2.symcb.com 80
192.168.122.201 49181 23.5.251.27 s2.symcb.com 80
192.168.122.201 49183 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49185 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49187 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49188 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49189 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49190 65.55.186.113 data.tvdownload.microsoft.com 443
192.168.122.201 49191 65.55.186.113 data.tvdownload.microsoft.com 443

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 49782 192.168.122.1 53
192.168.122.201 51023 192.168.122.1 53
192.168.122.201 51070 192.168.122.1 53
192.168.122.201 51694 192.168.122.1 53
192.168.122.201 52576 192.168.122.1 53
192.168.122.201 53294 192.168.122.1 53
192.168.122.201 54275 192.168.122.1 53
192.168.122.201 55072 192.168.122.1 53
192.168.122.201 59418 192.168.122.1 53
192.168.122.201 59795 192.168.122.1 53
192.168.122.201 62669 192.168.122.1 53
192.168.122.201 64810 192.168.122.1 53

HTTP 请求

URI HTTP数据
URL专业沙箱检测 -> http://www.znyshurufa.com/
GET / HTTP/1.1
Accept: */*
Referer: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=4&ved=0CCEQfjYlRRZllEdmtTTFp5SlRF&url=http%3A%2F%2Fwww.znyshurufa.com%2F&ei=SkZKenJ6WFZmTWpn&usg=AFQjWUx2YklqQVdZS3hO
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/stylesheets/main.css
GET /resources/stylesheets/main.css HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/javascripts/main.js
GET /resources/javascripts/main.js HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/images/bg1.jpg
GET /resources/images/bg1.jpg HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/images/bg2.jpg
GET /resources/images/bg2.jpg HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/images/bg3.jpg
GET /resources/images/bg3.jpg HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/images/down1.png
GET /resources/images/down1.png HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/images/down2.png
GET /resources/images/down2.png HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/images/cloud1.png
GET /resources/images/cloud1.png HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/images/cloud2.png
GET /resources/images/cloud2.png HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/images/img1_1.png
GET /resources/images/img1_1.png HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/images/down3.png
GET /resources/images/down3.png HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/resources/images/log55o.png
GET /resources/images/log55o.png HTTP/1.1
Accept: */*
Referer: http://www.znyshurufa.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.znyshurufa.com/favicon.ico
GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: www.znyshurufa.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X%2B%2BhEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18%2BP0%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X%2B%2BhEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18%2BP0%3D HTTP/1.1
Cache-Control: max-age = 514622
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 01 Sep 2017 15:11:07 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com

URL专业沙箱检测 -> http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFE%2FuXQ4cLc0QEGNMJMGmf8%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFE%2FuXQ4cLc0QEGNMJMGmf8%3D HTTP/1.1
Cache-Control: max-age = 515299
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 01 Sep 2017 15:21:09 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: s2.symcb.com

URL专业沙箱检测 -> http://ss.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV%2Bc%2FAZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CEG6PrCxmmU8tZDNcJoriZ80%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV%2Bc%2FAZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CEG6PrCxmmU8tZDNcJoriZ80%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ss.symcd.com

URL专业沙箱检测 -> http://www.microsoft.com/
GET / HTTP/1.1
Host: www.microsoft.com
Connection: Close

URL专业沙箱检测 -> http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQphfxhPb4vsBIPXkIOTJ7D1Z79fAQUCP4ln3TqhwTCvLuOqDhfM8bRbGUCEy0AAO%2FxE5PyQlBerOAAAAAA7%2FE%3D
GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQphfxhPb4vsBIPXkIOTJ7D1Z79fAQUCP4ln3TqhwTCvLuOqDhfM8bRbGUCEy0AAO%2FxE5PyQlBerOAAAAAA7%2FE%3D HTTP/1.1
Cache-Control: max-age = 10800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 06 Dec 2017 07:11:24 GMT
If-None-Match: "a602f001a25d1ece86269d16668acccb0791bbc6"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com

URL专业沙箱检测 -> http://cdn.epg.tvdownload.microsoft.com/broadbanddata/Prod/1/805332787786/cn/ALL/131/null-cn_null_131_BBPkg.enc
HEAD /broadbanddata/Prod/1/805332787786/cn/ALL/131/null-cn_null_131_BBPkg.enc HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
Host: cdn.epg.tvdownload.microsoft.com

URL专业沙箱检测 -> http://cdn.epg.tvdownload.microsoft.com/broadbanddata/Prod/1/805332787786/cn/ALL/131/null-cn_null_131_BBPkg.enc
GET /broadbanddata/Prod/1/805332787786/cn/ALL/131/null-cn_null_131_BBPkg.enc HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Thu, 09 Jul 2015 23:37:37 GMT
User-Agent: Microsoft BITS/7.5
Host: cdn.epg.tvdownload.microsoft.com

URL专业沙箱检测 -> http://crl.microsoft.com/pki/crl/products/tspca.crl
GET /pki/crl/products/tspca.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 24 May 2014 05:04:54 GMT
If-None-Match: "8ab194b3d77cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com

URL专业沙箱检测 -> http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1
Cache-Control: max-age = 172800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 02 Sep 2017 10:30:03 GMT
If-None-Match: "59aa882b-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

URL专业沙箱检测 -> http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1
Cache-Control: max-age = 172800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 06 Dec 2017 00:22:31 GMT
If-None-Match: "5a273847-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

Timestamp Source IP Source Port Destination IP Destination Port Protocol SID Signature Category
2017-12-15 19:09:43.229145+0800 183.136.212.50 80 192.168.122.201 49182 TCP 2012692 ET POLICY Microsoft user-agent automated process response to automated request A Network Trojan was detected
2017-12-15 19:09:51.461206+0800 183.136.212.50 80 192.168.122.201 49186 TCP 2012692 ET POLICY Microsoft user-agent automated process response to automated request A Network Trojan was detected

TLS

Timestamp Source IP Source Port Destination IP Destination Port Version Issuer Subject Fingerprint
2017-12-15 19:09:46.385632+0800 192.168.122.201 49183 65.55.186.113 443 TLSv1 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=data.tvdownload.microsoft.com a1:ca:16:54:fb:ba:28:d9:f4:a0:c3:b7:5b:b4:f5:2b:63:27:87:e5
2017-12-15 19:09:54.799005+0800 192.168.122.201 49188 65.55.186.113 443 TLSv1 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=data.tvdownload.microsoft.com a1:ca:16:54:fb:ba:28:d9:f4:a0:c3:b7:5b:b4:f5:2b:63:27:87:e5
2017-12-15 19:09:52.597543+0800 192.168.122.201 49187 65.55.186.113 443 TLSv1 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=data.tvdownload.microsoft.com a1:ca:16:54:fb:ba:28:d9:f4:a0:c3:b7:5b:b4:f5:2b:63:27:87:e5
2017-12-15 19:09:49.777709+0800 192.168.122.201 49185 65.55.186.113 443 TLSv1 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=data.tvdownload.microsoft.com a1:ca:16:54:fb:ba:28:d9:f4:a0:c3:b7:5b:b4:f5:2b:63:27:87:e5
2017-12-15 19:09:57.759077+0800 192.168.122.201 49189 65.55.186.113 443 TLSv1 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=data.tvdownload.microsoft.com a1:ca:16:54:fb:ba:28:d9:f4:a0:c3:b7:5b:b4:f5:2b:63:27:87:e5
2017-12-15 19:10:00.091318+0800 192.168.122.201 49190 65.55.186.113 443 TLSv1 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=data.tvdownload.microsoft.com a1:ca:16:54:fb:ba:28:d9:f4:a0:c3:b7:5b:b4:f5:2b:63:27:87:e5
2017-12-15 19:10:02.283764+0800 192.168.122.201 49191 65.55.186.113 443 TLSv1 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=data.tvdownload.microsoft.com a1:ca:16:54:fb:ba:28:d9:f4:a0:c3:b7:5b:b4:f5:2b:63:27:87:e5
2017-12-15 19:09:36.423431+0800 192.168.122.201 49169 106.39.162.247 443 TLS 1.2 C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4 C=CN, ST=beijing, L=beijing, O=BeiJing Baidu Netcom Science Technology Co., Ltd, OU=service operation department., CN=baidu.com d9:b2:cf:83:5d:ab:f4:c8:30:ae:64:a0:52:24:1a:45:0b:54:d1:93

Suricata HTTP

No Suricata HTTP

未发现网络提取文件
文件名 index.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017121520171216\index.dat
文件大小 32768 字节
文件类型 Internet Explorer cache file version Ver 5.2
MD5 e06e404c7c1486dde8e1f8431c81401b
SHA1 125f47cb6cb8e3eb237130af4afa6259146e56f5
SHA256 b44d7476eca4b3626dfd3cb9a13df165f9a54d6ced0fc90cc01ba48c03c5b404
CRC32 2B35D4F8
Ssdeep 6:qjyxXKWKWxHmB3wiJKk3F2Sjj4TMGQU3wizqF2SjWMGQ:qjRWrxHg3wiJh2I0/3wiz+2IW
下载提交魔盾安全分析
文件名 index.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat
文件大小 32768 字节
文件类型 Internet Explorer cache file version Ver 5.2
MD5 cff6fe2f89d02c5c669063e730062609
SHA1 038fbca44a1b3c919ebd1bad6b7a31c8f2ecd6f7
SHA256 5db2b57992149c6058cec70af828550cf6bd6c5876adc6f91f6cba1512ded27d
CRC32 2623E29C
Ssdeep 24:qjfAIIj+dwkKH4BTaPacyYo78ajOzwBhzGG2I6JYFc/gKxowZoBSSqILwmYd:qDAtyQuaPaFB/KQc3bWqE8
下载提交魔盾安全分析
文件名 hm[1].js
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EHDRIWWS\hm[1].js
文件大小 29404 字节
文件类型 ASCII text, with very long lines
MD5 44fd3c33b01fe7fa37c7c45a14eb7f68
SHA1 93c804b6d826d42926651e86c74f5a57a5fe0556
SHA256 efb7a01b762924d9a61d1888185926b321ab3632d1f97179d86b3486a951b9a4
CRC32 7B4393C3
Ssdeep 384:e0693cMs5UyNBucA4lwrl/ExsvwS6N2Zv947YII0P3nIagmlXQ7f9W09Wqipn:ehILNBs4KrlMxJuKYIIc3IcQz9W09WN
Yara
  • Rule to detect the presence of an or several urls
  • Rule to detect the no presence of any attachment
  • Rule to detect the no presence of any image
  • Looks for big numbers 32:sized
下载提交魔盾安全分析显示文本
(function(){var h={},mt={},c={id:"d244e430403005a8fbdc44484ecf6460",dm:["znyshurufa.com"],js:"tongji.baidu.com/hm-web/js/",etrk:[{id:"%23pydownload",eventType:"onclick"},{id:"%23wbdownload",eventType:"onclick"},{id:"%23bdzmdownload",eventType:"onclick"}],icon:'',ctrk:false,align:-1,nv:-1,vdur:1800000,age:31536000000,rec:0,rp:[],trust:0,vcard:0,qiao:0,lxb:0,conv:0,med:0,cvcc:'',cvcf:[],apps:''};var q=void 0,r=!0,u=null,v=!1;mt.cookie={};mt.cookie.set=function(a,e,d){var b;d.O&&(b=new Date,b.setTime(b.getTime()+d.O));document.cookie=a+"="+e+(d.domain?"; domain="+d.domain:"")+(d.path?"; path="+d.path:"")+(b?"; expires="+b.toGMTString():"")+(d.Bb?"; secure":"")};mt.cookie.get=function(a){return(a=RegExp("(^| )"+a+"=([^;]*)(;|$)").exec(document.cookie))?a[2]:u};mt.g={};mt.g.P=function(a){return document.getElementById(a)};
mt.g.R=function(a,e){var d=[],b=[];if(!a)return b;for(;a.parentNode!=u;){for(var g=0,m=0,k=a.parentNode.childNodes.length,p=0;p<k;p++){var f=a.parentNode.childNodes[p];if(f.nodeName===a.nodeName&&(g++,f===a&&(m=g),0<m&&1<g))break}if((k=""!==a.id)&&e){d.unshift("#"+encodeURIComponent(a.id));break}else k&&(k="#"+encodeURIComponent(a.id),k=0<d.length?k+">"+d.join(">"):k,b.push(k)),d.unshift(encodeURIComponent(String(a.nodeName).toLowerCase())+(1<g?"["+m+"]":""));a=a.parentNode}b.push(d.join(">"));return b};
mt.g.Pa=function(a){return(a=mt.g.R(a,r))&&a.length?String(a[0]):""};mt.g.Oa=function(a){return mt.g.R(a,v)};mt.g.Ga=function(a){var e;for(e="A";(a=a.parentNode)&&1==a.nodeType;)if(a.tagName==e)return a;return u};mt.g.Ia=function(a){return 9===a.nodeType?a:a.ownerDocument||a.document};
mt.g.Ma=function(a){var e={top:0,left:0};if(!a)return e;var d=mt.g.Ia(a).documentElement;"undefined"!==typeof a.getBoundingClientRect&&(e=a.getBoundingClientRect());return{top:e.top+(window.pageYOffset||d.scrollTop)-(d.clientTop||0),left:e.left+(window.pageXOffset||d.scrollLeft)-(d.clientLeft||0)}};
(mt.g.ga=function(){function a(){if(!a.G){a.G=r;for(var e=0,d=b.length;e<d;e++)b[e]()}}function e(){try{document.documentElement.doScroll("left")}catch(b){setTimeout(e,1);return}a()}var d=v,b=[],g;document.addEventListener?g=function(){document.removeEventListener("DOMContentLoaded",g,v);a()}:document.attachEvent&&(g=function(){"complete"===document.readyState&&(document.detachEvent("onreadystatechange",g),a())});(function(){if(!d)if(d=r,"complete"===document.readyState)a.G=r;else if(document.addEventListener)document.addEventListener("DOMContentLoaded",
g,v),window.addEventListener("load",a,v);else if(document.attachEvent){document.attachEvent("onreadystatechange",g);window.attachEvent("onload",a);var b=v;try{b=window.frameElement==u}catch(k){}document.documentElement.doScroll&&b&&e()}})();return function(e){a.G?e():b.push(e)}}()).G=v;mt.event={};mt.event.c=function(a,e,d){a.attachEvent?a.attachEvent("on"+e,function(b){d.call(a,b)}):a.addEventListener&&a.addEventListener(e,d,v)};
mt.event.preventDefault=function(a){a.preventDefault?a.preventDefault():a.returnValue=v};
(function(){var a=mt.event;mt.f={};mt.f.da=/msie (\d+\.\d+)/i.test(navigator.userAgent);mt.f.$a=/msie (\d+\.\d+)/i.test(navigator.userAgent)?document.documentMode||+RegExp.$1:q;mt.f.cookieEnabled=navigator.cookieEnabled;mt.f.javaEnabled=navigator.javaEnabled();mt.f.language=navigator.language||navigator.browserLanguage||navigator.systemLanguage||navigator.userLanguage||"";mt.f.hb=(window.screen.width||0)+"x"+(window.screen.height||0);mt.f.colorDepth=window.screen.colorDepth||0;mt.f.C=function(){var a;
a=a||document;return parseInt(window.pageYOffset||a.documentElement.scrollTop||a.body&&a.body.scrollTop||0,10)};mt.f.D=function(){var a=document;return parseInt(window.innerHeight||a.documentElement.clientHeight||a.body&&a.body.clientHeight||0,10)};mt.f.orientation=0;(function(){function e(){var a=0;window.orientation!==q&&(a=window.orientation);screen&&(screen.orientation&&screen.orientation.angle!==q)&&(a=screen.orientation.angle);mt.f.orientation=a}e();a.c(window,"orientationchange",e)})();return mt.f})();
mt.m={};mt.m.parse=function(){return(new Function('return (" + source + ")'))()};
mt.m.stringify=function(){function a(a){/["\\\x00-\x1f]/.test(a)&&(a=a.replace(/["\\\x00-\x1f]/g,function(a){var b=d[a];if(b)return b;b=a.charCodeAt();return"\\u00"+Math.floor(b/16).toString(16)+(b%16).toString(16)}));return'"'+a+'"'}function e(a){return 10>a?"0"+a:a}var d={"\b":"\\b","\t":"\\t","\n":"\\n","\f":"\\f","\r":"\\r",'"':'\\"',"\\":"\\\\"};return function(b){switch(typeof b){case "undefined":return"undefined";case "number":return isFinite(b)?String(b):"null";case "string":return a(b);case "boolean":return String(b);
default:if(b===u)return"null";if(b instanceof Array){var d=["["],m=b.length,k,p,f;for(p=0;p<m;p++)switch(f=b[p],typeof f){case "undefined":case "function":case "unknown":break;default:k&&d.push(","),d.push(mt.m.stringify(f)),k=1}d.push("]");return d.join("")}if(b instanceof Date)return'"'+b.getFullYear()+"-"+e(b.getMonth()+1)+"-"+e(b.getDate())+"T"+e(b.getHours())+":"+e(b.getMinutes())+":"+e(b.getSeconds())+'"';k=["{"];p=mt.m.stringify;for(m in b)if(Object.prototype.hasOwnProperty.call(b,m))switch(f=
b[m],typeof f){case "undefined":case "unknown":case "function":break;default:d&&k.push(","),d=1,k.push(p(m)+":"+p(f))}k.push("}");return k.join("")}}}();mt.lang={};mt.lang.d=function(a,e){return"[object "+e+"]"==={}.toString.call(a)};mt.lang.yb=function(a){return mt.lang.d(a,"Number")&&isFinite(a)};mt.lang.Ab=function(a){return mt.lang.d(a,"String")};mt.lang.h=function(a){return a.replace?a.replace(/'/g,"'0").replace(/\*/g,"'1").replace(/!/g,"'2"):a};mt.localStorage={};
mt.localStorage.L=function(){if(!mt.localStorage.i)try{mt.localStorage.i=document.createElement("input"),mt.localStorage.i.type="hidden",mt.localStorage.i.style.display="none",mt.localStorage.i.addBehavior("#default#userData"),document.getElementsByTagName("head")[0].appendChild(mt.localStorage.i)}catch(a){return v}return r};
mt.localStorage.set=function(a,e,d){var b=new Date;b.setTime(b.getTime()+d||31536E6);try{window.localStorage?(e=b.getTime()+"|"+e,window.localStorage.setItem(a,e)):mt.localStorage.L()&&(mt.localStorage.i.expires=b.toUTCString(),mt.localStorage.i.load(document.location.hostname),mt.localStorage.i.setAttribute(a,e),mt.localStorage.i.save(document.location.hostname))}catch(g){}};
mt.localStorage.get=function(a){if(window.localStorage){if(a=window.localStorage.getItem(a)){var e=a.indexOf("|"),d=a.substring(0,e)-0;if(d&&d>(new Date).getTime())return a.substring(e+1)}}else if(mt.localStorage.L())try{return mt.localStorage.i.load(document.location.hostname),mt.localStorage.i.getAttribute(a)}catch(b){}return u};
mt.localStorage.remove=function(a){if(window.localStorage)window.localStorage.removeItem(a);else if(mt.localStorage.L())try{mt.localStorage.i.load(document.location.hostname),mt.localStorage.i.removeAttribute(a),mt.localStorage.i.save(document.location.hostname)}catch(e){}};mt.sessionStorage={};mt.sessionStorage.set=function(a,e){if(window.sessionStorage)try{window.sessionStorage.setItem(a,e)}catch(d){}};
mt.sessionStorage.get=function(a){return window.sessionStorage?window.sessionStorage.getItem(a):u};mt.sessionStorage.remove=function(a){window.sessionStorage&&window.sessionStorage.removeItem(a)};mt.la={};mt.la.log=function(a,e){var d=new Image,b="mini_tangram_log_"+Math.floor(2147483648*Math.random()).toString(36);window[b]=d;d.onload=d.onerror=d.onabort=function(){d.onload=d.onerror=d.onabort=u;d=window[b]=u;e&&e(a)};d.src=a};mt.K={};
mt.K.Ra=function(){var a="";if(navigator.plugins&&navigator.mimeTypes.length){var e=navigator.plugins["Shockwave Flash"];e&&e.description&&(a=e.description.replace(/^.*\s+(\S+)\s+\S+$/,"$1"))}else if(window.ActiveXObject)try{if(e=new ActiveXObject("ShockwaveFlash.ShockwaveFlash"))(a=e.GetVariable("$version"))&&(a=a.replace(/^.*\s+(\d+),(\d+).*$/,"$1.$2"))}catch(d){}return a};
mt.K.za=function(a,e,d,b,g){return'<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" id="'+a+'" width="'+d+'" height="'+b+'"><param name="movie" value="'+e+'" /><param name="flashvars" value="'+(g||"")+'" /><param name="allowscriptaccess" value="always" /><embed type="applicati <truncated>
文件名 cloud1[1].png
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\cloud1[1].png
文件大小 13762 字节
文件类型 PNG image data, 236 x 185, 8-bit/color RGBA, non-interlaced
MD5 53d5b7eadb4a76a9db82716c9cb0dae3
SHA1 fe7b7d1ecd1d0f0e1da9f5b0434044d5498bd0b2
SHA256 4a808cdc3b253fc94b7dc64dbb8309493d8072aca801628fce91b8208ded8ca0
CRC32 F719A463
Ssdeep 384:m8utIT0FPY+tVg6/Fua2/j+TUqLsv4U+p9Pfqhw2B:N1gYMg2F8/iT4d8PAfB
下载提交魔盾安全分析
文件名 {6584B804-E188-11E7-A1F7-525400F9C664}.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6584B804-E188-11E7-A1F7-525400F9C664}.dat
文件大小 4608 字节
文件类型 Composite Document File V2 Document, Cannot read section info
MD5 a83ec83c3d4188c293fa2d8ed9a5b40f
SHA1 6ec9a79d691625c90b7d7371de6910652bc1fffc
SHA256 ccda707b6b9d26831c7a9e0d31c4e9cc067bd68b4e797a084a0c9adcf5d49cdf
CRC32 22FD3FAA
Ssdeep 12:rlfFW4ZrEgmfR16F0rEgmfB1qjNlYfOo3+/Nlz9oXCQ:rNGhGUNljowNlhoXC
下载提交魔盾安全分析
文件名 main[1].js
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDL4J1KW\main[1].js
文件大小 2646 字节
文件类型 UTF-8 Unicode text, with CRLF line terminators
MD5 0c9e744dd87cba5219afb0df28d5e3b6
SHA1 e79bd016893eacc05d4e6ac98325a74674685417
SHA256 e682c79c9262b5e36bfb3018fd9de8ea0842c733b39a355e7bc12ec3148065de
CRC32 C702546F
Ssdeep 48:HDKU4inVA3Mh0a0cSYSzeS/Qx/+nA/X/a/8eXm3/x9/EIhpkBsNfMDDwU/eLSzyK:H2U9XyJLOIOxMDJ/8SzyUlwaxAjjy
Yara
  • Rule to detect the presence of an or several urls
  • Rule to detect the no presence of any attachment
  • Rule to detect the no presence of any image
下载提交魔盾安全分析显示文本
var down_url = "";
var can_whell = true;
function go_to_index(index){
    if(index == $('.block.now').index()){return false;} //\xe5\xbd\x93\xe5\x89\x8d\xe4\xb8\x8d\xe6\x93\x8d\xe4\xbd\x9c
    can_whell = false; //\xe9\x9d\x9e\xe5\xbd\x93\xe5\x89\x8d \xe5\xbc\x80\xe5\xa7\x8b\xe5\x8f\x98\xe5\x8c\x96 \xe8\xbf\x87\xe7\xa8\x8b\xe4\xb8\xad\xe4\xb8\x8d\xe5\xbe\x97\xe5\x8f\x98\xe5\x8c\x96
    if(index == $('.block').size() - 1){ //\xe6\x9c\x80\xe5\x90\x8e\xe4\xb8\x80\xe9\xa1\xb5\xe5\x88\x99\xe4\xb8\x8d\xe6\x98\xbe\xe7\xa4\xba\xe7\xae\xad\xe5\xa4\xb4
        $('.arrow').hide();
    }else{
        $('.arrow').show();
    }
    $('.block').removeClass('now');
    $('.block').animate({
        opacity: 0
    }, 750, function(){
        $('.block').filter(':not(".now")').hide();
    });
    $('.block:eq(' + index + ')').addClass('now');
    $('.block:eq(' + index + ')').stop();
    $('.block:eq(' + index + ')').show();
    $('.block:eq(' + index + ')').animate({
        opacity: 1
    }, 750);

    $('.point div').removeClass('now');
    $('.point div:eq(' + index + ')').addClass('now');
    setTimeout(function(){
        can_whell = true; //\xe5\x8f\x98\xe5\x8c\x96\xe7\xbb\x93\xe6\x9d\x9f
    }, 800);
}
$(function(){
    for(var i = 0; i < $('.block').size(); i++){
        if(i == 0){
            $('.point').append('<div class="now"></div>');
        }else{
            $('.point').append('<div></div>');
        }
    }
    $('.point div').on('click', function(){
        if(!can_whell){return false;}
        go_to_index($(this).index());
    });
    $('.logo').on('click', function(){
        $('.point div:eq(0)').trigger('click');
    });
    $('.point').css({
        marginTop: -$('.point').height() / 2
    });
    
    $(window).on('resize', function(){
        $('.winw').width($(window).width());
        $('.winh').height($(window).height());
    });
    $('body').mousewheel(function(event){
        if(!can_whell){return false;}
        var current_index = $('.block.now').index();
        if(event.deltaY < 0){
            //\xe5\x90\x91\xe4\xb8\x8b\xe6\xbb\x9a\xe5\x8a\xa8
            if(current_index == $('.block').size() - 1){return false;} //\xe6\x9c\x80\xe5\x90\x8e\xe4\xb8\x80\xe9\xa1\xb5\xe4\xb8\x8d\xe8\x83\xbd\xe5\x90\x91\xe4\xb8\x8b
            go_to_index(current_index + 1);
        }else{
            //\xe5\x90\x91\xe4\xb8\x8a\xe6\xbb\x9a\xe5\x8a\xa8
            if(current_index == 0){return false;} //\xe7\xac\xac\xe4\xb8\x80\xe9\xa1\xb5\xe4\xb8\x8d\xe8\x83\xbd\xe5\x90\x91\xe4\xb8\x8a
            go_to_index(current_index - 1);
        }
    });
    $('.ico1').on('click', function(){
        $('.down').trigger('click');
    });
    $('.ico3').on('click', function(){
        location.href = 'skin.html';
    });
    $('.ico4').on('click', function(){
        window.open('http://tieba.baidu.com/f?kw=%E4%B8%87%E8%83%BD%E4%BA%94%E7%AC%94');
    });
    //\xe6\x89\xa7\xe8\xa1\x8c
    $(window).trigger('resize');
    $('.block').filter(':not(".now")').hide();
    $('.block').filter(':not(".now")').animate({
        opacity: 0
    }, 0);
});
文件名 705A76DE71EA2CAEBB8F0907449CE086_611D8AF93D88D61ED8CD55C30E7FC92A
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\705A76DE71EA2CAEBB8F0907449CE086_611D8AF93D88D61ED8CD55C30E7FC92A
文件大小 394 字节
文件类型 data
MD5 321bf7950213819c117ef3d912c27c17
SHA1 cd823b30ead472ec59d60638ab36f73518af32df
SHA256 b08be3cf9406de7025cda04df4715a9c22404c2dfa836be2b8ee3fe7d2c51164
CRC32 2A93416D
Ssdeep 6:kK5JsPptl73sWxslwGBXivhClroF3hLPwZK10lWr4TZOL3iJn:cMFXiv8sFxLPwZKulTZOjS
下载提交魔盾安全分析
文件名 main[1].css
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDL4J1KW\main[1].css
文件大小 11556 字节
文件类型 troff or preprocessor input, ASCII text, with CRLF line terminators
MD5 6569aaacd8a9d4b7242acc5f00ed60a3
SHA1 e36ee7f0005487dc3a3491be9b68106bdfdb5ac4
SHA256 74c1a9152795b24e4c39b0c2c1ec599f0d2bf6d2a52603dc3ada00332bfc0f9a
CRC32 23C2A9E7
Ssdeep 192:n7/QjG8edQ8OAGseB5fqYBx9S6Mv5gpOY0yNv7NkuwNHdTw:n1NdQ8Pe5fqav7NkhHds
下载提交魔盾安全分析显示文本
@charset "utf-8";
* {
	margin: 0;
	padding: 0;
	font-family: '\5FAE\8F6F\96C5\9ED1', '\5B8B\4F53';
}
ul {
	list-style: none;
}
a {
	text-decoration: none;
}
.cf {
	clear: both;
}
html, body, #body {
	overflow: hidden;
}
#body {
	position: relative;
}
.logo {
	position: absolute;
	left: 28px;
	top: 20px;
	z-index: 9999;
	cursor: pointer;
}
.logo .logo_in {
	width: 163px;
	height: 33px;
	background: url("../images/log55o.png") no-repeat;
	_background: none;
 _filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src="resources/images/logo.png");
}
.down {
	position: absolute;
	left: 50%;
	margin-left: -350px;
	top: 50%;
	margin-top: 170px;
	width: 188px;
	height: 50px;
	z-index: 9999;
	cursor: pointer;
	overflow: hidden;
	background:#69CC56;
	background:url(../images/down1.png) no-repeat 0 0;
	display:block;
}


.down:hover{background:url(../images/down1.png) no-repeat 0 -51px;}

.down2 {
	position: absolute;
	left: 50%;
	margin-left: -80px;
	top: 50%;
	margin-top: 170px;
	width: 188px;
	height: 50px;
	z-index: 9999;
	cursor: pointer;
	overflow: hidden;
	background:#69CC56;
	background:url(../images/down2.png) no-repeat 0 0;
	display:block;
}

.down3 {
	position: absolute;
	left: 50%;
	margin-left: 210px;
	top: 50%;
	margin-top: 170px;
	width: 188px;
	height: 50px;
	z-index: 9999;
	cursor: pointer;
	overflow: hidden;
	background:#69CC56;
	background:url(../images/down3.png) no-repeat 0 0;
	display:block;
}


.down2:hover{background:url(../images/down2.png) no-repeat 0 -51px;}
.down3:hover{background:url(../images/down3.png) no-repeat 0 -51px;}

.text{ font-size:12px; color:#FFF; position:absolute; z-index:2000; top:47%; left:50%; margin-top:268px; margin-left:-330px;}

.text2{ font-size:12px; color:#FFF; position:absolute; z-index:2000; top:47%; left:50%; margin-top:268px; margin-left:-60px;}
.text3{ font-size:12px; color:#FFF; position:absolute; z-index:2000; top:47%; left:50%; margin-top:268px; margin-left:230px;}

.point {
	position: absolute;
	top: 50%;
	right: 48px;
	width: 12px;
}
.point div {
	font-size: 0;
	width: 12px;
	height: 12px;
	overflow: hidden;
	margin-top: 7px;
	margin-bottom: 7px;
	background: url('../images/point_normal.png') no-repeat 0 0;
	_background: url('../images/point_ie6.png') no-repeat 0 0;
	cursor: pointer;
}
.point div.now {
	background: url('../images/point_normal.png') no-repeat 0 -12px;
	_background: url('../images/point_ie6.png') no-repeat 0 -12px;
}
.ICP {
	position: absolute;
	left: 50%;
	margin-left: -505px;
	bottom: 0;
	width: 1010px;
	height: 24px;
	line-height: 24px;
	text-align: center;
	font-size: 12px;
	color: #aaaaaa;
	cursor: default;
}
.block {
	position: absolute;
	left: 0;
	top: 0;
}
.block .img {
	position: absolute;
	left: 50%;
	top: 50%;
}
.b1 {
	background:url(../images/bg1.jpg) no-repeat center;
}
.b2 {
	background:url(../images/bg2.jpg) no-repeat center;
}
.b3 {
	background:url(../images/bg3.jpg) no-repeat center;
}
/*.b4 {*/
	/*background:url(../images/bg4.jpg) no-repeat center;*/
/*}*/
.big_rock {
 -webkit-transition: -webkit-transform .2s;
 -moz-transition: -moz-transform .2s;
 -ms-transition: -ms-transform .2s;
}
.big_rock:hover {
	-webkit-transform: scale(1.1);
	-moz-transform: scale(1.1);
	-ms-transform: scale(1.1);
}
.now .img1_0 {
	width: 1124px;
	height: 967px;
	margin-left: -562px;
	margin-top: -483px;
	-webkit-animation: img1_0 1s;
	-moz-animation: img1_0 1s;
	-ms-animation: img1_0 1s;
}
@-webkit-keyframes img1_0 {
 from {
-webkit-transform: scale(.2);
opacity: 0;
}
}
@-moz-keyframes img1_0 {
 from {
-moz-transform: scale(.2);
opacity: 0;
}
}
@-ms-keyframes img1_0 {
 from {
-ms-transform: scale(.2);
opacity: 0;
}
}
.now .img1_1 {
	width: 341px;
	height: 336px;
	margin-left: -170px;
	margin-top: -345px;
	background: url("../images/img1_1.png") no-repeat;
	_background: none;
 _filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src="resources/images/img1_1.png");
	-webkit-animation: shangxia 2s ease-in-out infinite alternate;
	-moz-animation: shangxia 2s ease-in-out infinite alternate;
	-ms-animation: shangxia 2s ease-in-out infinite alternate;
}
@-webkit-keyframes shangxia {
 0% {
-webkit-transform: translateY(0px)
}
 100% {
-webkit-transform: translateY(-15px)
}
}
@-moz-keyframes shangxia {
 0% {
-moz-transform: translateY(0px)
}
 100% {
-moz-transform: translateY(-15px)
}
}
@-ms-keyframes shangxia {
 0% {
-ms-transform: translateY(0px)
}
 100% {
-ms-transform: translateY(-15px)
}
}
 @-webkit-keyframes img1_1 {
 from {
-webkit-transform: scale(1.5) rotateZ(-90deg);
opacity: 0
}
}
@-moz-keyframes img1_1 {
 0% {
opacity: 0
}
 10% {
opacity: 0
}
}
@-ms-keyframes img1_1 {
 from {
-ms-transform: scale(1.5) rotateZ(-90deg);
opacity: 0
}
}
.img1_2, .now .img1_2 {
	width: 556px;
	height: 93px;
	margin-left: -246px;
	margin-top: -35px;
	font-size:70px;
	color:#FFF;
	-webkit-animation: img1_2 1s;
	-moz-animation: img1_2 1s;
	-ms-animation: img1_2 1s;
}
@-webkit-keyframes img1_2 {
 0% {
-webkit-transform: translateY(30px);
opacity: 0
}
50% {
-webkit-transform: translateY(30px);
opacity: 0
}
}
@-moz-keyframes img1_2 {
 0% {
-moz-transform: translateY(30px);
opacity: 0
}
50% {
-moz-transform: translateY(30px);
opacity: 0
}
}
@-ms-keyframes img1_2 {
 0% {
-ms-transform: translateY(30px);
opacity: 0
}
50% {
-ms-transform: translateY(30px);
opacity: 0
}
}
.img2_2, .now .img2_2 {
	width: 556px;
	height: 93px;
	margin-left: -246px;
	margin-top: -35px;
	font-size:70px;
	color:#FFF;
	-webkit-animation: img1_2 1s;
	-moz-animation: img1_2 1s;
	-ms-animation: img1_2 1s;
}
.img3_2, .now .img3_2 {
	width: 556px;
	height: 93px;
	margin-left: -246px;
	margin-top: -35px;
	font-size:70px;
	color:#FFF;
	-webkit-animation: img1_2 1s;
	-moz-animation: img1_2 1s;
	-ms-animation: img1_2 1s;
}
.img2_3, .now .img2_3, .img1_3, .now .img1_3 {
	width: 500px;
	line-height:160%;
	margin-left: -246px;
	margin-top: 75px;
	font-size:16px;
	color:#FFF;
	text-align:center;
	-webkit-animation: img1_3 1s;
	-moz-animation: img1_3 1s;
	-ms-animation: img1_3 1s;
}
 @-webkit-keyframes img1_3 {
 0% {
-webkit-transform: translateY(-30px);
opacity: 0
}
50% {
-webkit-transform: translateY(-30px);
opacity: 0
}
}
@-moz-keyframes img1_3 {
 0% {
-moz-transform: translateY(-30px);
opacity: 0
}
50% {
-moz-transform: translateY(-30px);
opacity: 0
}
}
@-ms-keyframes img1_3 {
 0% {
-ms-transform: translateY(-30px);
opacity: 0
}
50% {
-ms-transform: translateY(-30px);
opacity: 0
}
}
.now .img2_1 {
	width: 237px;
	height: 237px;
	margin-left: -121px;
	margin-top: -330px;
	background: url("../images/img2_1.png") no-repeat;
	_background: none;
	-webkit-animation: img4_1 1s;
	-moz-animation: img4_1 1s;
	-ms-animation: img4_1 1s;
	-webkit-animation: shangxia 2s ease-in-out infinite alternate;
	
	-ms-animation: shangxia 2s ease-in-out infinite alternate;
}
@-webkit-keyframes img2_1 {
 from {
-webkit-transform: scale(1.5) rotateZ(90deg);
opacity: 0
}
}
@-moz-keyframes img2_1 {
 0% {
opacity: 0
}
 10% {
opacity: 0
}
}
@-ms-keyframes img2_1 {
 from {
-ms-transform: scale(1.5) rotateZ(90deg);
opacity: 0
}
}
.now .img3_1 {
	width: 237px;
	height: 237px;
	margin-left: -121px;
	margin-top: -330px;
	background: url("../images/img3_1.png") no-repeat;
	_background: none;
	-webkit-animation: img4_1 1s;
	-moz-animation: img4_1 1s;
	-ms-animation: img4_1 1s;
	-webkit-animation: shangxia 2s ease-in-out infinite alternate;

	-ms-animation: shangxia 2s ease-in-out infinite alternate;
}
.now .img4_1 {
	width: 237px;
	height: 237px;
	margin-left: -121px;
	margin-top: -330px;
	background: url("../images/img4_1.png") no-repeat;
	_background: none;
	-webkit-animation: img4_1 1s;
	-moz-animation: img4_1 1s;
	-ms-animation: img4_1 1s;
	-webkit-animation: shangxia 2s ease-in-out infinite alternate;

	-ms-animation: shangxia 2s ease-in-out infinite alternate <truncated>
文件名 log55o[1].png
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EHDRIWWS\log55o[1].png
文件大小 3360 字节
文件类型 PNG image data, 163 x 33, 8-bit/color RGBA, non-interlaced
MD5 0eecf0e3f8e457fc67a7b7c1460b25a6
SHA1 a02092def51c776003668486feb2cbcd4170d1bb
SHA256 691078feea264db871662bd35e072faca7c2f4f256378ffe43e8acac3a9ddfeb
CRC32 FA7D4EF8
Ssdeep 96:MqyY5Af/gIVZzYV5QQgn3Ke6s6oRpMEkWasSbGZ7N3:Mqr5Af/3DzYVa96Ms4bSiZx3
下载提交魔盾安全分析
文件名 bg1[1].jpg
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\bg1[1].jpg
文件大小 57699 字节
文件类型 JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x1080, frames 3
MD5 a7ab9406a2848ebb06e6ec286abba18e
SHA1 03c8c43f9f67604787467c9d98b4e46099b9f6a5
SHA256 46849c48e2dbb1bf288bc729c7eb49a1d13d3cea58891ee23dfaa517c0be4133
CRC32 35B0C91A
Ssdeep 768:/FkpLOlxKpKIq30+erNO5rFgmmlDdRdU6NeGqaW3KJIJu+b:apExsb+eqtmlDBU6NeGD7Z+b
下载提交魔盾安全分析
文件名 www.znyshurufa[1].xml
相关文件
C:\Users\test\AppData\Local\Microsoft\Internet Explorer\DOMStore\YEE0B1V8\www.znyshurufa[1].xml
文件大小 136 字节
文件类型 ASCII text, with no line terminators
MD5 c4e6474e74a4c0233886375e425e03b2
SHA1 ff71813f31388aee5cdb78ace125141353afe84e
SHA256 eb85e0a951d76a0d55f03afa9f9909999b51a1067cc5ff2de6b9e268e48e38d8
CRC32 787945E2
Ssdeep 3:D9yRtFwslqn0SRyxBGTAGpTjgVqUQwu2q8UQWNRJAqSaYwoaKb:JUFJf1BGTAKTEVqDwI8UQWNIaYwwb
下载提交魔盾安全分析显示文本
<root><item name="Hm_lvt_d244e430403005a8fbdc44484ecf6460" value="1544886350409|1513350300" ltime="835715984" htime="30635446" /></root>
文件名 test@hm.baidu[1].txt
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\Cookies\test@hm.baidu[1].txt
文件大小 93 字节
文件类型 ASCII text
MD5 7843a18e9212e4aa413b590fd97e741e
SHA1 2fea9567aee76dc983a07cbac0eab0cb058ed00f
SHA256 17bdef87f7b41c76287b14aed486b76c9455681c992ff374053015f87b87f3d8
CRC32 53BA6619
Ssdeep 3:+mL1ILkk0Vv7YfWAUsTOXGTGysY5Xn:ZiLkkPWA3sEzvX
下载提交魔盾安全分析显示文本
HMACCOUNT
214641541719C077
hm.baidu.com/
2147484672
2350186496
32111674
334935984
30635446
*
文件名 index.dat
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\IECompatCache\index.dat
文件大小 65536 字节
文件类型 Internet Explorer cache file version Ver 5.2
MD5 191d3d20f356bf520a7d1ed07b1bc08b
SHA1 bdba37ad96d8801e8d2c9e30e68afaf3822b0e4a
SHA256 d2eae7eeb07f08972ec78e59eaf73b6cfa48e92121748f61a394a28e33e36788
CRC32 BFF870C9
Ssdeep 384:wEEG/+oBMgfh3+EIOTcxi8kB+JuE1uPFykblh2F/0mjv3Bw2LI/u1sVdvM2zLOY4:wEEG/+xo
下载提交魔盾安全分析
文件名 D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE
文件大小 408 字节
文件类型 data
MD5 ffb46df4b800a731e47d73c58888a48d
SHA1 01a8527e5bbed62cf3913f611ffc70f0771f3c42
SHA256 2c2288dca4a8675c474f9dcabd6d96d5e32dc57e9f668b5fc5d42d0dcc89fbe2
CRC32 CD45A46B
Ssdeep 6:kKfpD3rH5loioTtlBR8MziKpivhClroFNnleuJUPlxojPFcTNTl3Ts8JJn:Hl4RzJzHiv8sFOAUPlJTNT1Y8H
下载提交魔盾安全分析
文件名 test@znyshurufa[1].txt
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\Cookies\test@znyshurufa[1].txt
文件大小 113 字节
文件类型 ASCII text
MD5 1648888fcf0f49d951d96f1650c81215
SHA1 202b38862cb0c02fa422d2aee2df19cb2e5630c4
SHA256 bbf9a1a2e24cbe24bd571f81b73f0ff56a07ae63a41abc84084f3c2a7ae2ddb9
CRC32 B46C6DD0
Ssdeep 3:lqn0SRyxBGTAGpTQoKaGKIKMVdtNQvUjWOKd5Xn:lf1BGTAKTDKaGZVdwM3KvX
下载提交魔盾安全分析显示文本
Hm_lvt_d244e430403005a8fbdc44484ecf6460
1513350300
znyshurufa.com/
1088
2857917184
30708871
835715984
30635446
*
文件名 C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF
文件大小 1754 字节
文件类型 data
MD5 c687e5a34a3fe3d30642e81571ddedb6
SHA1 5614c2bd8c4c87b5f4aa84aadafa5e69f3a2d89e
SHA256 15d14d6040c15771e61afe3d01195804e7237ae3db83273f811ec4b30341e890
CRC32 FF2AAC41
Ssdeep 48:Un/lU4ltptDILLoW+6aCzUzbQUT4Xb6yJo6:c/CQtzckjCzWbLT4L6m/
下载提交魔盾安全分析
文件名 D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE
文件大小 1435 字节
文件类型 data
MD5 f7ed1f5a161095e91e5ac9662b031185
SHA1 b8d546012b381cb388ead039b429d9a98903b386
SHA256 f0bce82cbcb6104b743a0dcd43e34ff3c5ee8627d0fb2071f123cb8e6d89cc01
CRC32 BF6CCF51
Ssdeep 24:qtUQDEu4JM3LXscDkhaxQ7N67IuN474xgYOIpJWm3TC68rX+ZziwDPz:kUQLIu8h6JNkiOIjWG0rvwbz
下载提交魔盾安全分析
文件名 down2[1].png
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\down2[1].png
文件大小 23318 字节
文件类型 PNG image data, 188 x 101, 8-bit/color RGBA, non-interlaced
MD5 107ef1cb214e9d6c99deeb589053b1e4
SHA1 20b3016c4b2c0d407d42ac79028bb8fe2a731c0f
SHA256 17c7fe47c4c8a095ca92f7f205fa6b7e9f43986763306337ee1836df16da873d
CRC32 A07B81D0
Ssdeep 192:mktG5BIjINb1MmRhd/61LyPjoYSnSm2hflt4xlAKKpBEuiTVZHr:NtG5BIjIVimb+t1p86wXpBEzL
下载提交魔盾安全分析
文件名 img1_1[1].png
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CB4GP22D\img1_1[1].png
文件大小 34528 字节
文件类型 PNG image data, 341 x 336, 8-bit/color RGBA, non-interlaced
MD5 a308d61c65211eb01e707f3d2c7fe9e8
SHA1 348a8822b0a7ebc44bf0a180e4eb5fbd8d7eaec1
SHA256 8d88d5c0bd3478c9de28d72f13a193817036376ec12ef6ba23c10bd7d24b5105
CRC32 038CA0CD
Ssdeep 768:1uxs8ONYjjDHXRWOGpcPs3LS4DgJXgk1dTh5ENm6cBHpy:1uxstNYjPVGePF4MJX5TDEsO
下载提交魔盾安全分析
文件名 index.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Feeds Cache\index.dat
文件大小 32768 字节
文件类型 Internet Explorer cache file version Ver 5.2
MD5 0aee387ca0a52dcdd8f8a29ea76edb42
SHA1 5df81547dcadb2a7b8bc689da8e1383ba1a84cb9
SHA256 c31bc37e102b70a472837d530ec80bdaea28b0fefda3e9aa8c8cda98c4200c4e
CRC32 B451CA0B
Ssdeep 12:qjtSaFpbZli3zIoYDPO7em4GZj03W/cKYDPOCG5A30WUsOXQDG9YRm4GZ5:qj4avEIoYTCebGZ7ZYTlEJ0oQQ4bGZ
魔盾安全分析结果 2.0分析时间:2016-11-06 20:10:20查看分析报告
下载提交魔盾安全分析
文件名 C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF
文件大小 398 字节
文件类型 data
MD5 4b9052a3d331a127a5ea810bc8cfc7dd
SHA1 32dc5b4cb46fadf77119a843bd5e86bb18e5cd21
SHA256 ba7383898fb97e6259f29bb9fad7a39ad8180db0bea5307e76d49f13cfc8108c
CRC32 7847327B
Ssdeep 6:kKB/klRZCRxaRGlKpivhClroFHP7jDsczlGSuZrgglilH0ROy0evo4UAlWn:SvRiv8sFzjD9zlUZrggIlHVyt3Z4
下载提交魔盾安全分析
文件名 bg2[1].jpg
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\bg2[1].jpg
文件大小 93858 字节
文件类型 JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x1080, frames 3
MD5 8bd49222b23684202b45b00c8ae8c262
SHA1 783614060c9e283ea62f120c2fab51dc6d51ebc6
SHA256 c00187bd64da4e432268b2467b1a10ac6f45bf7489e28f8de7966e72f83d2d90
CRC32 997E39E2
Ssdeep 1536:555bTp2A2S3dBmN8FStx9yWG/Dwt6FryNJR0COfLzBi:13/mNeStx9yWWfF401Q
下载提交魔盾安全分析
文件名 down3[1].png
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CB4GP22D\down3[1].png
文件大小 21619 字节
文件类型 PNG image data, 188 x 101, 8-bit/color RGBA, non-interlaced
MD5 2e929879624a8f4ffcc41aeb80751cf6
SHA1 3f498eee93fee18d4622c1819c42b26eef5e73da
SHA256 877799d897d1a8ae3ba3f830f9573ea9ed6948fc67c9a662d4cac10ac6221d13
CRC32 2E6FA8F9
Ssdeep 192:6kt65BNbhENbhALezvknQ4mIW88yHddIc6UiPpwHe:Jt65Bpep1zM4+Eoe
下载提交魔盾安全分析
文件名 down1[1].png
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\down1[1].png
文件大小 23104 字节
文件类型 PNG image data, 188 x 101, 8-bit/color RGBA, non-interlaced
MD5 48305b5ce302dd137ee4e38bcd0d5cbf
SHA1 cc0479173372b9e90d11d2e9ff3fa1cf1e950360
SHA256 50ff0b15e8fca20e40f5d4ea875be65660b8ba8cfa8d962a064f8797c3b23366
CRC32 D021EE40
Ssdeep 192:mktO5BXkXYtJ7DfHqa/9MIx25DOG0icu+EUxj5bhJA9GaoEJ:NtO5BXkXM5/9MIxGNeu+3BJctJ
下载提交魔盾安全分析
文件名 bg3[1].jpg
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\bg3[1].jpg
文件大小 45137 字节
文件类型 JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x1080, frames 3
MD5 3078ddb36ad1e8b7503e4182a4cc5282
SHA1 d14ea4049533a4859237fb79659e889900bfbd8f
SHA256 95adde1587825bf8f117eb0d614e108dba92922217d87143a67007b2f7403541
CRC32 61E5B3D2
Ssdeep 384:+HhdWkbPqf3BuWrcD0/lBAj0Tv8j388pf+LRVt/6Jk90hsdg2exgi8a:6qfBuWrB3yHj3Dp+VVBZ90ui2mgLa
下载提交魔盾安全分析
文件名 cloud2[1].png
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CB4GP22D\cloud2[1].png
文件大小 7542 字节
文件类型 PNG image data, 271 x 76, 8-bit colormap, non-interlaced
MD5 d7d76aed9cc58b9b655145d4e1ad5ab8
SHA1 2ac9764a1e4b128eed394190e7c2bc08e8ed7964
SHA256 a7c37f8d1403cc8e35abd1a642b0a37c2c96472bdb2d3cf4546bd0fdb5b16c2c
CRC32 A3534BDE
Ssdeep 192:Q2cTiCif4hQPz7x1zNILhlYSbCIIgxe5Zr38RyDN:QpTiNgQPp5elYSbUuCrYyDN
下载提交魔盾安全分析
文件名 RecoveryStore.{6584B803-E188-11E7-A1F7-525400F9C664}.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6584B803-E188-11E7-A1F7-525400F9C664}.dat
文件大小 3584 字节
文件类型 Composite Document File V2 Document, Cannot read section info
MD5 7787cf1513682128a302e48850aee237
SHA1 cd1c45795bf3c2e86cd3c032c83e6a5b17b24e6b
SHA256 882db344871df99f0d2ae12a97844f022addc821c527a6c47f1d383c2fc6ea76
CRC32 5529C60C
Ssdeep 12:rl0YmGF2ArEg5+IaCrI017+FmDrEgmf+IaCy8qgQNlTqo0dCL4:rIA5/1Gv/TQNlWo0AL4
下载提交魔盾安全分析
文件名 705A76DE71EA2CAEBB8F0907449CE086_611D8AF93D88D61ED8CD55C30E7FC92A
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\705A76DE71EA2CAEBB8F0907449CE086_611D8AF93D88D61ED8CD55C30E7FC92A
文件大小 1609 字节
文件类型 data
MD5 5bcd730b875e6f074457cfe47867bd18
SHA1 e088ec2088887d2fafd909ee5b695e18ea5a7b11
SHA256 6c60a2eea1410d5f53a54d024e7ae4ac4338b18c801686d3c633921eebe98ddc
CRC32 1BED75A2
Ssdeep 48:rZymeCLOSk7WCx3yUqZ89c4Bl+xetwM9bVv:gdCKkCxva4Bl91Vv
下载提交魔盾安全分析
HTML 总结报告
(需15-60分钟同步)
下载

Processing ( 33.675 seconds )

  • 20.62 NetworkAnalysis
  • 7.957 Suricata
  • 1.695 BehaviorAnalysis
  • 1.485 Dropped
  • 1.298 VirusTotal
  • 0.604 Static
  • 0.012 AnalysisInfo
  • 0.002 Debug
  • 0.002 Memory

Signatures ( 3.17 seconds )

  • 2.201 md_url_bl
  • 0.163 antiav_detectreg
  • 0.081 stealth_timeout
  • 0.063 api_spamming
  • 0.06 infostealer_ftp
  • 0.042 md_bad_drop
  • 0.039 infostealer_im
  • 0.038 antivm_generic_scsi
  • 0.038 md_domain_bl
  • 0.033 antianalysis_detectreg
  • 0.025 infostealer_mail
  • 0.023 stealth_file
  • 0.02 antivm_generic_services
  • 0.018 mimics_filetime
  • 0.017 antivm_generic_disk
  • 0.017 antiav_detectfile
  • 0.013 bootkit
  • 0.013 virus
  • 0.012 infostealer_bitcoin
  • 0.011 geodo_banking_trojan
  • 0.009 betabot_behavior
  • 0.008 antiemu_wine_func
  • 0.008 kibex_behavior
  • 0.008 vawtrak_behavior
  • 0.008 antivm_parallels_keys
  • 0.008 antivm_xen_keys
  • 0.008 darkcomet_regkeys
  • 0.007 antivm_vbox_files
  • 0.007 ransomware_extensions
  • 0.007 ransomware_files
  • 0.006 hancitor_behavior
  • 0.006 dridex_behavior
  • 0.006 infostealer_browser_password
  • 0.006 persistence_autorun
  • 0.006 kovter_behavior
  • 0.005 stealth_network
  • 0.005 antidbg_windows
  • 0.005 antivm_generic_diskreg
  • 0.005 recon_fingerprint
  • 0.004 andromeda_behavior
  • 0.004 stack_pivot
  • 0.004 ransomware_message
  • 0.004 antivm_vbox_libs
  • 0.004 disables_browser_warn
  • 0.003 injection_createremotethread
  • 0.003 antisandbox_productid
  • 0.003 antivm_vbox_keys
  • 0.003 antivm_vmware_keys
  • 0.003 network_torgateway
  • 0.003 packer_armadillo_regkey
  • 0.002 tinba_behavior
  • 0.002 hawkeye_behavior
  • 0.002 rat_nanocore
  • 0.002 antiav_avast_libs
  • 0.002 rat_luminosity
  • 0.002 sets_autoconfig_url
  • 0.002 Locky_behavior
  • 0.002 antisandbox_sunbelt_libs
  • 0.002 ipc_namedpipe
  • 0.002 exec_crash
  • 0.002 antivm_vmware_events
  • 0.002 injection_runpe
  • 0.002 cryptowall_behavior
  • 0.002 antidbg_devices
  • 0.002 antivm_xen_keys
  • 0.002 antivm_hyperv_keys
  • 0.002 antivm_vbox_acpi
  • 0.002 antivm_vpc_keys
  • 0.002 browser_security
  • 0.002 bypass_firewall
  • 0.002 rat_pcclient
  • 0.001 network_tor
  • 0.001 network_anomaly
  • 0.001 antivm_vmware_libs
  • 0.001 clickfraud_cookies
  • 0.001 virtualcheck_js
  • 0.001 antivm_vbox_window
  • 0.001 injection_explorer
  • 0.001 kazybot_behavior
  • 0.001 heapspray_js
  • 0.001 antisandbox_sboxie_libs
  • 0.001 dead_connect
  • 0.001 antiav_bitdefender_libs
  • 0.001 dyre_behavior
  • 0.001 shifu_behavior
  • 0.001 ispy_behavior
  • 0.001 cerber_behavior
  • 0.001 securityxploded_modules
  • 0.001 antivm_generic_bios
  • 0.001 antivm_generic_cpu
  • 0.001 antivm_generic_system
  • 0.001 antivm_vmware_files
  • 0.001 banker_zeus_mutex
  • 0.001 bot_drive
  • 0.001 bot_drive2
  • 0.001 browser_addon
  • 0.001 codelux_behavior
  • 0.001 disables_system_restore
  • 0.001 disables_windows_defender
  • 0.001 ie_martian_children
  • 0.001 modify_uac_prompt
  • 0.001 rat_spynet
  • 0.001 recon_programs
  • 0.001 sniffer_winpcap
  • 0.001 targeted_flame
  • 0.001 whois_create

Reporting ( 0.473 seconds )

  • 0.473 ReportHTMLSummary
Task ID 122629
Mongo ID 5a33ae12bb7d5720df12a142
Cuckoo release 1.4-Maldun