分析任务

分析类型 虚拟机标签 开始时间 结束时间 持续时间
URL win7-sp1-x64-hpdapp03-1 2017-12-13 13:34:41 2017-12-13 13:37:02 141 秒

魔盾分数

1.05

正常的

URL详细信息

URL
URL专业沙箱检测 -> https://xztwq.wufoo.com/forms/untitled-form

登录查看威胁特征

运行截图


访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
104.17.176.200 美国
117.18.237.29 亚洲太平洋地区
151.101.230.110 美国
162.247.242.18 美国
183.136.212.50 中国
58.211.137.192 未知 中国
65.55.186.115 美国
74.125.204.82 美国
75.98.93.66 未知 美国

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
xztwq.wufoo.com 未知 CNAME wufoo.com
A 75.98.93.66
ocsp.digicert.com CNAME cs9.wac.phicdn.net
A 117.18.237.29
html5shiv.googlecode.com A 74.125.204.82
CNAME googlecode.l.googleusercontent.com
www.microsoft.com CNAME e1863.ca2.s.tl88.net
CNAME www.microsoft.com-c-2.edgekey.net.globalredir.akadns.net
CNAME www.microsoft.com-c-2.edgekey.net
A 183.136.212.50
data.tvdownload.microsoft.com A 65.55.186.115
CNAME data.tvdownload.windowsmedia.com.akadns.net
js-agent.newrelic.com CNAME f4.shared.global.fastly.net
A 151.101.230.110
ocsp.globalsign.com CNAME cdn.globalsigncdn.com
A 58.211.137.192
bam.nr-data.net A 162.247.242.18
A 162.247.242.19
A 162.247.242.21
A 162.247.242.20
g2.symcb.com CNAME ocsp-ds.ws.symantec.com.edgekey.net
CNAME e8218.dscb1.akamaiedge.net
A 23.37.43.27
ocsp.msocsp.com CNAME hostedocsp.globalsign.com
CNAME ocsp.globalsign.cloud
A 104.17.178.200
A 104.17.177.200
A 104.17.179.200
A 104.17.175.200
A 104.17.176.200

摘要

登录查看详细行为信息

WHOIS 信息

Name: Domain Admin
Country: US
State: CA
City: Palo Alto
ZIP Code: 94301
Address: 101 Lytton Avenue,

Orginization: SurveyMonkey Inc.
Domain Name(s):
    WUFOO.COM
    wufoo.com
Creation Date:
    2006-01-16 06:45:18
    2006-01-15 22:45:18-0800
Updated Date:
    2015-12-15 10:05:55
    2017-04-22 04:00:25-0700
Expiration Date:
    2018-01-16 06:45:18
    2018-01-15 22:45:18-0800
Email(s):
    abusecomplaints@markmonitor.com
    domainadmin@surveymonkey.com

Registrar(s):
    MarkMonitor, Inc.
Name Server(s):
    NS1.P22.DYNECT.NET
    NS2.P22.DYNECT.NET
    NS3.P22.DYNECT.NET
    NS4.P22.DYNECT.NET
    ns2.p22.dynect.net
    ns1.p22.dynect.net
    ns3.p22.dynect.net
    ns4.p22.dynect.net
Referral URL(s):
    None
没有防病毒引擎扫描信息!

进程树


iexplore.exe, PID: 2072, 上一级进程 PID: 704
iexplore.exe, PID: 2356, 上一级进程 PID: 2072

访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
104.17.176.200 美国
117.18.237.29 亚洲太平洋地区
151.101.230.110 美国
162.247.242.18 美国
183.136.212.50 中国
58.211.137.192 未知 中国
65.55.186.115 美国
74.125.204.82 美国
75.98.93.66 未知 美国

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49185 104.17.176.200 ocsp.msocsp.com 80
192.168.122.201 49165 117.18.237.29 ocsp.digicert.com 80
192.168.122.201 49190 117.18.237.29 ocsp.digicert.com 80
192.168.122.201 49178 151.101.230.110 js-agent.newrelic.com 443
192.168.122.201 49182 162.247.242.18 bam.nr-data.net 443
192.168.122.201 49172 183.136.212.50 www.microsoft.com 80
192.168.122.201 49187 183.136.212.50 www.microsoft.com 80
192.168.122.201 49183 23.37.43.27 g2.symcb.com 80
192.168.122.201 49184 23.37.43.27 g2.symcb.com 80
192.168.122.201 49179 58.211.137.192 ocsp.globalsign.com 80
192.168.122.201 49175 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49186 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49188 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49200 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49201 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49222 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49171 74.125.204.82 html5shiv.googlecode.com 443
192.168.122.201 49173 74.125.204.82 html5shiv.googlecode.com 443
192.168.122.201 49163 75.98.93.66 xztwq.wufoo.com 443
192.168.122.201 49177 75.98.93.66 xztwq.wufoo.com 443
192.168.122.201 49189 77.67.20.140 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 50907 192.168.122.1 53
192.168.122.201 51444 192.168.122.1 53
192.168.122.201 52050 192.168.122.1 53
192.168.122.201 53297 192.168.122.1 53
192.168.122.201 54903 192.168.122.1 53
192.168.122.201 55303 192.168.122.1 53
192.168.122.201 58406 192.168.122.1 53
192.168.122.201 59004 192.168.122.1 53
192.168.122.201 59793 192.168.122.1 53
192.168.122.201 60316 192.168.122.1 53
192.168.122.201 60407 192.168.122.1 53
192.168.122.201 60455 192.168.122.1 53
192.168.122.201 64169 192.168.122.1 53

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
xztwq.wufoo.com 未知 CNAME wufoo.com
A 75.98.93.66
ocsp.digicert.com CNAME cs9.wac.phicdn.net
A 117.18.237.29
html5shiv.googlecode.com A 74.125.204.82
CNAME googlecode.l.googleusercontent.com
www.microsoft.com CNAME e1863.ca2.s.tl88.net
CNAME www.microsoft.com-c-2.edgekey.net.globalredir.akadns.net
CNAME www.microsoft.com-c-2.edgekey.net
A 183.136.212.50
data.tvdownload.microsoft.com A 65.55.186.115
CNAME data.tvdownload.windowsmedia.com.akadns.net
js-agent.newrelic.com CNAME f4.shared.global.fastly.net
A 151.101.230.110
ocsp.globalsign.com CNAME cdn.globalsigncdn.com
A 58.211.137.192
bam.nr-data.net A 162.247.242.18
A 162.247.242.19
A 162.247.242.21
A 162.247.242.20
g2.symcb.com CNAME ocsp-ds.ws.symantec.com.edgekey.net
CNAME e8218.dscb1.akamaiedge.net
A 23.37.43.27
ocsp.msocsp.com CNAME hostedocsp.globalsign.com
CNAME ocsp.globalsign.cloud
A 104.17.178.200
A 104.17.177.200
A 104.17.179.200
A 104.17.175.200
A 104.17.176.200

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49185 104.17.176.200 ocsp.msocsp.com 80
192.168.122.201 49165 117.18.237.29 ocsp.digicert.com 80
192.168.122.201 49190 117.18.237.29 ocsp.digicert.com 80
192.168.122.201 49178 151.101.230.110 js-agent.newrelic.com 443
192.168.122.201 49182 162.247.242.18 bam.nr-data.net 443
192.168.122.201 49172 183.136.212.50 www.microsoft.com 80
192.168.122.201 49187 183.136.212.50 www.microsoft.com 80
192.168.122.201 49183 23.37.43.27 g2.symcb.com 80
192.168.122.201 49184 23.37.43.27 g2.symcb.com 80
192.168.122.201 49179 58.211.137.192 ocsp.globalsign.com 80
192.168.122.201 49175 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49186 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49188 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49200 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49201 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49222 65.55.186.115 data.tvdownload.microsoft.com 443
192.168.122.201 49171 74.125.204.82 html5shiv.googlecode.com 443
192.168.122.201 49173 74.125.204.82 html5shiv.googlecode.com 443
192.168.122.201 49163 75.98.93.66 xztwq.wufoo.com 443
192.168.122.201 49177 75.98.93.66 xztwq.wufoo.com 443
192.168.122.201 49189 77.67.20.140 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 50907 192.168.122.1 53
192.168.122.201 51444 192.168.122.1 53
192.168.122.201 52050 192.168.122.1 53
192.168.122.201 53297 192.168.122.1 53
192.168.122.201 54903 192.168.122.1 53
192.168.122.201 55303 192.168.122.1 53
192.168.122.201 58406 192.168.122.1 53
192.168.122.201 59004 192.168.122.1 53
192.168.122.201 59793 192.168.122.1 53
192.168.122.201 60316 192.168.122.1 53
192.168.122.201 60407 192.168.122.1 53
192.168.122.201 60455 192.168.122.1 53
192.168.122.201 64169 192.168.122.1 53

HTTP 请求

URI HTTP数据
URL专业沙箱检测 -> http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

URL专业沙箱检测 -> http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEApnWMtPTTX9u3twXfQX4os%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEApnWMtPTTX9u3twXfQX4os%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

URL专业沙箱检测 -> http://www.microsoft.com/
GET / HTTP/1.1
Host: www.microsoft.com
Connection: Close

URL专业沙箱检测 -> http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80
GET /rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80 HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sun, 03 Sep 2017 00:23:35 GMT
If-None-Match: "c70e2fd1c6955ec74c92d3d4d5d6a6770e268314"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com

URL专业沙箱检测 -> http://g2.symcb.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6bw%3D%3D
GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6bw%3D%3D HTTP/1.1
Cache-Control: max-age = 334385
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 31 Aug 2017 00:15:28 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: g2.symcb.com

URL专业沙箱检测 -> http://gn.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSxiwsBl1MHLHQ30p2z4Y2jbM5X4AQU0m%2F3lvSFP3I8MH0j2oV4m6N8WnwCEByn6JbJKxD9%2FaGQ0HDCCEI%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSxiwsBl1MHLHQ30p2z4Y2jbM5X4AQU0m%2F3lvSFP3I8MH0j2oV4m6N8WnwCEByn6JbJKxD9%2FaGQ0HDCCEI%3D HTTP/1.1
Cache-Control: max-age = 534132
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 02 Sep 2017 07:45:34 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: gn.symcd.com

URL专业沙箱检测 -> http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQphfxhPb4vsBIPXkIOTJ7D1Z79fAQUCP4ln3TqhwTCvLuOqDhfM8bRbGUCEy0AAO%2FxE5PyQlBerOAAAAAA7%2FE%3D
GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQphfxhPb4vsBIPXkIOTJ7D1Z79fAQUCP4ln3TqhwTCvLuOqDhfM8bRbGUCEy0AAO%2FxE5PyQlBerOAAAAAA7%2FE%3D HTTP/1.1
Cache-Control: max-age = 10800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 06 Dec 2017 07:11:24 GMT
If-None-Match: "a602f001a25d1ece86269d16668acccb0791bbc6"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com

URL专业沙箱检测 -> http://crl.microsoft.com/pki/crl/products/tspca.crl
GET /pki/crl/products/tspca.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 24 May 2014 05:04:54 GMT
If-None-Match: "8ab194b3d77cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com

URL专业沙箱检测 -> http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1
Cache-Control: max-age = 172800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 02 Sep 2017 10:30:03 GMT
If-None-Match: "59aa882b-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

URL专业沙箱检测 -> http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1
Cache-Control: max-age = 172800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 06 Dec 2017 00:22:31 GMT
If-None-Match: "5a273847-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

Timestamp Source IP Source Port Destination IP Destination Port Protocol SID Signature Category
2017-12-13 13:35:06.743300+0800 183.136.212.50 80 192.168.122.201 49172 TCP 2012692 ET POLICY Microsoft user-agent automated process response to automated request A Network Trojan was detected
2017-12-13 13:35:17.018150+0800 183.136.212.50 80 192.168.122.201 49187 TCP 2012692 ET POLICY Microsoft user-agent automated process response to automated request A Network Trojan was detected

TLS

Timestamp Source IP Source Port Destination IP Destination Port Version Issuer Subject Fingerprint
2017-12-13 13:35:06.292303+0800 192.168.122.201 49171 74.125.204.82 443 TLS 1.2 C=US, O=Google Trust Services, CN=Google Internet Authority G3 C=US, ST=California, L=Mountain View, O=Google Inc, CN=*.googlecode.com 00:38:c8:e6:bc:b9:f3:78:bb:68:34:e0:8f:d7:fe:f3:53:96:69:36
2017-12-13 13:35:01.347809+0800 192.168.122.201 49163 75.98.93.66 443 TLS 1.2 C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA C=US, ST=CA, L=Palo Alto, O=SurveyMonkey Inc., CN=*.wufoo.com 0d:ca:0b:91:2d:3a:32:84:9a:ed:b3:b2:d5:d4:07:c7:d2:45:db:dd
2017-12-13 13:35:10.164203+0800 192.168.122.201 49182 162.247.242.18 443 TLS 1.2 C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3 C=US, ST=California, L=San Francisco, O=New Relic, Inc., CN=*.nr-data.net 37:ab:c3:5a:14:73:4f:7a:6a:00:a8:65:06:55:06:3a:1f:03:6c:22
2017-12-13 13:35:08.553871+0800 192.168.122.201 49178 151.101.230.110 443 TLS 1.2 C=BE, O=GlobalSign nv-sa, CN=GlobalSign CloudSSL CA - SHA256 - G3 C=US, ST=California, L=San Francisco, O=Fastly, Inc., CN=f4.shared.global.fastly.net e4:03:1a:d2:28:91:b7:9e:6c:31:6d:67:ce:97:62:2d:18:c6:20:99
2017-12-13 13:35:18.040984+0800 192.168.122.201 49188 65.55.186.115 443 TLSv1 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=data.tvdownload.microsoft.com a1:ca:16:54:fb:ba:28:d9:f4:a0:c3:b7:5b:b4:f5:2b:63:27:87:e5
2017-12-13 13:36:59.520195+0800 192.168.122.201 49201 65.55.186.115 443 TLSv1 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=data.tvdownload.microsoft.com a1:ca:16:54:fb:ba:28:d9:f4:a0:c3:b7:5b:b4:f5:2b:63:27:87:e5
2017-12-13 13:35:11.872949+0800 192.168.122.201 49175 65.55.186.115 443 TLSv1 C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=data.tvdownload.microsoft.com a1:ca:16:54:fb:ba:28:d9:f4:a0:c3:b7:5b:b4:f5:2b:63:27:87:e5

Suricata HTTP

No Suricata HTTP

未发现网络提取文件
文件名 0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875
文件大小 1378 字节
文件类型 data
MD5 5aba6a14fae407b93a4e70c35ba82dc9
SHA1 a24570fdb3c2b28a1ed01777357bf5442ab684e2
SHA256 e904ffaa014de5cc836442769080a3a34415a88e3c96394d9bacd92a57f1be1c
CRC32 92039CEC
Ssdeep 24:QRnWxz21yhbw6vjigeGOmxawri7lRVZM2j5LRhp2STa+Ymadcgx6:QbyjigkGau6XVZ3RhNT3wk
下载提交魔盾安全分析
文件名 0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875
文件大小 358 字节
文件类型 data
MD5 4ef98ac83814b101f7f709e1db49bc6c
SHA1 208f0b2684971644e6e7b0f9051a29ea85043c2d
SHA256 f636a94489ff398a773377cb31edfe8d3df09b0d0c1899466334032cb261deff
CRC32 3B52D3D6
Ssdeep 6:kK0gRlPOL3mXmPaRGlK0IqEdMClroFHF9fKprxGfDWDmu86XtlrpSlAMlsMJn:8wlPOL2Xmy7FDsFXC0rAXdHksMJ
下载提交魔盾安全分析
文件名 test@wufoo[1].txt
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\Cookies\test@wufoo[1].txt
文件大小 92 字节
文件类型 ASCII text
MD5 c39a4ff54fa8aa741add68b609b04b47
SHA1 913ade8bb5a93e01367daf3e42c3778415b65fcb
SHA256 59e2686bbd984ba88e96430a18f2b6b41bd337ae7fac1401787e55cd4011b092
CRC32 02B34062
Ssdeep 3:wFXxwnc9KKLd3MVXJUVQqSqdZ2Pv:wFBPoKZ8VXY2X
下载提交魔盾安全分析显示文本
ep202
vvn58pUAwo/3OyBJC+29psG8RbI=
wufoo.com/
1024
1378756352
30708438
245770768
30634967
*
文件名 A9E4F776657345B52012CE8E279D314C_BFEA25747B8FDEC8EEB86690E71E9BDE
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9E4F776657345B52012CE8E279D314C_BFEA25747B8FDEC8EEB86690E71E9BDE
文件大小 991 字节
文件类型 data
MD5 c587ee9f69df67b91b69016b85e2449b
SHA1 01460d40a49d7c55237e98381c2c6aab8ed8ebaa
SHA256 13abc4e0c44768cdaf230d639b3c3cd942fbf50ffddf176b37a11988626ab7a2
CRC32 F689D119
Ssdeep 24:4rPUihLUEcAOA+0Jz5JXSl+fTp6oXFEWrz/VAK6d6nY3qJ:awkJ1BrfRfd03qJ
下载提交魔盾安全分析
文件名 0DA515F703BB9B49479E8697ADB0B955_7DC3E633EDFAEFC3AA3C99552548EC2F
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_7DC3E633EDFAEFC3AA3C99552548EC2F
文件大小 1521 字节
文件类型 data
MD5 c03f1cb63b6272411992d38828c03496
SHA1 397ab3834a920193bd913eb5af11d235a72a3aa8
SHA256 6a8db082cf8f45120b2009319d35fb919e146d1517713654eb3b0b7f4a467cfc
CRC32 FBF22DAA
Ssdeep 24:wkqN3yJGbi5C2T2zhaW6lFvcuCyNcK7Eike4zgVQruWQyVnoJsLXb/q1:whi5KazlFvculNZEdeufuenoCr70
下载提交魔盾安全分析
文件名 A9E4F776657345B52012CE8E279D314C_BFEA25747B8FDEC8EEB86690E71E9BDE
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A9E4F776657345B52012CE8E279D314C_BFEA25747B8FDEC8EEB86690E71E9BDE
文件大小 426 字节
文件类型 data
MD5 3f6377d7ec116ca4f7f7be1c0d6c2ec2
SHA1 7d2cdefe1306d3abce6b11949f33868a57372319
SHA256 63e5f22115a46fa06f961afe73ce8b00e782029cef20589c993d6f6daa0353bf
CRC32 519D4E5A
Ssdeep 12:gss02MHg+dRmxMiv8sFFu6JPPDTGLwaYcDQ:g/P6mxxvPbJ/GJVQ
下载提交魔盾安全分析
文件名 nr-1044.min[1].js
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDL4J1KW\nr-1044.min[1].js
文件大小 22890 字节
文件类型 ASCII text, with very long lines, with no line terminators
MD5 6442aaa45ec28f8b2c541026f3c24871
SHA1 32dc677bb3fa61736a35d30a809aa1c4a0a04976
SHA256 574558bc99cbcc4c8a0e57519cb6a317a0a4e0b70094fbec41946138d576486b
CRC32 4D37EF1A
Ssdeep 384:yWe9x8LHvWgIdGYwNRUyqK3zqdPEliwbiki5IYrQXFFPXXRbS7gQhs:yWzeg0GYwNHoprBQVBt/Qhs
Yara
  • Rule to detect the no presence of any image
  • Rule to detect the no presence of any attachment
  • Rule to detect the presence of an or several urls
下载提交魔盾安全分析显示文本
!function(n,e,t){function r(t,i){if(!e[t]){if(!n[t]){var a="function"==typeof __nr_require&&__nr_require;if(!i&&a)return a(t,!0);if(o)return o(t,!0);throw new Error("Cannot find module '"+t+"'")}var s=e[t]={exports:{}};n[t][0].call(s.exports,function(e){var o=n[t][1][e];return r(o||e)},s,s.exports)}return e[t].exports}for(var o="function"==typeof __nr_require&&__nr_require,i=0;i<t.length;i++)r(t[i]);return r}({1:[function(n,e,t){e.exports=function(n,e){return"addEventListener"in window?addEventListener(n,e,!1):"attachEvent"in window?attachEvent("on"+n,e):void 0}},{}],2:[function(n,e,t){function r(n,e,t,r){l("bstAgg",[n,e,t,r]),p[n]||(p[n]={});var i=p[n][e];return i||(i=p[n][e]={params:t||{}}),i.metrics=o(r,i.metrics),i}function o(n,e){return e||(e={count:0}),e.count+=1,f(n,function(n,t){e[n]=i(t,e[n])}),e}function i(n,e){return e?(e&&!e.c&&(e={t:e.t,min:e.t,max:e.t,sos:e.t*e.t,c:1}),e.c+=1,e.t+=n,e.sos+=n*n,n>e.max&&(e.max=n),n<e.min&&(e.min=n),e):{t:n}}function a(n,e){return e?p[n]&&p[n][e]:p[n]}function s(n){for(var e={},t="",r=!1,o=0;o<n.length;o++)t=n[o],e[t]=u(p[t]),e[t].length&&(r=!0),delete p[t];return r?e:null}function u(n){return"object"!=typeof n?[]:f(n,c)}function c(n,e){return e}var f=n(30),l=n("handle"),p={};e.exports={store:r,take:s,get:a}},{}],3:[function(n,e,t){function r(n,e,t){"string"==typeof e&&("/"!==e.charAt(0)&&(e="/"+e),h.customTransaction=(t||"http://custom.transaction")+e)}function o(n,e){var t=e?e-h.offset:n;l.store("cm","finished",{name:"finished"},{time:t}),i(n,{name:"finished",start:t+h.offset,origin:"nr"}),v("api-addPageAction",[t,"finished"])}function i(n,e){if(e&&"object"==typeof e&&e.name&&e.start){var t={n:e.name,s:e.start-h.offset,e:(e.end||e.start)-h.offset,o:e.origin||"",t:"api"};v("bstApi",[t])}}function a(n,e,t,r,o,i,a){if(e=window.encodeURIComponent(e),g+=1,h.info.beacon){var s="https://"+h.info.beacon+"/1/"+h.info.licenseKey;s+="?a="+h.info.applicationID+"&",s+="t="+e+"&",s+="qt="+~~t+"&",s+="ap="+~~r+"&",s+="be="+~~o+"&",s+="dc="+~~i+"&",s+="fe="+~~a+"&",s+="c="+g,d.img(s)}}function s(n,e){h.onerror=e}function u(n,e,t){++w>10||(h.releaseIds[e.slice(-200)]=(""+t).slice(-200))}var c=n(13),f=n(8),l=n(2),p=n(15),d=n(19),m=n(30),h=n("loader"),v=n("handle"),g=0;f.on("jserrors",function(){return{body:l.take(["cm"])}});var y={finished:p(o),setPageViewName:r,setErrorHandler:s,addToTrace:i,inlineHit:a,addRelease:u};m(y,function(n,e){c("api-"+n,e,"api")});var w=0},{}],4:[function(n,e,t){var r=/([^?#]*)[^#]*(#[^?]*|$).*/,o=/([^?#]*)().*/;e.exports=function(n,e){return n.replace(e?r:o,"$1$2")}},{}],5:[function(n,e,t){function r(n,e){var t=n[1];i(e[t],function(e,t){var r=n[0],o=t[0];if(o===r){var i=t[1],a=n[3],s=n[2];i.apply(a,s)}})}var o=n("ee"),i=n(30),a=n(13).handlers;e.exports=function(n){var e=o.backlog[n],t=a[n];if(t){for(var s=0;e&&s<e.length;++s)r(e[s],t);i(t,function(n,e){i(e,function(e,t){t[0].on(n,t[1])})})}delete a[n],o.backlog[n]=null}},{}],6:[function(n,e,t){function r(n){return f[n]}function o(n){return null===n||void 0===n?"null":encodeURIComponent(n).replace(p,r)}function i(n,e){for(var t=0,r=0;r<n.length;r++)if(t+=n[r].length,t>e)return n.slice(0,r).join("");return n.join("")}function a(n,e){var t=0,r="";return u(n,function(n,i){var a,s,u=[];if("string"==typeof i)a="&"+n+"="+o(i),t+=a.length,r+=a;else if(i.length){for(t+=9,s=0;s<i.length&&(a=o(c(i[s])),t+=a.length,!("undefined"!=typeof e&&t>=e));s++)u.push(a);r+="&"+n+"=%5B"+u.join(",")+"%5D"}}),r}function s(n,e){return e&&"string"==typeof e?"&"+n+"="+o(e):""}var u=n(30),c=n(18),f={"%2C":",","%3A":":","%2F":"/","%40":"@","%24":"$","%3B":";"},l=u(f,function(n){return n}),p=new RegExp(l.join("|"),"g");e.exports={obj:a,fromArray:i,qs:o,param:s}},{}],7:[function(n,e,t){var r=n(30),o=n("ee"),i=n(5);e.exports=function(n){n&&"object"==typeof n&&(r(n,function(n,e){e&&!a[n]&&(o.emit("feat-"+n,[]),a[n]=!0)}),i("feature"))};var a=e.exports.active={}},{}],8:[function(n,e,t){function r(n){if(n.info.beacon){n.info.queueTime&&b.store("measures","qt",{value:n.info.queueTime}),n.info.applicationTime&&b.store("measures","ap",{value:n.info.applicationTime}),k.measure("be","starttime","firstbyte"),k.measure("fe","firstbyte","onload"),k.measure("dc","firstbyte","domContent");var e=b.get("measures"),t=h(e,function(n,e){return"&"+n+"="+e.params.value}).join("");if(t){var r="1",o=[p(n)];if(o.push(t),o.push(g.param("tt",n.info.ttGuid)),o.push(g.param("us",n.info.user)),o.push(g.param("ac",n.info.account)),o.push(g.param("pr",n.info.product)),o.push(g.param("af",h(n.features,function(n){return n}).join(","))),window.performance&&"undefined"!=typeof window.performance.timing){var i={timing:v.addPT(window.performance.timing,{}),navigation:v.addPN(window.performance.navigation,{})};o.push(g.param("perf",y(i)))}o.push(g.param("xx",n.info.extra)),o.push(g.param("ua",n.info.userAttributes)),o.push(g.param("at",n.info.atts));var a=y(n.info.jsAttributes);o.push(g.param("ja","{}"===a?null:a));var s=g.fromArray(o,n.maxBytes);w.jsonp("https://"+n.info.beacon+"/"+r+"/"+n.info.licenseKey+s,A)}}}function o(n){var e=h(q,function(e){return a(e,n,{unload:!0})});return x(e,i)}function i(n,e){return n||e}function a(n,e,t){return u(e,n,s(n),t||{})}function s(n){for(var e=d({}),t=d({}),r=q[n]||[],o=0;o<r.length;o++){var i=r[o]();i.body&&h(i.body,e),i.qs&&h(i.qs,t)}return{body:e(),qs:t()}}function u(n,e,t,r){if(!n.info.errorBeacon||!t.body)return!1;var o="https://"+n.info.errorBeacon+"/"+e+"/1/"+n.info.licenseKey+p(n);t.qs&&(o+=g.obj(t.qs,n.maxBytes));var i,a,s;switch(e){case"jserrors":a=!1,i=T?w.beacon:w.img;break;default:if(r.needResponse)a=!0,i=w.xhr;else if(r.unload)a=T,i=T?w.beacon:w.img;else if(R)a=!0,i=w.xhr;else{if("events"!==e)return!1;i=w.img}}return a&&"events"===e?s=t.body.e:a?s=y(t.body):o+=g.obj(t.body,n.maxBytes),i(o,s)}function c(n){if(n&&n.info&&n.info.errorBeacon&&n.ieVersion){var e="https://"+n.info.errorBeacon+"/jserrors/ping/"+n.info.licenseKey+p(n);w.img(e)}}function f(n){return n.info.transactionName?g.param("to",n.info.transactionName):g.param("t",n.info.tNamePlain||"Unnamed Transaction")}function l(n,e){var t=q[n]||(q[n]=[]);t.push(e)}function p(n){return["?a="+n.info.applicationID,g.param("sa",n.info.sa?""+n.info.sa:""),g.param("v",S),f(n),g.param("ct",n.customTransaction),"&rst="+n.now(),g.param("ref",E(n.origin))].join("")}function d(n){var e=!1;return function(t,r){if(r&&r.length&&(n[t]=r,e=!0),e)return n}}var m=n(15),h=n(30),v=n(12),g=n(6),y=n(18),w=n(19),x=n(33),b=n(2),k=n(17),j=n("loader"),E=n(4),S="1044.a6554e7",A="NREUM.setToken",q={},T=!!navigator.sendBeacon;n(9);var R=j.xhrWrappable&&(j.ieVersion>9||0===j.ieVersion);e.exports={sendRUM:m(r),sendFinal:o,pingErrors:c,sendX:a,on:l,xhrUsable:R}},{}],9:[function(n,e,t){var r=n("loader"),o=document.createElement("div");o.innerHTML="<!--[if lte IE 6]><div></div><![endif]--><!--[if lte IE 7]><div></div><![endif]--><!--[if lte IE 8]><div></div><![endif]--><!--[if lte IE 9]><div></div><![endif]-->";var i=o.getElementsByTagName("div").length;4===i?r.ieVersion=6:3===i?r.ieVersion=7:2===i?r.ieVersion=8:1===i?r.ieVersion=9:r.ieVersion=0,e.exports=r.ieVersion},{}],10:[function(n,e,t){function r(n){c.sendFinal(p,!1),a.navCookie&&(document.cookie="NREUM=s="+Number(new Date)+"&r="+o(document.location.href)+"&p="+o(document.referrer)+"; path=/")}var o=n(14),i=n(1),a=n(16),s=n(17),u=n(15),c=n(8),f=n(13),l=n(7),p=n("loader"),d=n(29),m=n(5);n(3);var h="undefined"==typeof window.NREUM.autorun||window.NREUM.autorun;window.NREUM.setToken=l,6===n(9)?p.maxBytes=2e3:p.maxBytes=3e4,p.releaseIds={};var v=u(r);!d||navigator.sendBeacon?i("pagehide",v):i("beforeunload",v),i("unload",v),f("mark",s.mark,"api"),s.mark("done"),m("api"),h&&c.sendRUM(p)},{}],11:[function(n,e,t){e.exports=function(n,e){setTimeout(function t(){try{n()}finally{setTimeout(t,e)}},e)}},{}],12:[function(n,e,t){function r(n,e){var t=n["navigation"+a];return e.of=t,i(t,t,e,"n"),i(n[u+a],t,e,"u"),i(n[c+a],t,e,"r"),i(n[u+s],t,e,"ue"),i(n[c+s],t,e,"re"),i(n["fetch"+a],t,e,"f"),i(n[f+a],t,e,"dn"),i(n[f+s],t,e,"dne"),i(n["c"+l+a],t,e,"c"),i(n["secureC"+l+"ion"+a],t,e,"s"),i(n["c"+l+s],t,e,"ce"),i(n[p+a],t,e,"rq"),i(n[d+a],t,e,"rp"),i(n[d+s],t,e,"rpe"),i(n.domLoading,t,e," <truncated>
文件名 7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
文件大小 471 字节
文件类型 data
MD5 c5b4cf58049092d8716f8d7425d1714a
SHA1 2ed598368b1953645e9d199fc206853e6529b066
SHA256 d9caa98e17be8b89c8ed16f5e081a7c6ef8e71433a2ef7fbcd6e3d56539e864e
CRC32 CDC11579
Ssdeep 12:JD2+TUUG5J72+0+/prpFoWjbFAm1BZHVx1IuNrF3x:JD2+Qtf72+RpoWnF31DIuNxB
下载提交魔盾安全分析
文件名 index.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Feeds Cache\index.dat
文件大小 32768 字节
文件类型 Internet Explorer cache file version Ver 5.2
MD5 0aee387ca0a52dcdd8f8a29ea76edb42
SHA1 5df81547dcadb2a7b8bc689da8e1383ba1a84cb9
SHA256 c31bc37e102b70a472837d530ec80bdaea28b0fefda3e9aa8c8cda98c4200c4e
CRC32 B451CA0B
Ssdeep 12:qjtSaFpbZli3zIoYDPO7em4GZj03W/cKYDPOCG5A30WUsOXQDG9YRm4GZ5:qj4avEIoYTCebGZ7ZYTlEJ0oQQ4bGZ
魔盾安全分析结果 2.0分析时间:2016-11-06 20:10:20查看分析报告
下载提交魔盾安全分析
文件名 test@wufoo[1].txt
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\Cookies\test@wufoo[1].txt
文件大小 92 字节
文件类型 ASCII text
MD5 38170e47cbdaaf90654683a3187225d3
SHA1 eefa81c031cf98f5f4e27003bfa7a8a64bfde5b2
SHA256 8aa9f9bb0b8ae3a5fcc8f6d2990606620ed24595bb1c35e59a7c2a374e858e58
CRC32 E76CBFAA
Ssdeep 3:wFUse84XgP4NLd3MVXJUUQccWkvWVaRQ+Pv:wFUsesQZ8VXRJc9vWVaLX
下载提交魔盾安全分析显示文本
ep201
QI0BfQi9r6hq/3AOC4ysZHWyNIQ=
wufoo.com/
1024
1365993472
30634968
241560768
30634967
*
文件名 3388ECC3F7BC4A9271C10ED8621E5A65_A67501BCE988542BB46994577934ACBE
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3388ECC3F7BC4A9271C10ED8621E5A65_A67501BCE988542BB46994577934ACBE
文件大小 394 字节
文件类型 data
MD5 86daa4dee0c46b2e613cfc1c7e70ef7d
SHA1 8db90beb3238d61cc274eb34b76d980e729ecdc1
SHA256 7e936f8f6ba5f39bb83e222a6340f30447846ef8b9ab2bbe9c9ab15b12c4acfd
CRC32 12882275
Ssdeep 12:aMBnEFvSXiv8sFepU93kZPtIt2qlGTlFlj4m:aMBEFHvqUePtg1lGTvR
下载提交魔盾安全分析
文件名 test@wufoo[2].txt
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\Cookies\test@wufoo[2].txt
文件大小 93 字节
文件类型 ASCII text
MD5 9cd5c315fe737539b293efc70419fab5
SHA1 6d29259f4377ff83522687bfa813e3acfb6619be
SHA256 25cae3fafa6dcc19aa01231961ee6bdb56e1ab50a72e4139d393cd28637172ba
CRC32 2DC44991
Ssdeep 3:wFXxwnc9KKLd3MVXJUyb/SqydXgqWS:wFBPoKZ8VXFlS
下载提交魔盾安全分析显示文本
ep202
vvn58pUAwo/3OyBJC+29psG8RbI=
wufoo.com/
1024
1418756352
30708438
1858255920
30634980
*
文件名 0DA515F703BB9B49479E8697ADB0B955_7DC3E633EDFAEFC3AA3C99552548EC2F
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_7DC3E633EDFAEFC3AA3C99552548EC2F
文件大小 500 字节
文件类型 data
MD5 6e8ead9ad4f70bec1efb48e0de85d462
SHA1 6b0d73f1ea2972feb02edb44dfcee89edd8b383a
SHA256 4e8c30330076e324e797494584e622e26d1876c8171be85b35925b34bf71fc3a
CRC32 2F423423
Ssdeep 12:pWsuLDWzF68ksFyR7uE9SsAUOll1TgZcOIIes:pWsuLDgF6yYRd8JUKlGcpIH
下载提交魔盾安全分析
文件名 test@wufoo[2].txt
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\Cookies\test@wufoo[2].txt
文件大小 184 字节
文件类型 ASCII text
MD5 70efd73929a01ff57c77567f7687a0a5
SHA1 ebf7a2cc82e3f56da802625cb7561e8548f95c41
SHA256 7cf1d1e9f3e9d53841f610f455ca03b702d3765ad82bece48831db558344c243
CRC32 E5A6F3AE
Ssdeep 3:wFUse84XgP4NLd3MVXJUUQccWkvWVaRQ+P4zwnc9KKLd3MVXJUVQqSqZLPv:wFUsesQZ8VXRJc9vWVaL2PoKZ8VX2X
下载提交魔盾安全分析显示文本
ep201
QI0BfQi9r6hq/3AOC4ysZHWyNIQ=
wufoo.com/
1024
1365993472
30634968
241560768
30634967
*
ep202
vvn58pUAwo/3OyBJC+29psG8RbI=
wufoo.com/
1024
1378756352
30708438
241560768
30634967
*
文件名 RecoveryStore.{52174483-DFC7-11E7-8D49-52540055321F}.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{52174483-DFC7-11E7-8D49-52540055321F}.dat
文件大小 3584 字节
文件类型 Composite Document File V2 Document, Cannot read section info
MD5 060418ef2516297f24fe8c1e1fde2eb8
SHA1 43ee47596ccd10344b648c228bc9a069a0c5758c
SHA256 c11f94537f7ea94b64de2982379faa309e9b6866dee2adc26e9f85bd2c7550b9
CRC32 1530390C
Ssdeep 12:rl0YmGF21LWrEg5+IaCrI017+F3CDrEgmf+IaCy8qgQNlTqoEu3i66:rI9W5/dGv/TQNlWo
下载提交魔盾安全分析
文件名 7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
文件大小 434 字节
文件类型 data
MD5 260ac5996c8b8cc79db2da70e68b6c44
SHA1 6fd543ebac02ca4c69128d04488be8f56e928778
SHA256 9eadb8e2901960fe348d87148e7b74c1f55b78becb7c71f578c3eeb7cbbda6b7
CRC32 41D8D35F
Ssdeep 12:59bQEjQ5mxMiv8sFbq0yNYmc3Q2zQl5Qpu:4SAmxxvummOtQkpu
下载提交魔盾安全分析
文件名 index.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017121320171214\index.dat
文件大小 32768 字节
文件类型 Internet Explorer cache file version Ver 5.2
MD5 3bd522b04b1cb2ceb1cb021d961edd63
SHA1 14c459fe8236dcb453f1d0a8fc3da9e226837639
SHA256 8b02ea3a88005e9086ea7b829b13bfb434639ccc7decc46ed7ae4bac95d3de31
CRC32 3E0205E1
Ssdeep 6:qjyxXKPlf3KdDco/FVf4j2hnNZcKlKbX3KdDCFVf4jtMGNZWE:qjR93cDcoNx4j2hnHc1r3cDGx4jLHWE
下载提交魔盾安全分析
文件名 index.dat
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\IECompatCache\index.dat
文件大小 65536 字节
文件类型 Internet Explorer cache file version Ver 5.2
MD5 191d3d20f356bf520a7d1ed07b1bc08b
SHA1 bdba37ad96d8801e8d2c9e30e68afaf3822b0e4a
SHA256 d2eae7eeb07f08972ec78e59eaf73b6cfa48e92121748f61a394a28e33e36788
CRC32 BFF870C9
Ssdeep 384:wEEG/+oBMgfh3+EIOTcxi8kB+JuE1uPFykblh2F/0mjv3Bw2LI/u1sVdvM2zLOY4:wEEG/+xo
下载提交魔盾安全分析
文件名 3388ECC3F7BC4A9271C10ED8621E5A65_A67501BCE988542BB46994577934ACBE
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3388ECC3F7BC4A9271C10ED8621E5A65_A67501BCE988542BB46994577934ACBE
文件大小 1419 字节
文件类型 data
MD5 a619b64ad4bb099b5d06391e1332f2c2
SHA1 85e26064499c38a808d55b59b663b0d8477024e5
SHA256 0da75993a6728670047b376b50071c73f347d396bef500be3101642ff6fad672
CRC32 04B819D6
Ssdeep 24:jvhYZ28AgeKuT7IA4JDnmxZCaftr2nK7MT05ao6D2VBVRWfhGeUipKzpdcEA4rIn:jgPAgeKc7IA4JDGZHaCMgsPD2VB/WfhD
下载提交魔盾安全分析
文件名 favicon[3].ico
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDL4J1KW\favicon[3].ico
文件大小 1150 字节
文件类型 MS Windows icon resource - 1 icon, 16x16
MD5 3bace8e0c11a73a057c1efac16651858
SHA1 0b75d869fca7d8dfa0503186c7037ab5423a2979
SHA256 2690a1ed8eec3edfa1d64d540053f3e7de28fad1c1f79047343e8f428f4fdafb
CRC32 92B1DAC6
Ssdeep 12:phghkhdU7mW/s3MvWvLCYvQBS4dWJSkFP5cv18hD5d3TAaqrC4ydydUBRl2RHCEv:phykhN4s8CLjQs4dATLc2XIHUBn+CfG
下载提交魔盾安全分析
文件名 {52174484-DFC7-11E7-8D49-52540055321F}.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{52174484-DFC7-11E7-8D49-52540055321F}.dat
文件大小 6144 字节
文件类型 Composite Document File V2 Document, Cannot read section info
MD5 3b6673e985c20fb43fc9ecb90e52c8db
SHA1 9d85a9da715e0b189d53b010177b40ef7af0711f
SHA256 19bdee8ff63e996b913c97521063eae6ee15abf822fdd97879538ee923cf5617
CRC32 BD48267E
Ssdeep 48:rmMGWvYkhuY/nYWY3YAto/Yf3yuqJq4cDPiDmkHBPgwo/YEuYt:NvYBt/Cp71P4
下载提交魔盾安全分析
文件名 1e390569c3[1]
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\1e390569c3[1]
文件大小 57 字节
文件类型 ASCII text, with no line terminators
MD5 79f2d634ce67570918939df10a075576
SHA1 ba47b7dacb11250f9b1b3974b34954b188e3ecad
SHA256 d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1
CRC32 6109D338
Ssdeep 3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
下载提交魔盾安全分析显示文本
NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})
HTML 总结报告
(需15-60分钟同步)
下载

Processing ( 34.985 seconds )

  • 21.428 NetworkAnalysis
  • 7.504 Suricata
  • 1.973 Static
  • 1.594 BehaviorAnalysis
  • 1.228 VirusTotal
  • 0.813 Dropped
  • 0.32 Debug
  • 0.123 AnalysisInfo
  • 0.002 Memory

Signatures ( 3.413 seconds )

  • 1.987 md_url_bl
  • 0.559 md_bad_drop
  • 0.155 antiav_detectreg
  • 0.076 stealth_timeout
  • 0.06 api_spamming
  • 0.057 infostealer_ftp
  • 0.052 md_domain_bl
  • 0.04 antivm_generic_scsi
  • 0.033 infostealer_im
  • 0.032 antianalysis_detectreg
  • 0.02 antivm_generic_services
  • 0.019 stealth_file
  • 0.018 infostealer_mail
  • 0.014 antivm_generic_disk
  • 0.014 antiav_detectfile
  • 0.013 mimics_filetime
  • 0.01 bootkit
  • 0.01 virus
  • 0.01 infostealer_bitcoin
  • 0.009 betabot_behavior
  • 0.009 vawtrak_behavior
  • 0.009 geodo_banking_trojan
  • 0.008 kibex_behavior
  • 0.008 antivm_xen_keys
  • 0.008 darkcomet_regkeys
  • 0.007 antiemu_wine_func
  • 0.007 antivm_parallels_keys
  • 0.006 dridex_behavior
  • 0.006 persistence_autorun
  • 0.006 kovter_behavior
  • 0.006 antivm_vbox_files
  • 0.006 ransomware_extensions
  • 0.006 ransomware_files
  • 0.006 recon_fingerprint
  • 0.005 hancitor_behavior
  • 0.005 shifu_behavior
  • 0.005 infostealer_browser_password
  • 0.005 antivm_generic_diskreg
  • 0.004 andromeda_behavior
  • 0.004 antivm_vbox_libs
  • 0.004 antidbg_windows
  • 0.003 injection_createremotethread
  • 0.003 ransomware_message
  • 0.003 stealth_network
  • 0.003 antisandbox_productid
  • 0.003 disables_browser_warn
  • 0.003 network_torgateway
  • 0.003 packer_armadillo_regkey
  • 0.002 tinba_behavior
  • 0.002 hawkeye_behavior
  • 0.002 rat_nanocore
  • 0.002 antiav_avast_libs
  • 0.002 stack_pivot
  • 0.002 Locky_behavior
  • 0.002 antisandbox_sunbelt_libs
  • 0.002 exec_crash
  • 0.002 antivm_vmware_events
  • 0.002 injection_runpe
  • 0.002 cryptowall_behavior
  • 0.002 antidbg_devices
  • 0.002 antivm_xen_keys
  • 0.002 antivm_hyperv_keys
  • 0.002 antivm_vbox_acpi
  • 0.002 antivm_vbox_keys
  • 0.002 antivm_vmware_keys
  • 0.002 antivm_vpc_keys
  • 0.002 browser_security
  • 0.002 bypass_firewall
  • 0.002 rat_pcclient
  • 0.002 recon_programs
  • 0.001 network_tor
  • 0.001 rat_luminosity
  • 0.001 network_anomaly
  • 0.001 antivm_vmware_libs
  • 0.001 virtualcheck_js
  • 0.001 injection_explorer
  • 0.001 sets_autoconfig_url
  • 0.001 kazybot_behavior
  • 0.001 heapspray_js
  • 0.001 antisandbox_sboxie_libs
  • 0.001 dead_connect
  • 0.001 antiav_bitdefender_libs
  • 0.001 dyre_behavior
  • 0.001 ispy_behavior
  • 0.001 cerber_behavior
  • 0.001 antianalysis_detectfile
  • 0.001 antivm_generic_bios
  • 0.001 antivm_generic_cpu
  • 0.001 antivm_generic_system
  • 0.001 antivm_vmware_files
  • 0.001 bot_drive
  • 0.001 bot_drive2
  • 0.001 browser_addon
  • 0.001 codelux_behavior
  • 0.001 ie_martian_children
  • 0.001 maldun_blacklist
  • 0.001 modify_uac_prompt
  • 0.001 sniffer_winpcap
  • 0.001 targeted_flame
  • 0.001 whois_create

Reporting ( 0.558 seconds )

  • 0.558 ReportHTMLSummary
Task ID 122384
Mongo ID 5a30bcb0a093ef4c8fb51491
Cuckoo release 1.4-Maldun