分析任务

分析类型 虚拟机标签 开始时间 结束时间 持续时间
URL win7-sp1-x64-hpdapp03-1 2018-03-19 12:15:52 2018-03-19 12:18:18 146 秒

魔盾分数

0.05

正常的

URL详细信息

URL
URL专业沙箱检测 -> http://flare.jisusaiche.biz

登录查看威胁特征

运行截图


访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
104.28.20.78 美国
122.224.45.50 中国

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
flare.jisusaiche.biz A 104.28.20.78
A 104.28.21.78
www.microsoft.com CNAME e13678.ca.s.tl88.net
A 122.224.45.50
CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
CNAME www.microsoft.com-c-3.edgekey.net

摘要

登录查看详细行为信息

WHOIS 信息

Name: None
Country: None
State: None
City: None
ZIP Code: None
Address: None

Orginization: None
Domain Name(s):
    jisusaiche.biz
    JISUSAICHE.BIZ
Creation Date:
    None
Updated Date:
    None
Expiration Date:
    None
Email(s):
    None

Registrar(s):
    None
Name Server(s):
    dana.ns.cloudflare.com
    beau.ns.cloudflare.com
    BEAU.NS.CLOUDFLARE.COM
    DANA.NS.CLOUDFLARE.COM
Referral URL(s):
    None
防病毒引擎/厂商 网站安全分析
CLEAN MX Clean Site
DNS8 Clean Site
VX Vault Clean Site
ZDB Zeus Clean Site
Tencent Clean Site
Netcraft Unrated Site
desenmascara_me Clean Site
Dr_Web Clean Site
PhishLabs Unrated Site
Zerofox Clean Site
K7AntiVirus Clean Site
Virusdie External Site Scan Clean Site
SCUMWARE_org Clean Site
Quttera Clean Site
AegisLab WebGuard Clean Site
MalwareDomainList Clean Site
ZeusTracker Clean Site
zvelo Clean Site
Google Safebrowsing Clean Site
Kaspersky Clean Site
BitDefender Clean Site
Certly Clean Site
G-Data Clean Site
C-SIRT Clean Site
OpenPhish Clean Site
Malware Domain Blocklist Clean Site
MalwarePatrol Clean Site
Webutation Clean Site
Trustwave Clean Site
Web Security Guard Clean Site
CyRadar Clean Site
ADMINUSLabs Clean Site
Malwarebytes hpHosts Clean Site
Opera Clean Site
AlienVault Clean Site
Emsisoft Clean Site
Malc0de Database Clean Site
Spam404 Clean Site
Phishtank Clean Site
Malwared Clean Site
Avira Clean Site
NotMining Unrated Site
CyberCrime Clean Site
Antiy-AVL Clean Site
Forcepoint ThreatSeeker Clean Site
FraudSense Clean Site
malwares_com URL checker Clean Site
Comodo Site Inspector Clean Site
Malekal Clean Site
ESET Clean Site
Sophos Unrated Site
Yandex Safebrowsing Clean Site
SecureBrain Clean Site
Nucleon Clean Site
Sucuri SiteCheck Clean Site
Blueliv Clean Site
ZCloudsec Clean Site
AutoShun Unrated Site
ThreatHive Clean Site
FraudScore Clean Site
Rising Clean Site
URLQuery Unrated Site
StopBadware Unrated Site
Fortinet Clean Site
ZeroCERT Clean Site
Baidu-International Clean Site
securolytics Clean Site

进程树


iexplore.exe, PID: 2068, 上一级进程 PID: 284
iexplore.exe, PID: 2324, 上一级进程 PID: 2068

访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
104.28.20.78 美国
122.224.45.50 中国

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49160 104.28.20.78 flare.jisusaiche.biz 80
192.168.122.201 49161 104.28.20.78 flare.jisusaiche.biz 80
192.168.122.201 49162 122.224.45.50 www.microsoft.com 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 54844 192.168.122.1 53
192.168.122.201 59793 192.168.122.1 53
192.168.122.201 60316 192.168.122.1 53

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
flare.jisusaiche.biz A 104.28.20.78
A 104.28.21.78
www.microsoft.com CNAME e13678.ca.s.tl88.net
A 122.224.45.50
CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
CNAME www.microsoft.com-c-3.edgekey.net

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49160 104.28.20.78 flare.jisusaiche.biz 80
192.168.122.201 49161 104.28.20.78 flare.jisusaiche.biz 80
192.168.122.201 49162 122.224.45.50 www.microsoft.com 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 54844 192.168.122.1 53
192.168.122.201 59793 192.168.122.1 53
192.168.122.201 60316 192.168.122.1 53

HTTP 请求

URI HTTP数据
URL专业沙箱检测 -> http://flare.jisusaiche.biz/
GET / HTTP/1.1
Accept: */*
Referer: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=17&ved=0CCEQfjZ3dYZmxHTHdVZW9USVV1dVdEb2lD&url=http%3A%2F%2Fflare.jisusaiche.biz&ei=a2VRd25WbEJRc3Fr&usg=AFQjSkVMZGtCcUZaYklP
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: flare.jisusaiche.biz
Connection: Keep-Alive

URL专业沙箱检测 -> http://flare.jisusaiche.biz/favicon.ico
GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: flare.jisusaiche.biz
Connection: Keep-Alive
Cookie: __cfduid=d9fa75b3051474fdbd03b9d971d567ed61521432970

URL专业沙箱检测 -> http://www.microsoft.com/
GET / HTTP/1.1
Host: www.microsoft.com
Connection: Close

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

Timestamp Source IP Source Port Destination IP Destination Port Protocol SID Signature Category
2018-03-19 12:16:20.955817+0800 122.224.45.50 80 192.168.122.201 49162 TCP 2012692 ET POLICY Microsoft user-agent automated process response to automated request A Network Trojan was detected

TLS

No TLS

Suricata HTTP

No Suricata HTTP

未发现网络提取文件
文件名 {3543BFE4-2B2C-11E8-8D49-52540055321F}.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3543BFE4-2B2C-11E8-8D49-52540055321F}.dat
文件大小 4608 字节
文件类型 Composite Document File V2 Document, Cannot read section info
MD5 7d6599669dc70ffadf2096666e67f3c6
SHA1 52ac162a86c9bc0ca68a4b34895063f74f95a565
SHA256 fcf77ac173624e4404397ac10f20807c9255a12843dd20f4fd8cac362a5a65ec
CRC32 BFFA54E8
Ssdeep 12:rlfFvtrEgmfR16F3rEgmf91qjNlYfOo3+/Nlk89oxMZklp:rRGWGwNljowNlk8oKZk
下载提交魔盾安全分析
文件名 index.dat
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\IECompatCache\index.dat
文件大小 65536 字节
文件类型 Internet Explorer cache file version Ver 5.2
MD5 191d3d20f356bf520a7d1ed07b1bc08b
SHA1 bdba37ad96d8801e8d2c9e30e68afaf3822b0e4a
SHA256 d2eae7eeb07f08972ec78e59eaf73b6cfa48e92121748f61a394a28e33e36788
CRC32 BFF870C9
Ssdeep 384:wEEG/+oBMgfh3+EIOTcxi8kB+JuE1uPFykblh2F/0mjv3Bw2LI/u1sVdvM2zLOY4:wEEG/+xo
下载提交魔盾安全分析
文件名 index.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Feeds Cache\index.dat
文件大小 32768 字节
文件类型 Internet Explorer cache file version Ver 5.2
MD5 0aee387ca0a52dcdd8f8a29ea76edb42
SHA1 5df81547dcadb2a7b8bc689da8e1383ba1a84cb9
SHA256 c31bc37e102b70a472837d530ec80bdaea28b0fefda3e9aa8c8cda98c4200c4e
CRC32 B451CA0B
Ssdeep 12:qjtSaFpbZli3zIoYDPO7em4GZj03W/cKYDPOCG5A30WUsOXQDG9YRm4GZ5:qj4avEIoYTCebGZ7ZYTlEJ0oQQ4bGZ
魔盾安全分析结果 2.0分析时间:2016-11-06 20:10:20查看分析报告
下载提交魔盾安全分析
文件名 index.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018031920180320\index.dat
文件大小 32768 字节
文件类型 Internet Explorer cache file version Ver 5.2
MD5 ff22030dab43c478fc51ab3c4b493aaa
SHA1 1c26799990fc78810f04fca5d851b097b0ab6560
SHA256 366a6f13c105adfdb8faf980dd7310b39d98798e1adedee5cc109031b96f9592
CRC32 074F0BCE
Ssdeep 6:qjyxXKCSBQ3wB4S3Fltr4WlN+XssfU3wBMFltr4Wlz+Xssf:qjRpQ3wBFsiN+rs3wBEsiz+r
下载提交魔盾安全分析
文件名 test@jisusaiche[1].txt
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\Cookies\test@jisusaiche[1].txt
文件大小 116 字节
文件类型 ASCII text
MD5 81f2f9a6367b55fc49e24308eeabb43b
SHA1 d10f27f6d16551e00cbc3fe3788c5fb962a7ed4b
SHA256 e15c48ed3e714d99d81440997774cc039cc983b8efda08e55c185c0b9e09b223
CRC32 E7456F0D
Ssdeep 3:GmM/yEjI0bhlcI1UijsfGzWl9VSXSQFzfYWN:XM/Xv9GIJjsftwCQG4
下载提交魔盾安全分析显示文本
__cfduid
d9fa75b3051474fdbd03b9d971d567ed61521432970
jisusaiche.biz/
9216
2068373760
30727690
4088016992
30654348
*
文件名 RecoveryStore.{3543BFE3-2B2C-11E8-8D49-52540055321F}.dat
相关文件
C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3543BFE3-2B2C-11E8-8D49-52540055321F}.dat
文件大小 3584 字节
文件类型 Composite Document File V2 Document, Cannot read section info
MD5 f574e5c72dfe8ece988b94a3345b1166
SHA1 286f93a7049cf52d0488da66949009c92fafc585
SHA256 df8cbaa65c2855e1cee231cdff77147a32db54f34f062160027942c2a141ea92
CRC32 EF4C48B8
Ssdeep 12:rl0YmGF2lgWrEg5+IaCrI017+F+DrEgmf+IaCy8qgQNlTqosZIQZ:rIlH5/tGv/TQNlWoU
下载提交魔盾安全分析
文件名 favicon[1].ico
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EHDRIWWS\favicon[1].ico
文件大小 1150 字节
文件类型 MS Windows icon resource - 1 icon, 16x16
MD5 eea497b7602f3f6a8764df09b0f28222
SHA1 7bae94a7e1a9faad916afff4335b95b1c7db56c5
SHA256 72f15faa8814bf2dba9bf5823120f602145ba5ecc59da412ea59d528861a2055
CRC32 98BA455E
Ssdeep 24:1QlO1Sp4Utxhg4gCde6jLraQoHIaV3Sc+FVq:W41G4Utzg4g8XqQra4jq
下载提交魔盾安全分析
HTML 总结报告
(需15-60分钟同步)
下载

Processing ( 20.49 seconds )

  • 8.798 NetworkAnalysis
  • 7.505 Suricata
  • 1.502 Static
  • 1.21 VirusTotal
  • 1.065 BehaviorAnalysis
  • 0.313 AnalysisInfo
  • 0.055 Dropped
  • 0.039 Debug
  • 0.003 Memory

Signatures ( 2.255 seconds )

  • 1.277 md_url_bl
  • 0.356 md_bad_drop
  • 0.141 antiav_detectreg
  • 0.051 infostealer_ftp
  • 0.048 stealth_timeout
  • 0.035 api_spamming
  • 0.029 antivm_generic_scsi
  • 0.029 antianalysis_detectreg
  • 0.029 infostealer_im
  • 0.018 stealth_file
  • 0.016 infostealer_mail
  • 0.014 antivm_generic_services
  • 0.009 antivm_generic_disk
  • 0.008 mimics_filetime
  • 0.008 vawtrak_behavior
  • 0.008 antiav_detectfile
  • 0.008 geodo_banking_trojan
  • 0.007 betabot_behavior
  • 0.007 kibex_behavior
  • 0.007 antivm_parallels_keys
  • 0.007 antivm_xen_keys
  • 0.007 darkcomet_regkeys
  • 0.007 md_domain_bl
  • 0.006 persistence_autorun
  • 0.006 virus
  • 0.006 infostealer_bitcoin
  • 0.005 bootkit
  • 0.005 antivm_generic_diskreg
  • 0.004 andromeda_behavior
  • 0.004 antiemu_wine_func
  • 0.004 antidbg_windows
  • 0.004 kovter_behavior
  • 0.004 ransomware_extensions
  • 0.004 ransomware_files
  • 0.004 recon_fingerprint
  • 0.003 hancitor_behavior
  • 0.003 infostealer_browser_password
  • 0.003 antivm_vbox_files
  • 0.003 disables_browser_warn
  • 0.002 tinba_behavior
  • 0.002 rat_nanocore
  • 0.002 dridex_behavior
  • 0.002 injection_createremotethread
  • 0.002 Locky_behavior
  • 0.002 antivm_vbox_libs
  • 0.002 antivm_vmware_events
  • 0.002 cryptowall_behavior
  • 0.002 antisandbox_productid
  • 0.002 antivm_xen_keys
  • 0.002 antivm_hyperv_keys
  • 0.002 antivm_vbox_acpi
  • 0.002 antivm_vbox_keys
  • 0.002 antivm_vmware_keys
  • 0.002 antivm_vpc_keys
  • 0.002 browser_security
  • 0.002 bypass_firewall
  • 0.002 network_torgateway
  • 0.002 packer_armadillo_regkey
  • 0.001 network_tor
  • 0.001 antiav_avast_libs
  • 0.001 rat_luminosity
  • 0.001 stack_pivot
  • 0.001 network_anomaly
  • 0.001 antisandbox_sunbelt_libs
  • 0.001 antiav_bitdefender_libs
  • 0.001 dyre_behavior
  • 0.001 shifu_behavior
  • 0.001 exec_crash
  • 0.001 cerber_behavior
  • 0.001 injection_runpe
  • 0.001 antidbg_devices
  • 0.001 antivm_generic_bios
  • 0.001 antivm_generic_cpu
  • 0.001 antivm_generic_system
  • 0.001 bot_drive
  • 0.001 bot_drive2
  • 0.001 browser_addon
  • 0.001 ie_martian_children
  • 0.001 modify_uac_prompt
  • 0.001 rat_pcclient
  • 0.001 recon_programs

Reporting ( 0.321 seconds )

  • 0.321 ReportHTMLSummary
Task ID 139117
Mongo ID 5aaf3a2ba093ef3abc0411a5
Cuckoo release 1.4-Maldun