分析任务

分析类型 虚拟机标签 开始时间 结束时间 持续时间
URL win7-sp1-x64-shaapp01-1 2018-09-15 19:38:50 2018-09-15 19:41:23 153 秒

魔盾分数

1.6

正常的

URL详细信息

URL
URL专业沙箱检测 -> http://www.bandaoyy.com/dianying/

登录查看威胁特征

运行截图


访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
101.226.181.252 中国
107.150.10.226 未知 美国
117.18.237.29 亚洲太平洋地区
183.131.110.86 中国
220.181.7.190 未知 中国
43.241.48.155 中国
47.90.111.104 加拿大
58.222.18.2 未知 中国

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
www.bandaoyy.com A 107.150.10.226
A 107.150.10.233
www.bestore.cc A 43.241.48.155
m.jinchaoyu.com A 47.90.111.104
hm.baidu.com CNAME hm.e.shifen.com
A 220.181.7.190
img1.doubanio.com A 183.134.101.248
A 183.134.101.250
A 58.222.18.2
A 183.131.24.55
CNAME img1-doubanio-com.b0.aicdn.com
CNAME vm.ctn.aicdn.com
A 58.222.18.27
img3.doubanio.com CNAME img3.doubanio.com.w.alikunlun.com
A 101.226.181.248
A 101.226.181.249
A 114.80.174.21
A 101.226.181.251
A 101.226.181.250
A 101.226.181.253
A 101.226.181.252
A 114.80.174.117
A 101.226.181.254
p2.qhimg.com A 183.131.110.85
A 183.131.110.86
A 183.131.110.74
A 183.131.110.80
CNAME upichq.v.qingcdn.com
A 183.131.110.81
CNAME p2.qhimg.com.qingcdn.com
A 183.131.110.82
A 183.131.110.83
A 183.131.110.71
A 183.131.110.73
A 183.131.110.84
ocsp.globalsign.com CNAME globalsign.com.cdn.dnsv1.com
A 122.228.251.33
CNAME globalsign.com.s2.cdntip.com
A 122.228.251.32
CNAME global.prd.cdn.globalsign.com
A 122.246.10.30
A 180.153.100.147
cdp1.public-trust.com CNAME crl3.digicert.com
CNAME cs9.wac.phicdn.net
A 117.18.237.29
ocsp.digicert.com

摘要

登录查看详细行为信息

WHOIS 信息

Name: None
Country: CN
State: Guangdong
City: None
ZIP Code: None
Address: None

Orginization: None
Domain Name(s):
    BANDAOYY.COM
    bandaoyy.com
Creation Date:
    2017-05-04 14:25:05
Updated Date:
    2018-07-14 06:24:37
    2018-06-30 06:22:47
Expiration Date:
    2019-05-04 14:25:05
Email(s):
    abuse@godaddy.com

Registrar(s):
    GoDaddy.com, LLC
Name Server(s):
    NS1.360WZB.COM
    NS2.360WZB.COM
Referral URL(s):
    None
没有防病毒引擎扫描信息!

进程树


iexplore.exe, PID: 2684, 上一级进程 PID: 2412

访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
101.226.181.252 中国
107.150.10.226 未知 美国
117.18.237.29 亚洲太平洋地区
183.131.110.86 中国
220.181.7.190 未知 中国
43.241.48.155 中国
47.90.111.104 加拿大
58.222.18.2 未知 中国

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49175 101.226.181.252 img3.doubanio.com 80
192.168.122.201 49159 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49160 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49161 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49162 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49163 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49164 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49166 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49167 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49170 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49171 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49181 117.18.237.29 cdp1.public-trust.com 80
192.168.122.201 49183 117.18.237.29 cdp1.public-trust.com 80
192.168.122.201 49178 122.228.251.32 ocsp.globalsign.com 80
192.168.122.201 49179 122.228.251.33 ocsp.globalsign.com 80
192.168.122.201 49176 183.131.110.86 p2.qhimg.com 80
192.168.122.201 49172 220.181.7.190 hm.baidu.com 443
192.168.122.201 49182 23.46.211.195 80
192.168.122.201 49168 43.241.48.155 www.bestore.cc 80
192.168.122.201 49169 47.90.111.104 m.jinchaoyu.com 80
192.168.122.201 49173 58.222.18.2 img1.doubanio.com 80
192.168.122.201 49174 58.222.18.2 img1.doubanio.com 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 50005 192.168.122.1 53
192.168.122.201 50147 192.168.122.1 53
192.168.122.201 51769 192.168.122.1 53
192.168.122.201 53569 192.168.122.1 53
192.168.122.201 53720 192.168.122.1 53
192.168.122.201 54191 192.168.122.1 53
192.168.122.201 54569 192.168.122.1 53
192.168.122.201 58056 192.168.122.1 53
192.168.122.201 60231 192.168.122.1 53
192.168.122.201 60684 192.168.122.1 53
192.168.122.201 61800 192.168.122.1 53
192.168.122.201 64292 192.168.122.1 53

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
www.bandaoyy.com A 107.150.10.226
A 107.150.10.233
www.bestore.cc A 43.241.48.155
m.jinchaoyu.com A 47.90.111.104
hm.baidu.com CNAME hm.e.shifen.com
A 220.181.7.190
img1.doubanio.com A 183.134.101.248
A 183.134.101.250
A 58.222.18.2
A 183.131.24.55
CNAME img1-doubanio-com.b0.aicdn.com
CNAME vm.ctn.aicdn.com
A 58.222.18.27
img3.doubanio.com CNAME img3.doubanio.com.w.alikunlun.com
A 101.226.181.248
A 101.226.181.249
A 114.80.174.21
A 101.226.181.251
A 101.226.181.250
A 101.226.181.253
A 101.226.181.252
A 114.80.174.117
A 101.226.181.254
p2.qhimg.com A 183.131.110.85
A 183.131.110.86
A 183.131.110.74
A 183.131.110.80
CNAME upichq.v.qingcdn.com
A 183.131.110.81
CNAME p2.qhimg.com.qingcdn.com
A 183.131.110.82
A 183.131.110.83
A 183.131.110.71
A 183.131.110.73
A 183.131.110.84
ocsp.globalsign.com CNAME globalsign.com.cdn.dnsv1.com
A 122.228.251.33
CNAME globalsign.com.s2.cdntip.com
A 122.228.251.32
CNAME global.prd.cdn.globalsign.com
A 122.246.10.30
A 180.153.100.147
cdp1.public-trust.com CNAME crl3.digicert.com
CNAME cs9.wac.phicdn.net
A 117.18.237.29
ocsp.digicert.com

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49175 101.226.181.252 img3.doubanio.com 80
192.168.122.201 49159 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49160 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49161 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49162 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49163 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49164 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49166 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49167 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49170 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49171 107.150.10.226 www.bandaoyy.com 80
192.168.122.201 49181 117.18.237.29 cdp1.public-trust.com 80
192.168.122.201 49183 117.18.237.29 cdp1.public-trust.com 80
192.168.122.201 49178 122.228.251.32 ocsp.globalsign.com 80
192.168.122.201 49179 122.228.251.33 ocsp.globalsign.com 80
192.168.122.201 49176 183.131.110.86 p2.qhimg.com 80
192.168.122.201 49172 220.181.7.190 hm.baidu.com 443
192.168.122.201 49182 23.46.211.195 80
192.168.122.201 49168 43.241.48.155 www.bestore.cc 80
192.168.122.201 49169 47.90.111.104 m.jinchaoyu.com 80
192.168.122.201 49173 58.222.18.2 img1.doubanio.com 80
192.168.122.201 49174 58.222.18.2 img1.doubanio.com 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 50005 192.168.122.1 53
192.168.122.201 50147 192.168.122.1 53
192.168.122.201 51769 192.168.122.1 53
192.168.122.201 53569 192.168.122.1 53
192.168.122.201 53720 192.168.122.1 53
192.168.122.201 54191 192.168.122.1 53
192.168.122.201 54569 192.168.122.1 53
192.168.122.201 58056 192.168.122.1 53
192.168.122.201 60231 192.168.122.1 53
192.168.122.201 60684 192.168.122.1 53
192.168.122.201 61800 192.168.122.1 53
192.168.122.201 64292 192.168.122.1 53

HTTP 请求

URI HTTP数据
URL专业沙箱检测 -> http://www.bandaoyy.com/dianying/
GET /dianying/ HTTP/1.1
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/css/style.css
GET /template/97zy/css/style.css HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/js/common.js
GET /template/97zy/js/common.js HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/js/html5shiv.min.js
GET /template/97zy/js/html5shiv.min.js HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/js/function.js
GET /template/97zy/js/function.js HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/paody/ads/sydh.js
GET /template/paody/ads/sydh.js HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/js/jquery.lazyload.js
GET /template/97zy/js/jquery.lazyload.js HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/js/respond.min.js
GET /template/97zy/js/respond.min.js HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/js/jquery-1.4.4.min.js
GET /template/97zy/js/jquery-1.4.4.min.js HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bestore.cc/bandaoyy.js
GET /bandaoyy.js HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bestore.cc
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/Images/logo.png
GET /template/97zy/Images/logo.png HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://m.jinchaoyu.com/1/o3.html?u=1107|4|1
GET /1/o3.html?u=1107|4|1 HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: m.jinchaoyu.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://m.jinchaoyu.com/o6.php?u=1107|4|1&rand=19781&host=m.jinchaoyu.com&agent=Mozilla%2F4.0+%28compatible%3B+MSIE+8.0%3B+Windows+NT+6.1%3B+WOW64%3B+Trident%2F4.0%3B+SLCC2%3B+.NET+CLR+2.0.50727%3B+.NET+CLR+3.5.30729%3B+.NET+CLR+3.0.30729%3B+Media+Center+PC+6.0%3B+.NET4.0C%3B+.NET4.0E%29&referer=http%3A%2F%2Fwww.bandaoyy.com%2Fdianying%2F
GET /o6.php?u=1107|4|1&rand=19781&host=m.jinchaoyu.com&agent=Mozilla%2F4.0+%28compatible%3B+MSIE+8.0%3B+Windows+NT+6.1%3B+WOW64%3B+Trident%2F4.0%3B+SLCC2%3B+.NET+CLR+2.0.50727%3B+.NET+CLR+3.5.30729%3B+.NET+CLR+3.0.30729%3B+Media+Center+PC+6.0%3B+.NET4.0C%3B+.NET4.0E%29&referer=http%3A%2F%2Fwww.bandaoyy.com%2Fdianying%2F HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: m.jinchaoyu.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/Images/load.gif
GET /template/97zy/Images/load.gif HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/Images/p.png
GET /template/97zy/Images/p.png HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/Images/duomi-bg.png
GET /template/97zy/Images/duomi-bg.png HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://img3.doubanio.com/view/photo/s_ratio_poster/public/p2529136453.jpg
GET /view/photo/s_ratio_poster/public/p2529136453.jpg HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img3.doubanio.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://img1.doubanio.com/view/photo/s_ratio_poster/public/p2516612917.jpg
GET /view/photo/s_ratio_poster/public/p2516612917.jpg HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img1.doubanio.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://img1.doubanio.com/view/photo/s_ratio_poster/public/p2529410377.jpg
GET /view/photo/s_ratio_poster/public/p2529410377.jpg HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img1.doubanio.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://p2.qhimg.com/d/dy_ba3121b3eeebe2abf3b675ae20872ce7.jpg
GET /d/dy_ba3121b3eeebe2abf3b675ae20872ce7.jpg HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: p2.qhimg.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH
GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 01 Sep 2018 00:29:03 GMT
If-None-Match: "1480bfa43edc451651e279ba0f6dc69348c58eec"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com

URL专业沙箱检测 -> http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDHFB6lHS315kGvj29g%3D%3D
GET /gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDHFB6lHS315kGvj29g%3D%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp2.globalsign.com

URL专业沙箱检测 -> http://www.bandaoyy.com/template/97zy/Images/search.png
GET /template/97zy/Images/search.png HTTP/1.1
Accept: */*
Referer: http://www.bandaoyy.com/dianying/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: www.bandaoyy.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://www.bandaoyy.com/favicon.ico
GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: www.bandaoyy.com
Connection: Keep-Alive
Cookie: Hm_lvt_264512ff0768529472d1674335d295cb=1537011561; Hm_lpvt_264512ff0768529472d1674335d295cb=1537011561

URL专业沙箱检测 -> http://cdp1.public-trust.com/CRL/Omniroot2025.crl
GET /CRL/Omniroot2025.crl HTTP/1.1
Cache-Control: max-age = 172800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 21 Aug 2018 20:59:15 GMT
If-None-Match: "2057461361"
User-Agent: Microsoft-CryptoAPI/6.1
Host: cdp1.public-trust.com

URL专业沙箱检测 -> http://crl.microsoft.com/pki/crl/products/tspca.crl
GET /pki/crl/products/tspca.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 24 May 2014 05:04:54 GMT
If-None-Match: "8ab194b3d77cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com

URL专业沙箱检测 -> http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1
Cache-Control: max-age = 172072
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 31 Aug 2018 21:45:22 GMT
If-None-Match: "5b89b6f2-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

无警报

TLS

Timestamp Source IP Source Port Destination IP Destination Port Version Issuer Subject Fingerprint
2018-09-15 19:39:44.226519+0800 192.168.122.201 49172 220.181.7.190 443 TLS 1.2 C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=CN, ST=beijing, L=beijing, OU=service operation department, O=Beijing Baidu Netcom Science Technology Co., Ltd, CN=baidu.com 7e:2f:c8:ca:7c:3e:c3:a7:44:6a:cb:b2:08:56:f3:6d:dd:9b:85:a5

Suricata HTTP

No Suricata HTTP

未发现网络提取文件
抱歉! 没有任何文件投放。
HTML 总结报告
(需15-60分钟同步)
下载

Processing ( 29.065 seconds )

  • 14.588 NetworkAnalysis
  • 7.214 Suricata
  • 5.019 Static
  • 1.858 VirusTotal
  • 0.193 Debug
  • 0.189 AnalysisInfo
  • 0.002 BehaviorAnalysis
  • 0.002 Memory

Signatures ( 1.981 seconds )

  • 1.855 md_url_bl
  • 0.036 md_domain_bl
  • 0.03 md_bad_drop
  • 0.01 antiav_detectreg
  • 0.005 infostealer_ftp
  • 0.004 persistence_autorun
  • 0.004 antiav_detectfile
  • 0.004 geodo_banking_trojan
  • 0.004 ransomware_files
  • 0.003 infostealer_bitcoin
  • 0.003 infostealer_im
  • 0.003 network_torgateway
  • 0.003 ransomware_extensions
  • 0.002 tinba_behavior
  • 0.002 antianalysis_detectreg
  • 0.002 antivm_vbox_files
  • 0.002 disables_browser_warn
  • 0.002 infostealer_mail
  • 0.001 rat_nanocore
  • 0.001 cerber_behavior
  • 0.001 bot_drive
  • 0.001 bot_drive2
  • 0.001 browser_addon
  • 0.001 browser_security
  • 0.001 ie_martian_children

Reporting ( 0.368 seconds )

  • 0.368 ReportHTMLSummary
Task ID 187386
Mongo ID 5b9cf006bb7d5755b1cd88f9
Cuckoo release 1.4-Maldun