分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| URL | win7-sp1-x64-hpdapp01-2 | 2019-07-17 01:14:22 | 2019-07-17 01:16:52 | 150 秒 |
魔盾分数
1.65
正常的
URL详细信息
| URL |
|---|
| URL专业沙箱检测 -> http://www.vodxc.com/DLJ/ |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 104.20.98.101 | 美国 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| www.vodxc.com |
A 104.20.99.101 A 104.20.98.101 |
摘要
登录查看详细行为信息WHOIS 信息
Name: Registration Private
Country: US
State: Arizona
City: Scottsdale
ZIP Code: 85260
Address: DomainsByProxy.com
Orginization: Domains By Proxy, LLC
Domain Name(s):
VODXC.COM
Creation Date:
2013-04-01 05:19:06
Updated Date:
2019-05-07 13:27:12
2019-01-01 14:47:55
Expiration Date:
2020-04-01 05:19:06
Email(s):
abuse@godaddy.com
VODXC.COM@domainsbyproxy.com
Registrar(s):
GoDaddy.com, LLC
Name Server(s):
VIP3.ALIDNS.COM
VIP4.ALIDNS.COM
Referral URL(s):
None
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 104.20.98.101 | 美国 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.202 | 49159 | 104.20.98.101 www.vodxc.com | 80 |
| 192.168.122.202 | 49165 | 104.20.98.101 www.vodxc.com | 80 |
| 192.168.122.202 | 49166 | 104.20.98.101 www.vodxc.com | 80 |
| 192.168.122.202 | 49168 | 104.20.98.101 www.vodxc.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.202 | 51964 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| www.vodxc.com |
A 104.20.99.101 A 104.20.98.101 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.202 | 49159 | 104.20.98.101 www.vodxc.com | 80 |
| 192.168.122.202 | 49165 | 104.20.98.101 www.vodxc.com | 80 |
| 192.168.122.202 | 49166 | 104.20.98.101 www.vodxc.com | 80 |
| 192.168.122.202 | 49168 | 104.20.98.101 www.vodxc.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.202 | 51964 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://www.vodxc.com/DLJ/ | GET /DLJ/ HTTP/1.1 Accept: */* Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: www.vodxc.com Connection: Keep-Alive |
| URL专业沙箱检测 -> http://www.vodxc.com/xcimg/style.css | GET /xcimg/style.css HTTP/1.1 Accept: */* Referer: http://www.vodxc.com/DLJ/ Accept-Language: zh-CN User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: www.vodxc.com Connection: Keep-Alive Cookie: __cfduid=d1c62482d8431845bdf2ff5909d524f161563297307 |
| URL专业沙箱检测 -> http://www.vodxc.com/xcimg/js/jquery-1.8.3.min.js | GET /xcimg/js/jquery-1.8.3.min.js HTTP/1.1 Accept: */* Referer: http://www.vodxc.com/DLJ/ Accept-Language: zh-CN User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: www.vodxc.com Connection: Keep-Alive Cookie: __cfduid=d1c62482d8431845bdf2ff5909d524f161563297307 |
| URL专业沙箱检测 -> http://www.vodxc.com/xcimg/js/pingfen.js | GET /xcimg/js/pingfen.js HTTP/1.1 Accept: */* Referer: http://www.vodxc.com/DLJ/ Accept-Language: zh-CN User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: www.vodxc.com Connection: Keep-Alive Cookie: __cfduid=d1c62482d8431845bdf2ff5909d524f161563297307 |
| URL专业沙箱检测 -> http://www.vodxc.com/xcimg/js/history.js | GET /xcimg/js/history.js HTTP/1.1 Accept: */* Referer: http://www.vodxc.com/DLJ/ Accept-Language: zh-CN User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: www.vodxc.com Connection: Keep-Alive Cookie: __cfduid=d1c62482d8431845bdf2ff5909d524f161563297307 |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 24.238 seconds )
- 15.537 Suricata
- 4.046 Static
- 2.518 NetworkAnalysis
- 2.014 VirusTotal
- 0.11 AnalysisInfo
- 0.008 BehaviorAnalysis
- 0.005 Memory
Signatures ( 2.196 seconds )
- 2.05 md_url_bl
- 0.024 md_domain_bl
- 0.018 antiav_detectreg
- 0.011 anomaly_persistence_autorun
- 0.008 antiav_detectfile
- 0.007 infostealer_ftp
- 0.006 geodo_banking_trojan
- 0.006 ransomware_files
- 0.005 infostealer_im
- 0.005 ransomware_extensions
- 0.004 tinba_behavior
- 0.004 antianalysis_detectreg
- 0.004 infostealer_bitcoin
- 0.003 rat_nanocore
- 0.003 cerber_behavior
- 0.003 antivm_vbox_files
- 0.003 disables_browser_warn
- 0.003 infostealer_mail
- 0.003 md_bad_drop
- 0.003 network_torgateway
- 0.002 betabot_behavior
- 0.002 browser_security
- 0.001 network_tor
- 0.001 ursnif_behavior
- 0.001 kazybot_behavior
- 0.001 kibex_behavior
- 0.001 shifu_behavior
- 0.001 antianalysis_detectfile
- 0.001 antivm_parallels_keys
- 0.001 antivm_xen_keys
- 0.001 banker_zeus_mutex
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_addon
- 0.001 disables_system_restore
- 0.001 disables_windows_defender
- 0.001 malicious_drop_executable_file_to_temp_folder
- 0.001 ie_martian_children
- 0.001 maldun_network_blacklist
- 0.001 stealth_modify_uac_prompt
- 0.001 whois_create
Reporting ( 0.853 seconds )
- 0.853 ReportHTMLSummary
| Task ID | 336559 |
|---|---|
| Mongo ID | 5d2e06a82f8f2e4ea3fc0a86 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号