魔盾安全分析报告

分析类型 开始时间 结束时间 持续时间 分析引擎版本
URL 2020-02-14 23:12:09 2020-02-14 23:14:16 127 秒 1.4-Maldun
虚拟机机器名 标签 虚拟机管理 开机时间 关机时间
win7-sp1-x64-hpdapp01-1 win7-sp1-x64-hpdapp01-1 KVM 2020-02-14 23:12:09 2020-02-14 23:14:17
魔盾分数

0.35

正常的

URL信息

URL http://ytlpfr.cn
VirusTotal VirusTotal查询失败

特征

魔盾wping.org 域名信誉系统
Greylist: ytlpfr.cn
Greylist: 0z9xw.cn

运行截图

网络分析

域名解析

域名 响应
ytlpfr.cn A 47.56.86.239
0z9xw.cn

TCP连接

IP地址 端口
47.56.86.239 80
47.56.86.239 80
47.56.86.239 80
47.56.86.239 80
47.56.86.239 80
47.56.86.239 80

UDP连接

IP地址 端口
192.168.122.1 53
192.168.122.1 53

HTTP请求

URL HTTP数据
http://ytlpfr.cn/ 
GET / HTTP/1.1
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: ytlpfr.cn
Connection: Keep-Alive
http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3 
GET /C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3 HTTP/1.1
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/css/weui.css 
GET /css/weui.css HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/css/article.css?version=1561184221 
GET /css/article.css?version=1561184221 HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/plug/comments/js/comments.js 
GET /plug/comments/js/comments.js HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/plug/praise/js/praise.js 
GET /plug/praise/js/praise.js HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/plug/common/js/jquery.min.js 
GET /plug/common/js/jquery.min.js HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/plug/reading/js/reading.js 
GET /plug/reading/js/reading.js HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/poster/1581519229.jpg 
GET /poster/1581519229.jpg HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/images/praise.png 
GET /images/praise.png HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/favicon.ico 
GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/index.php?r=comments/index&art_num=C4BF6FFCCAE4E5 
GET /index.php?r=comments/index&art_num=C4BF6FFCCAE4E5 HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: zh-cn
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/index.php?r=reading/index&art_num=C4BF6FFCCAE4E5&nowurl=http%3A%2F%2F0z9xw.cn%2FC4BF6FFCCAE4E5%3Fv%3Dfd8ec7cd7172a29e619146ee0d270aa3&fromurl=&v=fd8ec7cd7172a29e619146ee0d270aa3 
GET /index.php?r=reading/index&art_num=C4BF6FFCCAE4E5&nowurl=http%3A%2F%2F0z9xw.cn%2FC4BF6FFCCAE4E5%3Fv%3Dfd8ec7cd7172a29e619146ee0d270aa3&fromurl=&v=fd8ec7cd7172a29e619146ee0d270aa3 HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: zh-cn
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/index.php?r=praise/index&art_num=C4BF6FFCCAE4E5 
GET /index.php?r=praise/index&art_num=C4BF6FFCCAE4E5 HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: zh-cn
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/comments/1578750318.jpg 
GET /comments/1578750318.jpg HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/comments/1578750579.jpg 
GET /comments/1578750579.jpg HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/comments/1578750688.jpg 
GET /comments/1578750688.jpg HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/comments/1578750790.jpg 
GET /comments/1578750790.jpg HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive
http://0z9xw.cn/comments/1578750912.jpg 
GET /comments/1578750912.jpg HTTP/1.1
Accept: */*
Referer: http://0z9xw.cn/C4BF6FFCCAE4E5?v=fd8ec7cd7172a29e619146ee0d270aa3
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 0z9xw.cn
Connection: Keep-Alive

投放文件

无信息

行为分析

互斥量(Mutexes) 无信息
执行的命令 无信息
创建的服务 无信息
启动的服务 无信息

进程

iexplore.exe PID: 2644, 上一级进程 PID: 2332

访问的文件 无信息
读取的文件 无信息
修改的文件 无信息
删除的文件 无信息
注册表键 无信息
读取的注册表键 无信息
修改的注册表键 无信息
删除的注册表键 无信息
API解析 无信息