魔盾安全分析报告

分析类型	开始时间	结束时间	持续时间	分析引擎版本
URL	2020-02-18 17:17:42	2020-02-18 17:19:57	135 秒	1.4-Maldun

虚拟机机器名	标签	虚拟机管理	开机时间	关机时间
win7-sp1-x64-hpdapp01-1	win7-sp1-x64-hpdapp01-1	KVM	2020-02-18 17:17:42	2020-02-18 17:19:58

魔盾分数
0.35 正常的

URL	http://url.cn/5mZOL61?_wv=3
VirusTotal	VirusTotal查询失败

网络分析

域名解析

域名	响应
url.cn	A 14.215.138.13 A 58.60.9.100
p.mb.qq.com	A 101.91.5.238 CNAME sparta.qb.mig.tencent-cloud.net A 101.91.69.89
wangzhecvh4.oss-cn-beijing.aliyuncs.com	A 59.110.190.94

TCP连接

IP地址	端口
101.91.5.238	80
101.91.5.238	443
14.215.138.13	80
59.110.190.94	443

UDP连接

IP地址	端口
192.168.122.1	53
192.168.122.1	53
192.168.122.1	53

HTTP请求

URL	HTTP数据
http://url.cn/5mZOL61?_wv=3	GET /5mZOL61?_wv=3 HTTP/1.1 Accept: / Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: url.cn Connection: Keep-Alive
http://p.mb.qq.com/s?u=http%3A%2F%2Furl.cn%2F5atMQS7%3Ffl822f3mj2hfl822f3mj2hfl822f3mj2hfl822f3mj2h1582017327953158201732795315820173279531582017327953fl822f3mj2hfl822f3mj2hfl822f3mj2h&_wv=3&_wv=3	GET /s?u=http%3A%2F%2Furl.cn%2F5atMQS7%3Ffl822f3mj2hfl822f3mj2hfl822f3mj2hfl822f3mj2h1582017327953158201732795315820173279531582017327953fl822f3mj2hfl822f3mj2hfl822f3mj2h&_wv=3&_wv=3 HTTP/1.1 Accept: / Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: p.mb.qq.com Connection: Keep-Alive
http://url.cn/5atMQS7?fl822f3mj2hfl822f3mj2hfl822f3mj2hfl822f3mj2h1582017327953158201732795315820173279531582017327953fl822f3mj2hfl822f3mj2hfl822f3mj2h	GET /5atMQS7?fl822f3mj2hfl822f3mj2hfl822f3mj2hfl822f3mj2h1582017327953158201732795315820173279531582017327953fl822f3mj2hfl822f3mj2hfl822f3mj2h HTTP/1.1 Accept: / Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: url.cn Connection: Keep-Alive

URL

HTTP数据

http://url.cn/5mZOL61?_wv=3

GET /5mZOL61?_wv=3 HTTP/1.1
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: url.cn
Connection: Keep-Alive

http://p.mb.qq.com/s?u=http%3A%2F%2Furl.cn%2F5atMQS7%3Ffl822f3mj2hfl822f3mj2hfl822f3mj2hfl822f3mj2h1582017327953158201732795315820173279531582017327953fl822f3mj2hfl822f3mj2hfl822f3mj2h&_wv=3&_wv=3

GET /s?u=http%3A%2F%2Furl.cn%2F5atMQS7%3Ffl822f3mj2hfl822f3mj2hfl822f3mj2hfl822f3mj2h1582017327953158201732795315820173279531582017327953fl822f3mj2hfl822f3mj2hfl822f3mj2h&_wv=3&_wv=3 HTTP/1.1
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: p.mb.qq.com
Connection: Keep-Alive

http://url.cn/5atMQS7?fl822f3mj2hfl822f3mj2hfl822f3mj2hfl822f3mj2h1582017327953158201732795315820173279531582017327953fl822f3mj2hfl822f3mj2hfl822f3mj2h

GET /5atMQS7?fl822f3mj2hfl822f3mj2hfl822f3mj2hfl822f3mj2h1582017327953158201732795315820173279531582017327953fl822f3mj2hfl822f3mj2hfl822f3mj2h HTTP/1.1
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: url.cn
Connection: Keep-Alive

魔盾安全分析报告

0.35

正常的

URL信息

特征

运行截图

网络分析

域名解析

TCP连接

UDP连接

HTTP请求

投放文件

行为分析

进程