魔盾安全分析报告

分析类型 开始时间 结束时间 持续时间 分析引擎版本
URL 2020-10-20 21:51:57 2020-10-20 21:54:00 123 秒 1.4-Maldun
虚拟机机器名 标签 虚拟机管理 开机时间 关机时间
win7-sp1-x64-shaapp03-1 win7-sp1-x64-shaapp03-1 KVM 2020-10-20 21:51:57 2020-10-20 21:54:02
魔盾分数

0.0

正常的

URL信息

URL http://39.98.65.193:15000/
VirusTotal VirusTotal查询失败

特征

无特征匹配

运行截图

网络分析

域名解析

域名 响应
cdnjs.cloudflare.com A 104.17.78.107
A 104.17.79.107
acroipm.adobe.com CNAME a1983.dscd.akamai.net
CNAME acroipm.adobe.com.edgesuite.net
A 23.59.188.114
A 23.59.188.113

TCP连接

IP地址 端口
104.17.78.107 80
104.17.78.107 80
23.59.188.114 80
39.98.65.193 15000
39.98.65.193 15000
39.98.65.193 15000

UDP连接

IP地址 端口
192.168.122.1 53
192.168.122.1 53

HTTP请求

URL HTTP数据
http://39.98.65.193:15000/ 
GET / HTTP/1.1
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 39.98.65.193:15000
Connection: Keep-Alive
http://39.98.65.193:15000/static/icon.png 
GET /static/icon.png HTTP/1.1
Accept: */*
Referer: http://39.98.65.193:15000/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 39.98.65.193:15000
Connection: Keep-Alive
Cookie: session=eyJjc3JmX3Rva2VuIjoiYjkxZTc1Y2M4OWEwNmNlMjVhM2VlMTY0MjZlZGVhZDkzOWIxNzRlOSJ9.EnB9Dw.5rOmvUmIYZO8wiBpOWGVtZaY5e8
http://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css 
GET /ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1
Accept: */*
Referer: http://39.98.65.193:15000/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: cdnjs.cloudflare.com
Connection: Keep-Alive
http://cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js 
GET /ajax/libs/jquery/1.12.4/jquery.min.js HTTP/1.1
Accept: */*
Referer: http://39.98.65.193:15000/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: cdnjs.cloudflare.com
Connection: Keep-Alive
http://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js 
GET /ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js HTTP/1.1
Accept: */*
Referer: http://39.98.65.193:15000/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: cdnjs.cloudflare.com
Connection: Keep-Alive
http://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/fonts/glyphicons-halflings-regular.eot? 
GET /ajax/libs/twitter-bootstrap/3.3.7/fonts/glyphicons-halflings-regular.eot? HTTP/1.1
Accept: */*
Referer: http://39.98.65.193:15000/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: cdnjs.cloudflare.com
Connection: Keep-Alive
http://39.98.65.193:15000/favicon.ico 
GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 39.98.65.193:15000
Connection: Keep-Alive
Cookie: session=eyJjc3JmX3Rva2VuIjoiYjkxZTc1Y2M4OWEwNmNlMjVhM2VlMTY0MjZlZGVhZDkzOWIxNzRlOSJ9.EnB9Dw.5rOmvUmIYZO8wiBpOWGVtZaY5e8
http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip 
GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1
Accept: */*
If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT
User-Agent: IPM
Host: acroipm.adobe.com
Connection: Keep-Alive
Cache-Control: no-cache

投放文件

无信息

行为分析

互斥量(Mutexes) 无信息
执行的命令 无信息
创建的服务 无信息
启动的服务 无信息

进程

iexplore.exe PID: 2396, 上一级进程 PID: 2176

访问的文件 无信息
读取的文件 无信息
修改的文件 无信息
删除的文件 无信息
注册表键 无信息
读取的注册表键 无信息
修改的注册表键 无信息
删除的注册表键 无信息
API解析 无信息