魔盾安全分析报告

分析类型	开始时间	结束时间	持续时间	分析引擎版本
URL	2020-10-23 17:58:40	2020-10-23 18:00:42	122 秒	1.4-Maldun

虚拟机机器名	标签	虚拟机管理	开机时间	关机时间
win7-sp1-x64-shaapp03-1	win7-sp1-x64-shaapp03-1	KVM	2020-10-23 17:58:40	2020-10-23 18:00:43

魔盾分数
7.87 恶意的

URL信息

URL	http://tips-hn.7654.com/n/tui/package/screensaver/v1.0.8.2/screen_saver-4.exe
VirusTotal	VirusTotal查询失败

特征

生成可疑网络流量，可能被用来进行恶意活动

signature: ET POLICY PE EXE or DLL Windows file download HTTP

signature: SURICATA Applayer Detect protocol only one direction

魔盾wping.org 域名信誉系统

Badlist: tips-hn.7654.com

运行截图

网络分析

域名解析

域名	响应
tips-hn.7654.com	A 59.63.235.236 A 125.78.252.115 A 59.63.235.194 A 59.63.235.122 CNAME tips-hn.7654.com.cdn.dnsv1.com CNAME 817465.p23.tc.cdntip.com
acroipm.adobe.com	CNAME acroipm.adobe.com.edgesuite.net A 23.218.94.163 CNAME a1983.dscd.akamai.net A 23.218.94.155
watson.microsoft.com	A 104.42.151.234 CNAME legacy.umwatsonrouting.trafficmanager.net CNAME skypedataprdcolwus16.cloudapp.net

TCP连接

IP地址	端口
104.42.151.234	80
23.218.94.163	80
59.63.235.194	80

UDP连接

IP地址	端口
192.168.122.1	53
192.168.122.1	53
192.168.122.1	53

HTTP请求

URL	HTTP数据
http://tips-hn.7654.com/n/tui/package/screensaver/v1.0.8.2/screen_saver-4.exe	GET /n/tui/package/screensaver/v1.0.8.2/screen_saver-4.exe HTTP/1.1 Accept: / Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: tips-hn.7654.com Connection: Keep-Alive
http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip	GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: / If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache
http://watson.microsoft.com/StageOne/AcroRd32_exe/11_0_0_379/505fd19e/AcroRd32_dll/11_0_0_379/505fd190/c0000005/000d2b25.htm?LCID=2052&OS=6.1.7601.2.00010100.1.0.1.17514&SM=QEMU&SPN=Standard%20PC%20(i440FX%20+%20PIIX_%201996)&BV=Bochs&MID=418354EE-9703-4A5C-8802-E77B54791961	GET /StageOne/AcroRd32_exe/11_0_0_379/505fd19e/AcroRd32_dll/11_0_0_379/505fd190/c0000005/000d2b25.htm?LCID=2052&OS=6.1.7601.2.00010100.1.0.1.17514&SM=QEMU&SPN=Standard%20PC%20(i440FX%20+%20PIIX_%201996)&BV=Bochs&MID=418354EE-9703-4A5C-8802-E77B54791961 HTTP/1.1 Connection: Keep-Alive User-Agent: MSDW Host: watson.microsoft.com

URL

HTTP数据

http://tips-hn.7654.com/n/tui/package/screensaver/v1.0.8.2/screen_saver-4.exe

GET /n/tui/package/screensaver/v1.0.8.2/screen_saver-4.exe HTTP/1.1
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: tips-hn.7654.com
Connection: Keep-Alive

http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip

GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1
Accept: */*
If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT
User-Agent: IPM
Host: acroipm.adobe.com
Connection: Keep-Alive
Cache-Control: no-cache

http://watson.microsoft.com/StageOne/AcroRd32_exe/11_0_0_379/505fd19e/AcroRd32_dll/11_0_0_379/505fd190/c0000005/000d2b25.htm?LCID=2052&OS=6.1.7601.2.00010100.1.0.1.17514&SM=QEMU&SPN=Standard%20PC%20(i440FX%20+%20PIIX_%201996)&BV=Bochs&MID=418354EE-9703-4A5C-8802-E77B54791961

GET /StageOne/AcroRd32_exe/11_0_0_379/505fd19e/AcroRd32_dll/11_0_0_379/505fd190/c0000005/000d2b25.htm?LCID=2052&OS=6.1.7601.2.00010100.1.0.1.17514&SM=QEMU&SPN=Standard%20PC%20(i440FX%20+%20PIIX_%201996)&BV=Bochs&MID=418354EE-9703-4A5C-8802-E77B54791961 HTTP/1.1
Connection: Keep-Alive
User-Agent: MSDW
Host: watson.microsoft.com

投放文件

无信息

行为分析

互斥量(Mutexes) 无信息

执行的命令 无信息

创建的服务 无信息

启动的服务 无信息

进程

iexplore.exe PID: 2428, 上一级进程 PID: 2116

访问的文件 无信息

读取的文件 无信息

修改的文件 无信息

删除的文件 无信息

注册表键 无信息

读取的注册表键 无信息

修改的注册表键 无信息

删除的注册表键 无信息

API解析 无信息