魔盾安全分析报告

分析类型	开始时间	结束时间	持续时间	分析引擎版本
URL	2021-04-19 14:42:37	2021-04-19 14:44:42	125 秒	1.4-Maldun

虚拟机机器名	标签	虚拟机管理	开机时间	关机时间
win7-sp1-x64-shaapp03-1	win7-sp1-x64-shaapp03-1	KVM	2021-04-19 14:42:37	2021-04-19 14:44:43

魔盾分数
0.35 正常的

URL	http://crisdomson.com
VirusTotal	VirusTotal查询失败

网络分析

域名解析

域名	响应
crisdomson.com	A 159.69.186.9 A 159.69.83.207 A 159.69.42.212 A 95.216.161.60
track.vcdc.com	A 167.233.8.197
acroipm.adobe.com	CNAME a1983.dscd.akamai.net CNAME acroipm.adobe.com.edgesuite.net A 23.45.112.66 A 23.45.112.74
watson.microsoft.com	A 13.88.21.125 CNAME blobcollector.events.data.trafficmanager.net CNAME skypedataprdcolwus15.cloudapp.net

TCP连接

IP地址	端口
159.69.186.9	80
167.233.8.197	443
167.233.8.197	443
167.233.8.197	443
23.45.112.66	80

UDP连接

IP地址	端口
192.168.122.1	53
192.168.122.1	53
192.168.122.1	53
192.168.122.1	53

HTTP请求

URL	HTTP数据
http://crisdomson.com/	GET / HTTP/1.1 Accept: / Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: crisdomson.com Connection: Keep-Alive
http://crisdomson.com/banner_ads.js	GET /banner_ads.js HTTP/1.1 Accept: / Referer: http://crisdomson.com/ Accept-Language: zh-CN User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: crisdomson.com Connection: Keep-Alive Cookie: ndsp=eyJkb21haW5OYW1lIjoiY3Jpc2RvbXNvbi5jb20iLCJtZW1iZXIiOiIxMjYiLCJ0ZW1wbGF0ZSI6InNwbGl0dGVyIiwidXNlckFnZW50IjoiTW96aWxsYVwvNC4wIChjb21wYXRpYmxlOyBNU0lFIDguMDsgV2luZG93cyBOVCA2LjE7IFdPVzY0OyBUcmlkZW50XC80LjA7IFNMQ0MyOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuNS4zMDcyOTsgLk5FVCBDTFIgMy4wLjMwNzI5OyBNZWRpYSBDZW50ZXIgUEMgNi4wOyAuTkVUNC4wQzsgLk5FVDQuMEUpIiwic2Vzc2lvbiI6ImM2MTBiNzQ2YjA0YjQxZTNiMmI3MjhhMDYwOTQzMjQ0IiwidGltZV9pbml0IjoxNjE4ODEzNDAwfQ%3D%3D
http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip	GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: / If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache

URL

HTTP数据

http://crisdomson.com/

GET / HTTP/1.1
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: crisdomson.com
Connection: Keep-Alive

http://crisdomson.com/banner_ads.js

GET /banner_ads.js HTTP/1.1
Accept: */*
Referer: http://crisdomson.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: crisdomson.com
Connection: Keep-Alive
Cookie: ndsp=eyJkb21haW5OYW1lIjoiY3Jpc2RvbXNvbi5jb20iLCJtZW1iZXIiOiIxMjYiLCJ0ZW1wbGF0ZSI6InNwbGl0dGVyIiwidXNlckFnZW50IjoiTW96aWxsYVwvNC4wIChjb21wYXRpYmxlOyBNU0lFIDguMDsgV2luZG93cyBOVCA2LjE7IFdPVzY0OyBUcmlkZW50XC80LjA7IFNMQ0MyOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuNS4zMDcyOTsgLk5FVCBDTFIgMy4wLjMwNzI5OyBNZWRpYSBDZW50ZXIgUEMgNi4wOyAuTkVUNC4wQzsgLk5FVDQuMEUpIiwic2Vzc2lvbiI6ImM2MTBiNzQ2YjA0YjQxZTNiMmI3MjhhMDYwOTQzMjQ0IiwidGltZV9pbml0IjoxNjE4ODEzNDAwfQ%3D%3D

http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip

GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1
Accept: */*
If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT
User-Agent: IPM
Host: acroipm.adobe.com
Connection: Keep-Alive
Cache-Control: no-cache

行为分析

互斥量(Mutexes) 无信息

执行的命令 无信息

创建的服务 无信息

启动的服务 无信息

进程

iexplore.exe PID: 2396, 上一级进程 PID: 2156

访问的文件 无信息

读取的文件 无信息

修改的文件 无信息

删除的文件 无信息

注册表键 无信息

读取的注册表键 无信息

修改的注册表键 无信息

删除的注册表键 无信息

API解析 无信息

魔盾安全分析报告

0.35

正常的

URL信息

特征

运行截图