魔盾安全分析报告

分析类型 开始时间 结束时间 持续时间 分析引擎版本
FILE 2023-06-07 22:03:48 2023-06-07 22:04:35 47 秒 1.4-Maldun
虚拟机机器名 标签 虚拟机管理 开机时间 关机时间
win7-sp1-x64-shaapp02-1 win7-sp1-x64-shaapp02-1 KVM 2023-06-07 22:03:50 2023-06-07 22:04:37
魔盾分数

0.775

正常的

文件详细信息

文件名 tweakeroo-fabric-1.19.2-0.14.3.jar
文件大小 269995 字节
文件类型 Zip archive data, at least v2.0 to extract
CRC32 86BF92FF
MD5 a9a4922ef397cfbbcd0ea1b3584f14f0
SHA1 26f27bfe870778a8986aea9fb403aa812b5f2d83
SHA256 dba8d9f045f0da639cded9e9af1a17c4e28fadf2b54220e617cc58ef176a9afe
SHA512 9e3078c920a26abfb58204e4b51989f745cb46ed9ac571c9989b09dab1426cd52d72a7cc333b1c73a3700d21c0ec4dab85ab031b9424ff52c7cfdde00baa91bb
Ssdeep 6144:PuoBbJ72JftYIEHxjekFVlT3nTCAbZoyTabSOk846KE:rbEjoHt3XTXQvvXn
PEiD 无匹配
Yara
  • with_images (Detected the presence of an or several images)
VirusTotal VirusTotal查询失败

特征

可能进行了时间有效期检查，检查本地时间后过早退出
可疑的样本异常终止
魔盾wping.org IP地址信誉系统
Greylist: 104.208.16.93
魔盾安全Yara检测结果 - 普通

运行截图

网络分析

访问主机记录

直接访问 IP地址 国家名
否 104.208.16.93 United States

域名解析

域名 响应
watson.microsoft.com A 104.208.16.93
CNAME legacywatson.trafficmanager.net
CNAME onedsblobprdcus07.centralus.cloudapp.azure.com

TCP连接

IP地址 端口
23.192.228.89 80

UDP连接

IP地址 端口
192.168.122.1 53
192.168.122.1 53

HTTP请求

URL HTTP数据
http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip 
GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1
Accept: */*
If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT
User-Agent: IPM
Host: acroipm.adobe.com
Connection: Keep-Alive
Cache-Control: no-cache

静态分析

投放文件

无信息

行为分析

互斥量(Mutexes) 无信息
执行的命令 无信息
创建的服务 无信息
启动的服务 无信息

进程

java.exe PID: 2588, 上一级进程 PID: 2240

访问的文件
  • C:\Users\test\AppData\Local\Temp\tweakeroo-fabric-1.19.2-0.14.3.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\java.dll
  • C:\Windows\System32\tzres.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\i386\jvm.cfg
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\client\jvm.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\msvcr100.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\WSOCK32.dll
  • C:\Windows\System32\wsock32.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\WINMM.dll
  • C:\Windows\System32\winmm.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\VERSION.dll
  • C:\Windows\System32\version.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\verify.dll
  • C:\Users\test\AppData\Local\Temp\.hotspotrc
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\endorsed
  • C:\
  • C:\Users\test\AppData\Local\Temp\hsperfdata_test
  • C:\Users\test\AppData\Local\Temp\hsperfdata_test\2588
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\zip.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\resources.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\rt.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\sunrsasign.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\jsse.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\jce.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\charsets.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\jfr.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\classes
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\meta-index
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\client\classes.jsa
  • C:\Program Files (x86)
  • C:\Program Files (x86)\Java
  • C:\Program Files (x86)\Java\jre1.8.0_121
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib
  • C:\Users\test\AppData\Local\Temp\.hotspot_compiler
  • C:\Windows\sysnative\C_G18030.DLL
  • C:\Windows\Fonts\SimSun18030.ttc
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\meta-index
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext
  • C:\Windows\Sun\Java\lib\ext\meta-index
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\*
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\access-bridge-32.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\cldrdata.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\dnsns.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\jaccess.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\jfxrt.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\localedata.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\nashorn.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\sunec.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\sunjce_provider.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\sunmscapi.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\sunpkcs11.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\zipfs.jar
  • C:\Windows\Sun\Java\lib\ext
  • C:\Users
  • C:\Users\test
  • C:\Users\test\AppData
  • C:\Users\test\AppData\Local
  • C:\Users\test\AppData\Local\Temp
  • C:\Program Files (x86)\Java\conf\usagetracker.properties
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\management\usagetracker.properties
  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d8040.timestamp
  • C:\Program Files (x86)\Java\jre1.8.0_121\meta-index
读取的文件
  • C:\Users\test\AppData\Local\Temp\tweakeroo-fabric-1.19.2-0.14.3.jar
  • C:\Windows\System32\tzres.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\i386\jvm.cfg
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\msvcr100.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\client\jvm.dll
  • C:\Windows\System32\wsock32.dll
  • C:\Windows\System32\winmm.dll
  • C:\Windows\System32\version.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\verify.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\java.dll
  • C:\Users\test\AppData\Local\Temp\hsperfdata_test\2588
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\zip.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\meta-index
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\client\classes.jsa
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\rt.jar
  • C:\Windows\Fonts\SimSun18030.ttc
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\charsets.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\meta-index
修改的文件
  • C:\Users\test\AppData\Local\Temp\hsperfdata_test\2588
  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d8040.timestamp
删除的文件 无信息
注册表键
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Codepage
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\54936
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
读取的注册表键
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\54936
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
修改的注册表键 无信息
删除的注册表键 无信息
API解析
  • kernel32.dll.FlsAlloc
  • kernel32.dll.FlsGetValue
  • kernel32.dll.FlsSetValue
  • kernel32.dll.FlsFree
  • jvm.dll.JNI_CreateJavaVM
  • jvm.dll.JNI_GetDefaultJavaVMInitArgs
  • java.dll.JDK_GetVersionInfo0
  • advapi32.dll.SetSecurityDescriptorControl
  • zip.dll.ZIP_Open
  • zip.dll.ZIP_Close
  • zip.dll.ZIP_FindEntry
  • zip.dll.ZIP_ReadEntry
  • zip.dll.ZIP_GetNextEntry
  • zip.dll.ZIP_CRC32
  • java.dll.Canonicalize
  • java.dll._Java_java_lang_Object_registerNatives@8
  • java.dll._Java_java_lang_System_registerNatives@8
  • java.dll._Java_java_lang_Thread_registerNatives@8
  • java.dll._Java_java_security_AccessController_getStackAccessControlContext@8
  • java.dll._Java_java_security_AccessController_getInheritedAccessControlContext@8
  • java.dll._Java_java_lang_Class_registerNatives@8
  • java.dll._Java_java_lang_ClassLoader_registerNatives@8
  • java.dll._Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedAction_2@12
  • java.dll._Java_java_lang_Class_forName0@24
  • java.dll._Java_java_lang_Throwable_fillInStackTrace@12
  • java.dll._Java_sun_reflect_Reflection_getCallerClass__@8
  • java.dll._Java_java_lang_Class_getPrimitiveClass@12
  • java.dll._Java_java_lang_Float_floatToRawIntBits@12
  • java.dll._Java_java_lang_Double_doubleToRawLongBits@16
  • java.dll._Java_java_lang_Double_longBitsToDouble@16
  • java.dll._Java_sun_misc_VM_initialize@8
  • jvm.dll.JVM_GetVersionInfo
  • java.dll._Java_java_lang_System_initProperties@12
  • shell32.dll.SHGetKnownFolderPath
  • java.dll._Java_java_lang_String_intern@8
  • java.dll._Java_sun_reflect_Reflection_getClassAccessFlags@12
  • java.dll._Java_sun_reflect_NativeConstructorAccessorImpl_newInstance0@16
  • java.dll._Java_java_lang_Object_getClass@8
  • java.dll.NewStringPlatform
  • java.dll._Java_java_lang_Runtime_maxMemory@8
  • java.dll._Java_java_io_FileInputStream_initIDs@8
  • java.dll._Java_java_io_FileDescriptor_initIDs@8
  • java.dll._Java_java_io_FileDescriptor_set@12
  • java.dll._Java_java_io_FileOutputStream_initIDs@8
  • java.dll._Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedExceptionAction_2@12
  • java.dll._Java_java_lang_Class_isAssignableFrom@12
  • java.dll._Java_java_lang_System_setIn0@12
  • java.dll._Java_java_util_concurrent_atomic_AtomicLong_VMSupportsCS8@8
  • java.dll._Java_java_lang_System_setOut0@12
  • java.dll._Java_java_lang_System_setErr0@12
  • java.dll._Java_java_io_WinNTFileSystem_initIDs@8
  • kernel32.dll.GetFinalPathNameByHandleW
  • java.dll._Java_java_lang_System_mapLibraryName@12
  • java.dll._Java_java_lang_ClassLoader_findBuiltinLib@12
  • java.dll._Java_java_io_WinNTFileSystem_getBooleanAttributes@12
  • java.dll._Java_java_io_WinNTFileSystem_canonicalize0@12
  • java.dll._Java_java_lang_ClassLoader_00024NativeLibrary_load@16
  • java.dll._Java_sun_misc_Signal_findSignal@12
  • java.dll._Java_sun_misc_Signal_handle0@20
  • java.dll._Java_sun_io_Win32ErrorMode_setErrorMode@16
  • java.dll._Java_java_lang_Compiler_registerNatives@8
  • java.dll._Java_java_io_FileInputStream_open0@12
  • java.dll._Java_java_io_FileInputStream_readBytes@20
  • java.dll._Java_java_io_FileInputStream_available@8
  • java.dll._Java_java_lang_reflect_Array_newArray@16
  • java.dll._Java_java_lang_Runtime_availableProcessors@8
  • java.dll._Java_java_io_FileInputStream_close0@8
  • java.dll._Java_java_io_WinNTFileSystem_list@12
  • java.dll._Java_java_io_WinNTFileSystem_canonicalizeWithPrefix0@16
  • java.dll._Java_sun_misc_URLClassPath_getLookupCacheURLs@12
  • java.dll._Java_java_lang_ProcessEnvironment_environmentBlock@8
  • java.dll._Java_java_io_FileOutputStream_open0@16
  • java.dll._Java_java_io_FileOutputStream_writeBytes@24
  • java.dll._Java_java_io_FileOutputStream_close0@8
  • jvm.dll.JVM_FindClassFromBootLoader
  • java.dll._Java_java_lang_ClassLoader_00024NativeLibrary_find@12
  • zip.dll._Java_java_util_zip_ZipFile_initIDs@8
  • java.dll._Java_java_io_WinNTFileSystem_getLastModifiedTime@12
  • zip.dll._Java_java_util_zip_ZipFile_open@28
  • zip.dll._Java_java_util_zip_ZipFile_getTotal@16
  • zip.dll._Java_java_util_zip_ZipFile_startsWithLOC@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntry@24
  • zip.dll._Java_java_util_zip_ZipFile_getEntryFlag@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntryTime@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntryCrc@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntrySize@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntryCSize@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntryMethod@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntryBytes@20
  • zip.dll._Java_java_util_zip_ZipFile_freeEntry@24
  • zip.dll._Java_java_util_zip_Inflater_initIDs@8
  • zip.dll._Java_java_util_zip_Inflater_init@12
  • zip.dll._Java_java_util_zip_Inflater_inflateBytes@28
  • zip.dll._Java_java_util_zip_ZipFile_read@44
  • zip.dll._Java_java_util_zip_Inflater_reset@16
  • java.dll._Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedExceptionAction_2Ljava_security_AccessControlContext_2@16
  • java.dll._Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedAction_2Ljava_security_AccessControlContext_2@16
  • java.dll._Java_java_lang_ClassLoader_findLoadedClass0@12
  • java.dll._Java_java_lang_ClassLoader_findBootstrapClass@12
  • java.dll._Java_java_lang_Shutdown_halt0@12