魔盾安全分析报告

分析类型 开始时间 结束时间 持续时间 分析引擎版本
URL 2019-01-15 10:45:47 2019-01-15 10:48:03 136 秒 1.4-Maldun
虚拟机机器名 标签 虚拟机管理 开机时间 关机时间
win7-sp1-x64-shaapp01-1 win7-sp1-x64-shaapp01-1 KVM 2019-01-15 10:45:47 2019-01-15 10:48:05
魔盾分数

3.0

可疑的

URL信息

URL http://8911889.com
VirusTotal VirusTotal查询失败

特征

目标URL域名为最近注册 (21 天以前)
检测到网络活动但没有显示在API日志中
country_name: Hong Kong
ip: 103.233.10.234
inaddrarpa:
hostname: 8911889.com
score: unknown
ip: 103.233.10.234
domain: 8911889.com

运行截图

网络分析

访问主机记录

直接访问 IP地址 国家名
否 103.233.10.234 Hong Kong

域名解析

域名 响应
8911889.com A 103.233.10.234

TCP连接

IP地址 端口
103.233.10.234 80
103.233.10.234 80
103.233.10.234 80
103.233.10.234 80
103.233.10.234 80
103.233.10.234 80
103.233.10.234 80

UDP连接

IP地址 端口
192.168.122.1 53

HTTP请求

URL HTTP数据
http://8911889.com/ 
GET / HTTP/1.1
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
http://8911889.com/yoy/css/home.css 
GET /yoy/css/home.css HTTP/1.1
Accept: */*
Referer: http://8911889.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/skin/main/onload.js?version=20160420 
GET /skin/main/onload.js?version=20160420 HTTP/1.1
Accept: */*
Referer: http://8911889.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/js/guest.js 
GET /js/guest.js HTTP/1.1
Accept: */*
Referer: http://8911889.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/yoy/css/index.css 
GET /yoy/css/index.css HTTP/1.1
Accept: */*
Referer: http://8911889.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/skin/main/reglogin.js 
GET /skin/main/reglogin.js HTTP/1.1
Accept: */*
Referer: http://8911889.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/yoy/js/global.js 
GET /yoy/js/global.js HTTP/1.1
Accept: */*
Referer: http://8911889.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/skin/js/jquery-1.8.3.min.js 
GET /skin/js/jquery-1.8.3.min.js HTTP/1.1
Accept: */*
Referer: http://8911889.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/yoy/css/common.css 
GET /yoy/css/common.css HTTP/1.1
Accept: */*
Referer: http://8911889.com/
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/browser.html 
GET /browser.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/static/images/firefox.png 
GET /static/images/firefox.png HTTP/1.1
Accept: */*
Referer: http://8911889.com/browser.html
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/static/images/chrome.png 
GET /static/images/chrome.png HTTP/1.1
Accept: */*
Referer: http://8911889.com/browser.html
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/static/images/ie.png 
GET /static/images/ie.png HTTP/1.1
Accept: */*
Referer: http://8911889.com/browser.html
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc
http://8911889.com/favicon.ico 
GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 8911889.com
Connection: Keep-Alive
Cookie: PHPSESSID=822e268a24b1327b43007a0457dfcbcc

投放文件

无信息

行为分析

互斥量(Mutexes) 无信息
执行的命令 无信息
创建的服务 无信息
启动的服务 无信息

进程

iexplore.exe PID: 2532, 上一级进程 PID: 2320

访问的文件 无信息
读取的文件 无信息
修改的文件 无信息
删除的文件 无信息
注册表键 无信息
读取的注册表键 无信息
修改的注册表键 无信息
删除的注册表键 无信息
API解析 无信息