魔盾安全分析报告

分析类型 开始时间 结束时间 持续时间 分析引擎版本
FILE 2019-07-21 11:24:06 2019-07-21 11:27:16 190 秒 1.4-Maldun
虚拟机机器名 标签 虚拟机管理 开机时间 关机时间
win7-sp1-x64-hpdapp01-4 win7-sp1-x64-hpdapp01-4 KVM 2019-07-21 11:24:13 2019-07-21 11:27:18
魔盾分数

0.775

正常的

文件详细信息

文件名 www.eyy5.cn
文件大小 102003 字节
文件类型 HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
CRC32 156401F4
MD5 36ca8ac81f341ec5a7b1dddf00b89eee
SHA1 7034e88d661a9bf2d6728559f02716325df03b4d
SHA256 e2df2955a262003eabe1a6409e982f04fc0ee5425696dcd39e7d94534401633e
SHA512 48d3c2a476906dc6117f9f67487bf77f340027971b3bbfcf02826fd72fd9b2acf0a00d35f31bc13d139ed630fa77f87e75a4718094a4d36d0ad935f6cdc04eda
Ssdeep 1536:S8HEqPJRK92GYjtWGhJzta4g1uOqwEkRlfmWcOsL:S8W9fuL
PEiD 无匹配
Yara
  • without_attachments (Detected no presence of any attachment)
  • with_images (Detected the presence of an or several images)
  • with_urls (Detected the presence of an or several urls)
  • Big_Numbers1 (Looks for big numbers 32:sized)
VirusTotal 无此文件扫描结果

特征

检测到网络活动但没有显示在API日志中
country_name: China
ip: 111.67.195.176
inaddrarpa:
hostname: img.eyy5.cn
score: 8
ip: 111.67.195.176
domain: img.eyy5.cn
魔盾wping.org 域名信誉系统
Greylist: www.eyy5.cn
魔盾安全Yara检测结果 - 普通
Informational: Detected no presence of any attachment
Informational: Detected the presence of an or several images
Informational: Detected the presence of an or several urls
Informational: Looks for big numbers 32:sized
发起了一些HTTP请求
url: http://img.eyy5.cn/block/36/36a9f75e4be9681bb0a35c5790f457af.jpg
url: http://img.eyy5.cn/block/51/51198606eba38b38cafb49b2b1cb635b.jpg
url: http://img.eyy5.cn/block/e8/e80c1fc0fa3f126fa2d2c044b6469416.jpg
url: http://img.eyy5.cn/block/b1/b16a28edce6cefbb6af03f930c2cbb08.jpg
url: http://img.eyy5.cn/block/dd/dd3a7f3e5756c7ee4c6a8a74ca1f7104.jpg
url: http://img.eyy5.cn/block/d6/d6017eacf5c8d28f8c16f5bae02c3e9e.jpg
url: http://img.eyy5.cn/block/4b/4bce767d1bbc7f66be37cf4990ebbdde.jpg
url: http://img.eyy5.cn/block/4a/4a38f66ad75fe66c5e4cadb0a61a8503.jpg
url: http://img.eyy5.cn/block/d9/d922c17032008da6299d1c5b5c370076.jpg
url: http://img.eyy5.cn/block/4c/4c9cf4b82d8cbf76ec0b6c77bc721c35.jpg

运行截图

无运行截图

网络分析

访问主机记录

直接访问 IP地址 国家名
否 111.67.195.176 China

域名解析

域名 响应
www.eyy5.cn A 111.67.195.176
img.eyy5.cn

TCP连接

IP地址 端口
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 80
111.67.195.176 80
111.67.195.176 80
111.67.195.176 80
111.67.195.176 80
111.67.195.176 80
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443
111.67.195.176 443

UDP连接

IP地址 端口
192.168.122.1 53
192.168.122.1 53

HTTP请求

URL HTTP数据
http://img.eyy5.cn/block/36/36a9f75e4be9681bb0a35c5790f457af.jpg 
GET /block/36/36a9f75e4be9681bb0a35c5790f457af.jpg HTTP/1.1
Accept: */*
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img.eyy5.cn
Connection: Keep-Alive
http://img.eyy5.cn/block/51/51198606eba38b38cafb49b2b1cb635b.jpg 
GET /block/51/51198606eba38b38cafb49b2b1cb635b.jpg HTTP/1.1
Accept: */*
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img.eyy5.cn
Connection: Keep-Alive
http://img.eyy5.cn/block/e8/e80c1fc0fa3f126fa2d2c044b6469416.jpg 
GET /block/e8/e80c1fc0fa3f126fa2d2c044b6469416.jpg HTTP/1.1
Accept: */*
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img.eyy5.cn
Connection: Keep-Alive
http://img.eyy5.cn/block/b1/b16a28edce6cefbb6af03f930c2cbb08.jpg 
GET /block/b1/b16a28edce6cefbb6af03f930c2cbb08.jpg HTTP/1.1
Accept: */*
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img.eyy5.cn
Connection: Keep-Alive
http://img.eyy5.cn/block/dd/dd3a7f3e5756c7ee4c6a8a74ca1f7104.jpg 
GET /block/dd/dd3a7f3e5756c7ee4c6a8a74ca1f7104.jpg HTTP/1.1
Accept: */*
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img.eyy5.cn
Connection: Keep-Alive
http://img.eyy5.cn/block/d6/d6017eacf5c8d28f8c16f5bae02c3e9e.jpg 
GET /block/d6/d6017eacf5c8d28f8c16f5bae02c3e9e.jpg HTTP/1.1
Accept: */*
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img.eyy5.cn
Connection: Keep-Alive
http://img.eyy5.cn/block/4b/4bce767d1bbc7f66be37cf4990ebbdde.jpg 
GET /block/4b/4bce767d1bbc7f66be37cf4990ebbdde.jpg HTTP/1.1
Accept: */*
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img.eyy5.cn
Connection: Keep-Alive
http://img.eyy5.cn/block/4a/4a38f66ad75fe66c5e4cadb0a61a8503.jpg 
GET /block/4a/4a38f66ad75fe66c5e4cadb0a61a8503.jpg HTTP/1.1
Accept: */*
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img.eyy5.cn
Connection: Keep-Alive
http://img.eyy5.cn/block/d9/d922c17032008da6299d1c5b5c370076.jpg 
GET /block/d9/d922c17032008da6299d1c5b5c370076.jpg HTTP/1.1
Accept: */*
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img.eyy5.cn
Connection: Keep-Alive
http://img.eyy5.cn/block/4c/4c9cf4b82d8cbf76ec0b6c77bc721c35.jpg 
GET /block/4c/4c9cf4b82d8cbf76ec0b6c77bc721c35.jpg HTTP/1.1
Accept: */*
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: img.eyy5.cn
Connection: Keep-Alive

静态分析

无信息

投放文件

无信息

行为分析

互斥量(Mutexes) 无信息
执行的命令 无信息
创建的服务 无信息
启动的服务 无信息

进程

iexplore.exe PID: 2960, 上一级进程 PID: 2324

访问的文件 无信息
读取的文件 无信息
修改的文件 无信息
删除的文件 无信息
注册表键 无信息
读取的注册表键 无信息
修改的注册表键 无信息
删除的注册表键 无信息
API解析 无信息