魔盾安全分析报告

分析类型 开始时间 结束时间 持续时间 分析引擎版本
FILE 2022-05-27 19:09:25 2022-05-27 19:10:14 49 秒 1.4-Maldun
虚拟机机器名 标签 虚拟机管理 开机时间 关机时间
win7-sp1-x64-shaapp02-1 win7-sp1-x64-shaapp02-1 KVM 2022-05-27 19:09:26 2022-05-27 19:10:15
魔盾分数

0.625

正常的

文件详细信息

文件名 SeeyonOAGetShell.jar
文件大小 2831576 字节
文件类型 Java archive data (JAR)
CRC32 639B7869
MD5 398ea3a9ea702b2b9e6e4f261bd93263
SHA1 111e618e330619fe583d6dc54ecf310d01837b02
SHA256 66b9e4bae363c1c530b118ef1276ee96292f203d5287d9694fa6456e514541b1
SHA512 a8c5529e387ad54910c0f5daca8635069dd6976b750c0f563f91647aa5258ded81cb6f69aa506c0d01bc99359fbad9e38eb59462bbb22a7104d4bd35ce9dd5fb
Ssdeep 49152:QP6EO3u38H5m/TtZkZFiEgwosoKmDGJKtsmFsNIz:lBskZFiFWSsiz
PEiD 无匹配
Yara 无Yara规则匹配
VirusTotal VirusTotal查询失败

特征

可疑的样本异常终止
魔盾wping.org IP地址信誉系统
Greylist: 20.189.173.20

运行截图

网络分析

访问主机记录

直接访问 IP地址 国家名
否 20.189.173.20 United States

域名解析

域名 响应
watson.microsoft.com A 20.189.173.20
CNAME legacywatson.trafficmanager.net
CNAME onedsblobprdwus15.westus.cloudapp.azure.com

TCP连接

IP地址 端口
172.232.44.9 80

UDP连接

IP地址 端口
192.168.122.1 53
192.168.122.1 53

HTTP请求

URL HTTP数据
http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip 
GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1
Accept: */*
If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT
User-Agent: IPM
Host: acroipm.adobe.com
Connection: Keep-Alive
Cache-Control: no-cache

静态分析

投放文件

无信息

行为分析

互斥量(Mutexes) 无信息
执行的命令 无信息
创建的服务 无信息
启动的服务 无信息

进程

java.exe PID: 2388, 上一级进程 PID: 2240

访问的文件
  • C:\Users\test\AppData\Local\Temp\SeeyonOAGetShell.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\java.dll
  • C:\Windows\System32\tzres.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\i386\jvm.cfg
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\client\jvm.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\msvcr100.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\WSOCK32.dll
  • C:\Windows\System32\wsock32.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\WINMM.dll
  • C:\Windows\System32\winmm.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\VERSION.dll
  • C:\Windows\System32\version.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\verify.dll
  • C:\Users\test\AppData\Local\Temp\.hotspotrc
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\endorsed
  • C:\
  • C:\Users\test\AppData\Local\Temp\hsperfdata_test
  • C:\Users\test\AppData\Local\Temp\hsperfdata_test\2388
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\zip.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\resources.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\rt.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\sunrsasign.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\jsse.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\jce.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\charsets.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\jfr.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\classes
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\meta-index
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\client\classes.jsa
  • C:\Program Files (x86)
  • C:\Program Files (x86)\Java
  • C:\Program Files (x86)\Java\jre1.8.0_121
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib
  • C:\Users\test\AppData\Local\Temp\.hotspot_compiler
  • C:\Windows\sysnative\C_G18030.DLL
  • C:\Windows\Fonts\SimSun18030.ttc
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\meta-index
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext
  • C:\Windows\Sun\Java\lib\ext\meta-index
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\*
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\access-bridge-32.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\cldrdata.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\dnsns.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\jaccess.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\jfxrt.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\localedata.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\nashorn.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\sunec.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\sunjce_provider.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\sunmscapi.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\sunpkcs11.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\zipfs.jar
  • C:\Windows\Sun\Java\lib\ext
  • C:\Users
  • C:\Users\test
  • C:\Users\test\AppData
  • C:\Users\test\AppData\Local
  • C:\Users\test\AppData\Local\Temp
  • C:\Program Files (x86)\Java\conf\usagetracker.properties
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\management\usagetracker.properties
  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d8040.timestamp
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\security\java.security
  • C:\Users\test\AppData\Local\Temp\url.txt
  • C:\Windows\SysWOW64\zh-CN\KERNELBASE.dll.mui
读取的文件
  • C:\Users\test\AppData\Local\Temp\SeeyonOAGetShell.jar
  • C:\Windows\System32\tzres.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\i386\jvm.cfg
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\msvcr100.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\client\jvm.dll
  • C:\Windows\System32\wsock32.dll
  • C:\Windows\System32\winmm.dll
  • C:\Windows\System32\version.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\verify.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\java.dll
  • C:\Users\test\AppData\Local\Temp\hsperfdata_test\2388
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\zip.dll
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\meta-index
  • C:\Program Files (x86)\Java\jre1.8.0_121\bin\client\classes.jsa
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\rt.jar
  • C:\Windows\Fonts\SimSun18030.ttc
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\charsets.jar
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\ext\meta-index
  • C:\Program Files (x86)\Java\jre1.8.0_121\lib\security\java.security
  • C:\Users\test\AppData\Local\Temp\url.txt
  • C:\Windows\SysWOW64\zh-CN\KERNELBASE.dll.mui
修改的文件
  • C:\Users\test\AppData\Local\Temp\hsperfdata_test\2388
  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d8040.timestamp
删除的文件 无信息
注册表键
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Codepage
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\54936
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
读取的注册表键
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\54936
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
修改的注册表键 无信息
删除的注册表键 无信息
API解析
  • kernel32.dll.FlsAlloc
  • kernel32.dll.FlsGetValue
  • kernel32.dll.FlsSetValue
  • kernel32.dll.FlsFree
  • jvm.dll.JNI_CreateJavaVM
  • jvm.dll.JNI_GetDefaultJavaVMInitArgs
  • java.dll.JDK_GetVersionInfo0
  • advapi32.dll.SetSecurityDescriptorControl
  • zip.dll.ZIP_Open
  • zip.dll.ZIP_Close
  • zip.dll.ZIP_FindEntry
  • zip.dll.ZIP_ReadEntry
  • zip.dll.ZIP_GetNextEntry
  • zip.dll.ZIP_CRC32
  • java.dll.Canonicalize
  • java.dll._Java_java_lang_Object_registerNatives@8
  • java.dll._Java_java_lang_System_registerNatives@8
  • java.dll._Java_java_lang_Thread_registerNatives@8
  • java.dll._Java_java_security_AccessController_getStackAccessControlContext@8
  • java.dll._Java_java_security_AccessController_getInheritedAccessControlContext@8
  • java.dll._Java_java_lang_Class_registerNatives@8
  • java.dll._Java_java_lang_ClassLoader_registerNatives@8
  • java.dll._Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedAction_2@12
  • java.dll._Java_java_lang_Class_forName0@24
  • java.dll._Java_java_lang_Throwable_fillInStackTrace@12
  • java.dll._Java_sun_reflect_Reflection_getCallerClass__@8
  • java.dll._Java_java_lang_Class_getPrimitiveClass@12
  • java.dll._Java_java_lang_Float_floatToRawIntBits@12
  • java.dll._Java_java_lang_Double_doubleToRawLongBits@16
  • java.dll._Java_java_lang_Double_longBitsToDouble@16
  • java.dll._Java_sun_misc_VM_initialize@8
  • jvm.dll.JVM_GetVersionInfo
  • java.dll._Java_java_lang_System_initProperties@12
  • shell32.dll.SHGetKnownFolderPath
  • java.dll._Java_java_lang_String_intern@8
  • java.dll._Java_sun_reflect_Reflection_getClassAccessFlags@12
  • java.dll._Java_sun_reflect_NativeConstructorAccessorImpl_newInstance0@16
  • java.dll._Java_java_lang_Object_getClass@8
  • java.dll.NewStringPlatform
  • java.dll._Java_java_lang_Runtime_maxMemory@8
  • java.dll._Java_java_io_FileInputStream_initIDs@8
  • java.dll._Java_java_io_FileDescriptor_initIDs@8
  • java.dll._Java_java_io_FileDescriptor_set@12
  • java.dll._Java_java_io_FileOutputStream_initIDs@8
  • java.dll._Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedExceptionAction_2@12
  • java.dll._Java_java_lang_Class_isAssignableFrom@12
  • java.dll._Java_java_lang_System_setIn0@12
  • java.dll._Java_java_util_concurrent_atomic_AtomicLong_VMSupportsCS8@8
  • java.dll._Java_java_lang_System_setOut0@12
  • java.dll._Java_java_lang_System_setErr0@12
  • java.dll._Java_java_io_WinNTFileSystem_initIDs@8
  • kernel32.dll.GetFinalPathNameByHandleW
  • java.dll._Java_java_lang_System_mapLibraryName@12
  • java.dll._Java_java_lang_ClassLoader_findBuiltinLib@12
  • java.dll._Java_java_io_WinNTFileSystem_getBooleanAttributes@12
  • java.dll._Java_java_io_WinNTFileSystem_canonicalize0@12
  • java.dll._Java_java_lang_ClassLoader_00024NativeLibrary_load@16
  • java.dll._Java_sun_misc_Signal_findSignal@12
  • java.dll._Java_sun_misc_Signal_handle0@20
  • java.dll._Java_sun_io_Win32ErrorMode_setErrorMode@16
  • java.dll._Java_java_lang_Compiler_registerNatives@8
  • java.dll._Java_java_io_FileInputStream_open0@12
  • java.dll._Java_java_io_FileInputStream_readBytes@20
  • java.dll._Java_java_io_FileInputStream_available@8
  • java.dll._Java_java_lang_reflect_Array_newArray@16
  • java.dll._Java_java_lang_Runtime_availableProcessors@8
  • java.dll._Java_java_io_FileInputStream_close0@8
  • java.dll._Java_java_io_WinNTFileSystem_list@12
  • java.dll._Java_java_io_WinNTFileSystem_canonicalizeWithPrefix0@16
  • java.dll._Java_sun_misc_URLClassPath_getLookupCacheURLs@12
  • java.dll._Java_java_lang_ProcessEnvironment_environmentBlock@8
  • java.dll._Java_java_io_FileOutputStream_open0@16
  • java.dll._Java_java_io_FileOutputStream_writeBytes@24
  • java.dll._Java_java_io_FileOutputStream_close0@8
  • jvm.dll.JVM_FindClassFromBootLoader
  • java.dll._Java_java_lang_ClassLoader_00024NativeLibrary_find@12
  • zip.dll._Java_java_util_zip_ZipFile_initIDs@8
  • java.dll._Java_java_io_WinNTFileSystem_getLastModifiedTime@12
  • zip.dll._Java_java_util_zip_ZipFile_open@28
  • zip.dll._Java_java_util_zip_ZipFile_getTotal@16
  • zip.dll._Java_java_util_zip_ZipFile_startsWithLOC@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntry@24
  • zip.dll._Java_java_util_zip_ZipFile_getEntryFlag@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntryTime@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntryCrc@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntrySize@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntryCSize@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntryMethod@16
  • zip.dll._Java_java_util_zip_ZipFile_getEntryBytes@20
  • zip.dll._Java_java_util_zip_ZipFile_freeEntry@24
  • zip.dll._Java_java_util_zip_Inflater_initIDs@8
  • zip.dll._Java_java_util_zip_Inflater_init@12
  • zip.dll._Java_java_util_zip_Inflater_inflateBytes@28
  • zip.dll._Java_java_util_zip_ZipFile_read@44
  • zip.dll._Java_java_util_zip_Inflater_reset@16
  • zip.dll._Java_java_util_zip_Inflater_end@16
  • zip.dll._Java_java_util_zip_ZipFile_close@16
  • java.dll._Java_java_lang_ClassLoader_findLoadedClass0@12
  • java.dll._Java_java_lang_ClassLoader_findBootstrapClass@12
  • java.dll._Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedExceptionAction_2Ljava_security_AccessControlContext_2@16
  • java.dll._Java_java_lang_Package_getSystemPackage0@12
  • zip.dll._Java_java_util_jar_JarFile_getMetaInfEntryNames@8
  • java.dll._Java_sun_reflect_NativeMethodAccessorImpl_invoke0@20
  • java.dll._Java_java_lang_Class_isInstance@12
  • java.dll._Java_java_lang_ClassLoader_defineClass1@32
  • java.dll._Java_java_lang_System_identityHashCode@12
  • java.dll._Java_java_lang_Throwable_getStackTraceDepth@8
  • java.dll._Java_java_lang_Throwable_getStackTraceElement@12