Analysis

Category Package Started Completed Duration Log
PCAP 2018-12-20 13:08:22 2018-12-20 13:08:22 0 seconds Show Log

    

MalScore

0.0

Benign


Signatures

No signatures

Hosts

Direct IP Country Name
Y 8.250.33.254 [VT] United States
Y 40.90.220.60 [VT] United States
Y 23.214.174.91 [VT] Netherlands
Y 23.212.109.137 [VT] Netherlands
Y 2.19.56.218 [VT] Europe
Y 134.170.185.174 [VT] United States
Y fe80::5872:c4d9:e858:1c0a [VT] unknown
Y fe80::5ac:a2c7:eb8a:d6dd [VT] unknown
Y ff02::1:2 [VT] unknown

DNS

No domains contacted.


Hosts

Direct IP Country Name
Y 8.250.33.254 [VT] United States
Y 40.90.220.60 [VT] United States
Y 23.214.174.91 [VT] Netherlands
Y 23.212.109.137 [VT] Netherlands
Y 2.19.56.218 [VT] Europe
Y 134.170.185.174 [VT] United States
Y fe80::5872:c4d9:e858:1c0a [VT] unknown
Y fe80::5ac:a2c7:eb8a:d6dd [VT] unknown
Y ff02::1:2 [VT] unknown

TCP

Source Source Port Destination Destination Port
fe80::5ac:a2c7:eb8a:d6dd 2869 fe80::5872:c4d9:e858:1c0a 49160
192.168.56.152 49175 134.170.185.174 80
192.168.56.152 49172 2.19.56.218 80
192.168.56.152 49171 23.212.109.137 80
192.168.56.152 49173 23.214.174.91 80
192.168.56.152 49174 40.90.220.60 443
192.168.56.152 49170 8.250.33.254 80
192.168.56.153 49162 192.168.56.152 2869

UDP

Source Source Port Destination Destination Port
fe80::5872:c4d9:e858:1c0a 546 ff02::1:2 547

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

No JA3 hashes found.

Sorry! No dropped files.
Sorry! No CAPE files.
Sorry! No process dumps.

Comments



No comments posted

Processing ( 0.029 seconds )

  • 0.016 NetworkAnalysis
  • 0.009 AnalysisInfo
  • 0.002 BehaviorAnalysis
  • 0.002 Debug

Signatures ( 0.078 seconds )

  • 0.013 antiav_detectreg
  • 0.006 ransomware_files
  • 0.005 persistence_autorun
  • 0.005 antiav_detectfile
  • 0.005 infostealer_ftp
  • 0.005 ransomware_extensions
  • 0.004 infostealer_bitcoin
  • 0.003 browser_security
  • 0.003 infostealer_im
  • 0.002 tinba_behavior
  • 0.002 rat_nanocore
  • 0.002 cerber_behavior
  • 0.002 antianalysis_detectfile
  • 0.002 antianalysis_detectreg
  • 0.002 antivm_vbox_files
  • 0.002 geodo_banking_trojan
  • 0.002 disables_browser_warn
  • 0.002 infostealer_mail
  • 0.002 ie_martian_children
  • 0.001 betabot_behavior
  • 0.001 antivm_parallels_keys
  • 0.001 antivm_vbox_keys
  • 0.001 antivm_vmware_keys
  • 0.001 banker_zeus_mutex
  • 0.001 bot_drive
  • 0.001 bot_drive2
  • 0.001 browser_addon
  • 0.001 modify_uac_prompt

Reporting ( 0.0 seconds )

Task ID 27841
Mongo ID 5c1b944bf284880509d970eb
Cuckoo release 1.3-CAPE
Delete