IOC Report
ekstre_pdf.exe

loading gif

Files

File Path
Type
Category
Malicious
ekstre_pdf.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\aut46DF.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut471E.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut5110.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut5150.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\extrorsal
Unicode text, UTF-8 text, with very long lines (29698), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\shrugged
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\ekstre_pdf.exe
C:\Users\user\Desktop\ekstre_pdf.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
C:\Users\user\Desktop\ekstre_pdf.exe
 malicious
C:\Users\user\Desktop\ekstre_pdf.exe
C:\Users\user\Desktop\ekstre_pdf.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
C:\Users\user\Desktop\ekstre_pdf.exe
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
https://api.ipify.org
unknown
http://crl.pki.goog/gsr1/gsr1.crl0;
unknown
https://account.dyn.com/
unknown
http://crl.pki.goog/gtsr1/gtsr1.crl0W
unknown
http://pki.goog/gsr1/gsr1.crt02
unknown
https://pki.goog/repository/0
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://smtp.gmail.com
unknown
smtp.gmail.com
http://crls.pki.goog/gts1c3/fVJxbV-Ktmk.crl0
unknown
http://pki.goog/repo/certs/gts1c3.der0
unknown
http://pki.goog/repo/certs/gtsr1.der04
unknown
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
api.ipify.org
104.26.13.205
smtp.gmail.com
142.251.16.108

IPs

IP
Domain
Country
Malicious
104.26.13.205
api.ipify.org
United States
142.251.16.108
smtp.gmail.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2770000
heap
page read and write
 malicious
5310000
trusted library section
page read and write
 malicious
1990000
direct allocation
page read and write
 malicious
17B0000
direct allocation
page read and write
 malicious
5170000
trusted library section
page read and write
 malicious
400000
system
page execute and read and write
 malicious
2C7C000
trusted library allocation
page read and write
 malicious
DE0000
heap
page read and write
58AE000
stack
page read and write
114E000
heap
page read and write
576C000
stack
page read and write
8AF9000
trusted library allocation
page read and write
691F000
stack
page read and write
C10000
heap
page read and write
3109000
trusted library allocation
page read and write
380E000
direct allocation
page read and write
19E0000
heap
page read and write
2CD5000
trusted library allocation
page read and write
285000
unkown
page readonly
BB6000
heap
page read and write
25F000
unkown
page readonly
E5F000
heap
page read and write
3670000
direct allocation
page read and write
28F000
unkown
page write copy
2C74000
trusted library allocation
page read and write
9B1E000
stack
page read and write
10DA000
heap
page read and write
C15000
heap
page read and write
701A000
heap
page read and write
379D000
direct allocation
page read and write
3670000
direct allocation
page read and write
2AF2000
trusted library allocation
page read and write
695E000
stack
page read and write
114E000
heap
page read and write
11BB000
heap
page read and write
379D000
direct allocation
page read and write
2880000
heap
page read and write
1258000
heap
page read and write
125A000
heap
page read and write
3670000
direct allocation
page read and write
2AD0000
trusted library allocation
page read and write
114E000
heap
page read and write
3202000
trusted library allocation
page read and write
10DD000
heap
page read and write
1249000
heap
page read and write
3E9E000
trusted library allocation
page read and write
2867000
heap
page read and write
6A00000
trusted library allocation
page read and write
3D39000
direct allocation
page read and write
64F0000
trusted library allocation
page read and write
1090000
heap
page read and write
2DD2000
trusted library allocation
page read and write
179000
stack
page read and write
3E5E000
trusted library allocation
page read and write
35F3000
direct allocation
page read and write
3D5D000
trusted library allocation
page read and write
3CF8000
trusted library allocation
page read and write
2F3E000
trusted library allocation
page read and write
3134000
trusted library allocation
page read and write
2ACE000
stack
page read and write
2C63000
trusted library allocation
page read and write
3CD000
stack
page read and write
25F000
unkown
page readonly
35F3000
direct allocation
page read and write
65DE000
stack
page read and write
9DB000
stack
page read and write
28BA000
trusted library allocation
page execute and read and write
BD6000
heap
page read and write
6F50000
trusted library allocation
page read and write
5216000
heap
page read and write
28AD000
trusted library allocation
page execute and read and write
2C68000
trusted library allocation
page read and write
3F1E000
trusted library allocation
page read and write
60AC000
stack
page read and write
2894000
trusted library allocation
page read and write
3CB5000
trusted library allocation
page read and write
711E000
stack
page read and write
3DFE000
trusted library allocation
page read and write
3136000
trusted library allocation
page read and write
363E000
stack
page read and write
69F0000
trusted library allocation
page execute and read and write
1269000
heap
page read and write
ADE000
heap
page read and write
379D000
direct allocation
page read and write
6620000
trusted library allocation
page execute and read and write
35F3000
direct allocation
page read and write
5370000
trusted library allocation
page read and write
1D1000
unkown
page execute read
103E000
stack
page read and write
315A000
trusted library allocation
page read and write
3D7D000
trusted library allocation
page read and write
2C70000
trusted library allocation
page read and write
3C10000
direct allocation
page read and write
5390000
heap
page read and write
2AE0000
trusted library allocation
page read and write
10EB000
heap
page read and write
2CE9000
trusted library allocation
page read and write
25F000
unkown
page readonly
1279000
heap
page read and write
34D0000
direct allocation
page read and write
648E000
stack
page read and write
16DF000
stack
page read and write
1780000
heap
page read and write
2A00000
heap
page read and write
3F83000
trusted library allocation
page read and write
A18000
heap
page read and write
2FE3000
trusted library allocation
page read and write
6B5C000
heap
page read and write
285000
unkown
page readonly
293000
unkown
page write copy
320C000
trusted library allocation
page read and write
8030000
heap
page read and write
34D0000
direct allocation
page read and write
320000
heap
page read and write
2B20000
heap
page execute and read and write
380E000
direct allocation
page read and write
69A0000
trusted library allocation
page read and write
298000
unkown
page readonly
3E1E000
trusted library allocation
page read and write
1D0000
unkown
page readonly
5200000
heap
page execute and read and write
3184000
heap
page read and write
35F3000
direct allocation
page read and write
3799000
direct allocation
page read and write
380E000
direct allocation
page read and write
5286000
heap
page read and write
BE7000
heap
page read and write
A4E000
heap
page read and write
34D0000
direct allocation
page read and write
285000
unkown
page readonly
3799000
direct allocation
page read and write
320A000
trusted library allocation
page read and write
3D3D000
trusted library allocation
page read and write
380E000
direct allocation
page read and write
293000
unkown
page write copy
4D2D000
stack
page read and write
C5C000
stack
page read and write
58B0000
trusted library allocation
page read and write
A9D000
heap
page read and write
64E0000
trusted library allocation
page execute and read and write
51D0000
trusted library allocation
page read and write
BB6000
heap
page read and write
31B1000
trusted library allocation
page read and write
29F0000
trusted library allocation
page read and write
1A90000
heap
page read and write
2FB8000
trusted library allocation
page read and write
17A0000
direct allocation
page execute and read and write
6A20000
heap
page read and write
5212000
heap
page read and write
5230000
heap
page read and write
E0D000
heap
page read and write
380E000
direct allocation
page read and write
B10000
heap
page read and write
379D000
direct allocation
page read and write
2CE5000
trusted library allocation
page read and write
3C95000
trusted library allocation
page read and write
6F0D000
stack
page read and write
64C0000
trusted library allocation
page read and write
679C000
unkown
page read and write
55CC000
stack
page read and write
28B2000
trusted library allocation
page read and write
379D000
direct allocation
page read and write
521E000
heap
page read and write
64F7000
trusted library allocation
page read and write
DB8000
heap
page read and write
127A000
heap
page read and write
2F13000
trusted library allocation
page read and write
572E000
stack
page read and write
7AA000
stack
page read and write
1800000
heap
page read and write
3799000
direct allocation
page read and write
28C2000
trusted library allocation
page read and write
3799000
direct allocation
page read and write
BE6000
heap
page read and write
ABE000
heap
page read and write
3D3D000
direct allocation
page read and write
28B6000
trusted library allocation
page execute and read and write
9DE000
stack
page read and write
3011000
trusted library allocation
page read and write
5273000
heap
page read and write
A10000
heap
page read and write
3009000
trusted library allocation
page read and write
634F000
stack
page read and write
1980000
direct allocation
page execute and read and write
A4E000
heap
page read and write
51E0000
trusted library allocation
page read and write
28B0000
trusted library allocation
page read and write
114E000
heap
page read and write
990000
heap
page read and write
114F000
heap
page read and write
1D0000
unkown
page readonly
D5C000
stack
page read and write
3FC3000
trusted library allocation
page read and write
8AF6000
trusted library allocation
page read and write
379D000
direct allocation
page read and write
28CB000
trusted library allocation
page execute and read and write
3D3D000
direct allocation
page read and write
3A70000
direct allocation
page read and write
2B01000
trusted library allocation
page read and write
2948000
trusted library allocation
page read and write
9FC000
stack
page read and write
3DAE000
direct allocation
page read and write
6B1F000
heap
page read and write
2930000
heap
page read and write
298000
unkown
page readonly
6F4B000
stack
page read and write
3F3E000
trusted library allocation
page read and write
285000
unkown
page readonly
638E000
stack
page read and write
64C4000
trusted library allocation
page read and write
6BA7000
heap
page read and write
7010000
heap
page read and write
3F63000
trusted library allocation
page read and write
289D000
trusted library allocation
page execute and read and write
2CE1000
trusted library allocation
page read and write
3670000
direct allocation
page read and write
2E1F000
trusted library allocation
page read and write
3799000
direct allocation
page read and write
ABE000
heap
page read and write
116E000
heap
page read and write
2B06000
trusted library allocation
page read and write
BF0000
heap
page read and write
BC6000
heap
page read and write
30B6000
trusted library allocation
page read and write
19E4000
heap
page read and write
2CAC000
trusted library allocation
page read and write
28C0000
trusted library allocation
page read and write
10D2000
heap
page read and write
69E0000
heap
page read and write
54CC000
stack
page read and write
35F3000
direct allocation
page read and write
1D1000
unkown
page execute read
29E0000
trusted library allocation
page execute and read and write
28A0000
trusted library allocation
page read and write
10DD000
heap
page read and write
3EFE000
trusted library allocation
page read and write
3C10000
direct allocation
page read and write
10A0000
heap
page read and write
FAC000
stack
page read and write
28F000
unkown
page read and write
653D000
stack
page read and write
2A04000
heap
page read and write
DA0000
trusted library section
page read and write
3EDE000
trusted library allocation
page read and write
3CCD000
trusted library allocation
page read and write
5210000
heap
page read and write
6AE0000
heap
page read and write
60C0000
trusted library allocation
page execute and read and write
689C000
stack
page read and write
3EBE000
trusted library allocation
page read and write
25F000
unkown
page readonly
9BF000
stack
page read and write
2AEE000
trusted library allocation
page read and write
6F60000
heap
page read and write
950000
heap
page read and write
2F64000
trusted library allocation
page read and write
ABE000
heap
page read and write
31DC000
trusted library allocation
page read and write
7EEC0000
trusted library allocation
page execute and read and write
3B93000
direct allocation
page read and write
DB0000
heap
page read and write
2893000
trusted library allocation
page execute and read and write
2EC6000
trusted library allocation
page read and write
2A7C000
stack
page read and write
2860000
heap
page read and write
3FE3000
trusted library allocation
page read and write
38E000
stack
page read and write
1D1000
unkown
page execute read
A41000
heap
page read and write
114E000
heap
page read and write
1259000
heap
page read and write
3065000
trusted library allocation
page read and write
2CF1000
trusted library allocation
page read and write
3A70000
direct allocation
page read and write
624E000
stack
page read and write
112C000
heap
page read and write
3E7E000
trusted library allocation
page read and write
298000
unkown
page readonly
313A000
trusted library allocation
page read and write
5FAC000
stack
page read and write
DEC000
heap
page read and write
D9C000
stack
page read and write
8020000
heap
page read and write
292E000
stack
page read and write
2B0D000
trusted library allocation
page read and write
2F6C000
trusted library allocation
page read and write
5F6C000
stack
page read and write
9E0000
heap
page read and write
2850000
trusted library section
page read and write
1D0000
unkown
page readonly
3017000
trusted library allocation
page read and write
3180000
heap
page read and write
3E62000
trusted library allocation
page read and write
BC5000
heap
page read and write
6540000
trusted library allocation
page read and write
A4E000
heap
page read and write
2FF0000
trusted library allocation
page read and write
562E000
stack
page read and write
28F000
unkown
page write copy
446000
system
page execute and read and write
ABE000
heap
page read and write
BC7000
heap
page read and write
FFC000
stack
page read and write
10D3000
heap
page read and write
3DDE000
trusted library allocation
page read and write
2A30000
heap
page read and write
2A10000
heap
page read and write
3E3E000
trusted library allocation
page read and write
34D0000
direct allocation
page read and write
35F3000
direct allocation
page read and write
1D0000
unkown
page readonly
12DD000
stack
page read and write
3670000
direct allocation
page read and write
8AFE000
trusted library allocation
page read and write
2C78000
trusted library allocation
page read and write
3FA3000
trusted library allocation
page read and write
28C7000
trusted library allocation
page execute and read and write
2FE5000
trusted library allocation
page read and write
AF8000
stack
page read and write
FCF000
stack
page read and write
6546000
trusted library allocation
page read and write
1249000
heap
page read and write
2890000
trusted library allocation
page read and write
34D0000
direct allocation
page read and write
3799000
direct allocation
page read and write
60B0000
heap
page read and write
3670000
direct allocation
page read and write
6E0C000
stack
page read and write
330000
heap
page read and write
2AEB000
trusted library allocation
page read and write
114E000
heap
page read and write
28A3000
trusted library allocation
page read and write
3B93000
direct allocation
page read and write
6B63000
heap
page read and write
57AE000
unkown
page read and write
DE9000
heap
page read and write
34D0000
direct allocation
page read and write
3C75000
trusted library allocation
page read and write
68DE000
stack
page read and write
919000
stack
page read and write
5302000
heap
page read and write
2C2F000
stack
page read and write
3DAE000
direct allocation
page read and write
10DA000
heap
page read and write
7120000
trusted library allocation
page read and write
3C55000
trusted library allocation
page read and write
58BD000
trusted library allocation
page read and write
10A8000
heap
page read and write
196F000
stack
page read and write
ABF000
heap
page read and write
BC6000
heap
page read and write
3090000
trusted library allocation
page read and write
28C5000
trusted library allocation
page execute and read and write
BE7000
heap
page read and write
28E0000
trusted library allocation
page read and write
9CE000
stack
page read and write
1D1000
unkown
page execute read
2CED000
trusted library allocation
page read and write
64D0000
trusted library allocation
page read and write
2DB1000
trusted library allocation
page read and write
BE7000
heap
page read and write
28F000
unkown
page read and write
2AFE000
trusted library allocation
page read and write
ABE000
heap
page read and write
FBF000
stack
page read and write
120D000
heap
page read and write
516E000
stack
page read and write
FDB000
stack
page read and write
E26000
heap
page read and write
3DBD000
trusted library allocation
page read and write
298000
unkown
page readonly
3D9D000
trusted library allocation
page read and write
6F70000
trusted library allocation
page read and write
2870000
trusted library allocation
page read and write
E17000
heap
page read and write
340000
heap
page read and write
2E6B000
trusted library allocation
page read and write
127A000
heap
page read and write
B2B000
heap
page read and write
3C31000
trusted library allocation
page read and write
2C31000
trusted library allocation
page read and write
69B0000
trusted library allocation
page read and write
521A000
heap
page read and write
3D39000
direct allocation
page read and write
380E000
direct allocation
page read and write
BE7000
heap
page read and write
2A36000
heap
page read and write
There are 377 hidden memdumps, click here to show them.