IOC Report
file -pdf.exe

loading gif

Files

File Path
Type
Category
Malicious
file -pdf.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\file -pdf.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tfdqpxy.t3l.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_41fidajs.xs1.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nxjflvyy.mfz.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vzuwvbmn.prg.psm1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file -pdf.exe
"C:\Users\user\Desktop\file -pdf.exe"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\file -pdf.exe"
 malicious
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2004 -s 12

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
https://github.com/Deathmax/Chest-Control/raw/master/version.txt
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://account.dyn.com/
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
https://api.ipify.org
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
There are 19 hidden URLs, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1415E000
trusted library allocation
page read and write
 malicious
1F340000
heap
page read and write
 malicious
B90000
heap
page read and write
1EF1E000
stack
page read and write
7FFD9B7BC000
trusted library allocation
page execute and read and write
138D000
heap
page read and write
1CC95000
heap
page read and write
2010E000
stack
page read and write
14074000
trusted library allocation
page read and write
7FFD9B81C000
trusted library allocation
page execute and read and write
13F41000
trusted library allocation
page read and write
680A5FC000
stack
page read and write
14026000
trusted library allocation
page read and write
1D0B0000
heap
page read and write
1D0F0000
heap
page read and write
ADC000
unkown
page readonly
7FFD9B810000
trusted library allocation
page read and write
3F41000
trusted library allocation
page read and write
7FFD9B846000
trusted library allocation
page execute and read and write
1610000
heap
page read and write
1E6A0000
trusted library section
page read and write
3A70000
heap
page execute and read and write
39A0000
heap
page read and write
13A2000
heap
page read and write
1265000
heap
page read and write
3F3F000
stack
page read and write
1379000
heap
page read and write
1E1E000
stack
page read and write
7FFD9B920000
trusted library allocation
page read and write
7FFD9B90C000
trusted library allocation
page read and write
1CBA0000
heap
page read and write
7FFD9B77D000
trusted library allocation
page execute and read and write
1D0A0000
heap
page read and write
1E5A0000
heap
page read and write
7FFD9B950000
trusted library allocation
page read and write
BB0000
heap
page read and write
1F320000
heap
page read and write
1F8CE000
stack
page read and write
1A1E000
stack
page read and write
7FFD9B936000
trusted library allocation
page read and write
7FFD9B930000
trusted library allocation
page read and write
3AA0000
heap
page read and write
13FD8000
trusted library allocation
page read and write
2050F000
stack
page read and write
7FFD9B764000
trusted library allocation
page read and write
1EB1D000
stack
page read and write
7FFD9B780000
trusted library allocation
page read and write
3A30000
trusted library section
page read and write
12B0000
heap
page read and write
4372000
trusted library allocation
page read and write
13F51000
trusted library allocation
page read and write
3950000
trusted library section
page readonly
131E000
heap
page read and write
1D105000
heap
page read and write
A30000
unkown
page readonly
1F326000
heap
page read and write
13F48000
trusted library allocation
page read and write
1E1A0000
trusted library allocation
page read and write
3F85000
trusted library allocation
page read and write
2090B000
stack
page read and write
1D0DC000
heap
page read and write
131C000
heap
page read and write
7FFD9B880000
trusted library allocation
page execute and read and write
1FD0F000
stack
page read and write
3A80000
trusted library section
page read and write
1E1C2000
trusted library allocation
page read and write
1200000
trusted library allocation
page read and write
7FFD9B770000
trusted library allocation
page read and write
3AA3000
heap
page read and write
B60000
heap
page read and write
7FFD9B816000
trusted library allocation
page read and write
3839000
heap
page read and write
A32000
unkown
page readonly
7FFD9B940000
trusted library allocation
page read and write
1615000
heap
page read and write
221F000
stack
page read and write
7FFD9B76D000
trusted library allocation
page execute and read and write
12E2000
heap
page read and write
12BC000
heap
page read and write
12F4000
heap
page read and write
12F1000
heap
page read and write
1290000
heap
page read and write
1324000
heap
page read and write
11F2000
stack
page read and write
7FFD9B78D000
trusted library allocation
page execute and read and write
3A90000
trusted library allocation
page read and write
7FFD9B78B000
trusted library allocation
page execute and read and write
7FF443A60000
trusted library allocation
page execute and read and write
1220000
trusted library allocation
page read and write
1F31D000
stack
page read and write
7FFD9B910000
trusted library allocation
page execute and read and write
1C6BC000
stack
page read and write
B70000
heap
page read and write
7FFD9B900000
trusted library allocation
page read and write
7FFD9B772000
trusted library allocation
page read and write
3B30000
heap
page execute and read and write
3A50000
trusted library section
page read and write
7FFD9B933000
trusted library allocation
page read and write
1BF70000
trusted library allocation
page read and write
7FFD9B763000
trusted library allocation
page execute and read and write
7FFD9B820000
trusted library allocation
page execute and read and write
7FFD9B760000
trusted library allocation
page read and write
12B6000
heap
page read and write
1D0CB000
heap
page read and write
1CC90000
heap
page read and write
1D0E3000
heap
page read and write
1D09C000
stack
page read and write
1260000
heap
page read and write
1F331000
heap
page read and write
3960000
heap
page read and write
7FFD9B784000
trusted library allocation
page read and write
There are 101 hidden memdumps, click here to show them.