IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
C:\Users\user\AppData\Local\Temp\IXP000.TMP\bxskiicciwd.bat
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\IXP000.TMP\ekkmphakhofgs.iiun
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\IXP000.TMP\ekkmphakhofir.iiun
Matlab v4 mat-file (little endian) , rows 4, columns 65535, imaginary
dropped
C:\Users\user\AppData\Local\Temp\IXP000.TMP\ekkmphakhofox.iiun
Non-ISO extended-ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\IXP000.TMP\ekkmphakhofqv.iiun
data
dropped
C:\Users\user\AppData\Local\Temp\IXP000.TMP\fopholde.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\IXP000.TMP\gufcrfmk.iiun
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\IXP000.TMP\lfssylb.iiun
ASCII text, with very long lines (65536), with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /d /c bxskiicciwd.bat 342745396
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Users\user\AppData\Local\Temp\IXP000.TMP\fopholde.exe
fopholde.exe lfssylb.iiun 342745396
C:\Windows\System32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"

URLs

Name
IP
Malicious
http://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
unknown
http://insanecoding.blogspot.com/2007/11/pathmax-simply-isnt.html
unknown
https://github.com/joyent/node/issues/1707
unknown
https://github.com/joyent/node/issues/3295.
unknown
http://nodejs.org/
unknown
https://github.com/joyent/node/issues/1726
unknown
http://stackoverflow.com/a/5501711/3561
unknown
http://daniel.haxx.se/blog/2011/02/21/localhost-hack-on-windows/
unknown
http://www.midnight-commander.org/browser/lib/tty/key.c
unknown
http://www.ecma-international.org/publications/standards/Ecma-262.htm)
unknown
http://www.squid-cache.org/Doc/config/half_closed_clients/
unknown
http://code.google.com/p/v8/wiki/DebuggerProtocol
unknown
http://www.3waylabs.com/nw/WWW/products/wizcon/vt220.html
unknown
http://narwhaljs.org)
unknown
http://tools.ietf.org/html/rfc3492#section-3.4
unknown
http://www.openssl.org/support/faq.html
unknown
http://invisible-island.net/xterm/ctlseqs/ctlseqs.html
unknown
https://code.google.com/p/chromium/issues/detail?id=25916
unknown
https://codereview.chromium.org/121173009/
unknown
http://mths.be/punycode
unknown
https://github.com/isaacs/readable-stream/issues/16
unknown
http://wiki.commonjs.org/wiki/Unit_Testing/1.0
unknown
http://foo.com
unknown
https://github.com/antirez/linenoise
unknown
https://groups.google.com/forum/?pli=1#
unknown
http://pod.tst.eu/http://cvs.schmorp.de/libev/ev.pod#Be_smart_about_timeouts
unknown
http://mathiasbynens.be/notes/javascript-encoding
unknown
https://github.com/joyent/node/issues/2631
unknown
There are 18 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
wextract_cleanup0

Memdumps

Base Address
Regiontype
Protect
Malicious
198C000
heap
page read and write
391D000
heap
page read and write
391D000
heap
page read and write
3653000
heap
page read and write
3651000
heap
page read and write
364E000
heap
page read and write
D58000
unkown
page write copy
1A28000
heap
page read and write
35F1000
heap
page read and write
19A5000
heap
page read and write
24408000
direct allocation
page read and write
19F4000
heap
page read and write
4430000
heap
page read and write
1435000
unkown
page readonly
3BF0000
heap
page read and write
19A6000
heap
page read and write
3651000
heap
page read and write
2104AB10000
heap
page read and write
391D000
heap
page read and write
193A000
heap
page read and write
2104A810000
heap
page read and write
3651000
heap
page read and write
35CC000
heap
page read and write
35CC000
heap
page read and write
1A0A000
heap
page read and write
1C00000
heap
page read and write
35D0000
heap
page read and write
34B4000
heap
page read and write
34B4000
heap
page read and write
3646000
heap
page read and write
3646000
heap
page read and write
1A28000
heap
page read and write
19CF000
heap
page read and write
1A12000
heap
page read and write
35C1000
heap
page read and write
3646000
heap
page read and write
35B1000
heap
page read and write
D50000
unkown
page readonly
3AAE000
stack
page read and write
35B1000
heap
page read and write
3641000
heap
page read and write
198C000
heap
page read and write
35B1000
heap
page read and write
1A0A000
heap
page read and write
19A5000
heap
page read and write
3651000
heap
page read and write
19A5000
heap
page read and write
3651000
heap
page read and write
19CD000
heap
page read and write
1994000
heap
page read and write
1FA08000
direct allocation
page read and write
199A000
heap
page read and write
3646000
heap
page read and write
35C5000
heap
page read and write
1989000
heap
page read and write
3651000
heap
page read and write
3FB6000
heap
page read and write
36A4000
heap
page read and write
198C000
heap
page read and write
44C6000
heap
page read and write
40E08000
direct allocation
page read and write
19A6000
heap
page read and write
27108000
direct allocation
page read and write
2104A83E000
heap
page read and write
63D6000
direct allocation
page read and write
198C000
heap
page read and write
3C11000
heap
page read and write
35CE000
heap
page read and write
19CD000
heap
page read and write
391D000
heap
page read and write
1A2C000
heap
page read and write
4A22000
heap
page read and write
1989000
heap
page read and write
19CD000
heap
page read and write
D5A000
unkown
page readonly
19A8000
heap
page read and write
35B1000
heap
page read and write
37E3000
heap
page read and write
19A6000
heap
page read and write
35CC000
heap
page read and write
3C33000
heap
page read and write
35CC000
heap
page read and write
1999000
heap
page read and write
35B1000
heap
page read and write
2CB08000
direct allocation
page read and write
3BB0000
heap
page read and write
660A000
direct allocation
page execute and read and write
1A17000
heap
page read and write
1A17000
heap
page read and write
198A000
heap
page read and write
40608000
direct allocation
page read and write
19CE000
heap
page read and write
1A17000
heap
page read and write
1A0F000
heap
page read and write
391C000
heap
page read and write
1A17000
heap
page read and write
35CC000
heap
page read and write
1989000
heap
page read and write
35CA000
heap
page read and write
1A28000
heap
page read and write
183E000
stack
page read and write
19F0000
heap
page read and write
1989000
heap
page read and write
317C000
stack
page read and write
1DF00000
direct allocation
page execute read
3651000
heap
page read and write
2104A837000
heap
page read and write
35BD000
heap
page read and write
1989000
heap
page read and write
198C000
heap
page read and write
35CE000
heap
page read and write
198A000
heap
page read and write
1A15000
heap
page read and write
3651000
heap
page read and write
1580000
heap
page read and write
1A29000
heap
page read and write
19A0000
heap
page read and write
1A2E000
heap
page read and write
3651000
heap
page read and write
35BC000
heap
page read and write
391D000
heap
page read and write
1887000
heap
page read and write
EBC000
stack
page read and write
35CC000
heap
page read and write
36BD000
heap
page read and write
35B1000
heap
page read and write
391D000
heap
page read and write
35C5000
heap
page read and write
35C5000
heap
page read and write
391D000
heap
page read and write
45DE000
heap
page read and write
1989000
heap
page read and write
1989000
heap
page read and write
198C000
heap
page read and write
D5C000
unkown
page readonly
D308000
direct allocation
page read and write
35CE000
heap
page read and write
19A6000
heap
page read and write
19CF000
heap
page read and write
19A6000
heap
page read and write
36A7000
heap
page read and write
35CC000
heap
page read and write
35BD000
heap
page read and write
40708000
direct allocation
page read and write
391D000
heap
page read and write
1A17000
heap
page read and write
198C000
heap
page read and write
19F3000
heap
page read and write
370E000
stack
page read and write
19F0000
heap
page read and write
35F1000
heap
page read and write
19CF000
heap
page read and write
35D0000
heap
page read and write
35CC000
heap
page read and write
19A4000
heap
page read and write
19A6000
heap
page read and write
35C5000
heap
page read and write
3BB1000
heap
page read and write
35CC000
heap
page read and write
19CD000
heap
page read and write
35B1000
heap
page read and write
19F2000
heap
page read and write
14408000
direct allocation
page read and write
1989000
heap
page read and write
1A15000
heap
page read and write
1A2A000
heap
page read and write
1A17000
heap
page read and write
19A6000
heap
page read and write
3646000
heap
page read and write
1434000
unkown
page read and write
35B1000
heap
page read and write
222967E000
stack
page read and write
1A14000
heap
page read and write
198B000
heap
page read and write
1989000
heap
page read and write
35D0000
heap
page read and write
35CC000
heap
page read and write
5250000
heap
page read and write
34708000
direct allocation
page read and write
1A17000
heap
page read and write
1989000
heap
page read and write
198C000
heap
page read and write
222977F000
stack
page read and write
3430000
heap
page read and write
1996000
heap
page read and write
2104A7F0000
heap
page read and write
3BAF000
stack
page read and write
35B1000
heap
page read and write
1A17000
heap
page read and write
35B1000
heap
page read and write
1422000
unkown
page read and write
48A8000
heap
page read and write
1997000
heap
page read and write
19A0000
heap
page read and write
19F0000
heap
page read and write
1989000
heap
page read and write
3653000
heap
page read and write
35B1000
heap
page read and write
19A6000
heap
page read and write
35B1000
heap
page read and write
198B000
heap
page read and write
35EF000
heap
page read and write
19CF000
heap
page read and write
35B4000
heap
page read and write
35CE000
heap
page read and write
222939C000
stack
page read and write
19F0000
heap
page read and write
491E000
heap
page read and write
35CE000
heap
page read and write
1A17000
heap
page read and write
1262000
unkown
page readonly
19A0000
heap
page read and write
35CE000
heap
page read and write
3899000
heap
page read and write
1989000
heap
page read and write
35C6000
heap
page read and write
43AF000
heap
page read and write
1A1D000
heap
page read and write
1887000
heap
page read and write
19F0000
heap
page read and write
35F1000
heap
page read and write
2104AB15000
heap
page read and write
1997000
heap
page read and write
35CE000
heap
page read and write
1989000
heap
page read and write
D51000
unkown
page execute read
1435000
unkown
page readonly
35B1000
heap
page read and write
35D0000
heap
page read and write
35C5000
heap
page read and write
19CF000
heap
page read and write
2F80A000
direct allocation
page execute and read and write
F31000
unkown
page execute read
35CE000
heap
page read and write
35CC000
heap
page read and write
199F000
heap
page read and write
19A0000
heap
page read and write
35CC000
heap
page read and write
35CB000
heap
page read and write
35C1000
heap
page read and write
35CE000
heap
page read and write
142B000
unkown
page write copy
19A6000
heap
page read and write
3898000
heap
page read and write
35CC000
heap
page read and write
19A6000
heap
page read and write
35BC000
heap
page read and write
3420000
heap
page read and write
CA0A000
direct allocation
page execute and read and write
40508000
direct allocation
page read and write
19A6000
heap
page read and write
391D000
heap
page read and write
1A17000
heap
page read and write
19CD000
heap
page read and write
1A17000
heap
page read and write
35B1000
heap
page read and write
19F0000
heap
page read and write
19A8000
heap
page read and write
35C5000
heap
page read and write
19F0000
heap
page read and write
1A2E000
heap
page read and write
199F000
heap
page read and write
31BC000
stack
page read and write
1A28000
heap
page read and write
3A6F000
stack
page read and write
38DA000
heap
page read and write
19CD000
heap
page read and write
36A4000
heap
page read and write
2CF08000
direct allocation
page read and write
35BD000
heap
page read and write
36B6000
heap
page read and write
1A17000
heap
page read and write
36A4000
heap
page read and write
35CC000
heap
page read and write
35CA000
heap
page read and write
1A2E000
heap
page read and write
2CD00000
direct allocation
page execute read
19F0000
heap
page read and write
198B000
heap
page read and write
3440000
heap
page read and write
1989000
heap
page read and write
F30000
unkown
page readonly
391D000
heap
page read and write
35CC000
heap
page read and write
35CE000
heap
page read and write
34A0000
heap
page read and write
19F0000
heap
page read and write
19A6000
heap
page read and write
19A6000
heap
page read and write
377E000
heap
page read and write
3646000
heap
page read and write
19CF000
heap
page read and write
19A6000
heap
page read and write
19A6000
heap
page read and write
1989000
heap
page read and write
35B1000
heap
page read and write
35BD000
heap
page read and write
35B1000
heap
page read and write
156E000
stack
page read and write
2104A710000
heap
page read and write
3646000
heap
page read and write
19CD000
heap
page read and write
40408000
direct allocation
page read and write
35CE000
heap
page read and write
374E000
stack
page read and write
35CE000
heap
page read and write
3925000
heap
page read and write
3770000
heap
page read and write
15EE000
stack
page read and write
19A6000
heap
page read and write
F31000
unkown
page execute read
377B000
heap
page read and write
190E000
stack
page read and write
35CC000
heap
page read and write
35CE000
heap
page read and write
198B000
heap
page read and write
35CC000
heap
page read and write
27A08000
direct allocation
page read and write
1989000
heap
page read and write
F30000
unkown
page readonly
2104C160000
heap
page read and write
198A000
heap
page read and write
35B1000
heap
page read and write
35CC000
heap
page read and write
35D0000
heap
page read and write
198B000
heap
page read and write
46EF000
heap
page read and write
1989000
heap
page read and write
3651000
heap
page read and write
35C5000
heap
page read and write
35300000
direct allocation
page execute read
36B0000
trusted library allocation
page read and write
35CE000
heap
page read and write
63FB000
direct allocation
page read and write
1A17000
heap
page read and write
199A000
heap
page read and write
1989000
heap
page read and write
3646000
heap
page read and write
199A000
heap
page read and write
35C6000
heap
page read and write
35CC000
heap
page read and write
40FB000
heap
page read and write
35D0000
heap
page read and write
35CC000
heap
page read and write
1ED08000
direct allocation
page read and write
3BB1000
heap
page read and write
1A17000
heap
page read and write
1998000
heap
page read and write
35C5000
heap
page read and write
3646000
heap
page read and write
1A0B000
heap
page read and write
1A17000
heap
page read and write
3855000
heap
page read and write
3646000
heap
page read and write
35CC000
heap
page read and write
1A0B000
heap
page read and write
19A8000
heap
page read and write
45F1000
heap
page read and write
35CE000
heap
page read and write
19A5000
heap
page read and write
1A17000
heap
page read and write
364D000
heap
page read and write
1989000
heap
page read and write
17100000
direct allocation
page execute read
35C5000
heap
page read and write
35C6000
heap
page read and write
391E000
heap
page read and write
1A17000
heap
page read and write
1A17000
heap
page read and write
1422000
unkown
page write copy
198B000
heap
page read and write
1989000
heap
page read and write
393C000
heap
page read and write
37E08000
direct allocation
page read and write
35B1000
heap
page read and write
1998000
heap
page read and write
19F3000
heap
page read and write
1A10000
heap
page read and write
19A6000
heap
page read and write
3646000
heap
page read and write
1A28000
heap
page read and write
35BD000
heap
page read and write
35CC000
heap
page read and write
35F1000
heap
page read and write
35EF000
heap
page read and write
35C5000
heap
page read and write
1885000
heap
page read and write
1989000
heap
page read and write
D58000
unkown
page read and write
35EF000
heap
page read and write
35CE000
heap
page read and write
364E000
heap
page read and write
3651000
heap
page read and write
197C000
heap
page read and write
3857000
heap
page read and write
1A17000
heap
page read and write
391D000
heap
page read and write
1880000
heap
page read and write
19F0000
heap
page read and write
40F08000
direct allocation
page read and write
3646000
heap
page read and write
3BF2000
heap
page read and write
36CE000
stack
page read and write
2E708000
direct allocation
page read and write
38DA000
heap
page read and write
36A4000
heap
page read and write
198D000
heap
page read and write
1A0F000
heap
page read and write
1A2E000
heap
page read and write
1A2A000
heap
page read and write
19CD000
heap
page read and write
1997000
heap
page read and write
1A0F000
heap
page read and write
19CD000
heap
page read and write
1986000
heap
page read and write
35B1000
heap
page read and write
19CD000
heap
page read and write
35B1000
heap
page read and write
3C33000
heap
page read and write
3BF9000
heap
page read and write
35D0A000
direct allocation
page execute and read and write
3646000
heap
page read and write
D5A000
unkown
page readonly
19CD000
heap
page read and write
35F1000
heap
page read and write
1A2C000
heap
page read and write
F20000
heap
page read and write
198C000
heap
page read and write
14208000
direct allocation
page read and write
19A6000
heap
page read and write
35EF000
heap
page read and write
3935000
heap
page read and write
35CC000
heap
page read and write
35C0000
heap
page read and write
1840000
heap
page read and write
3774000
heap
page read and write
D5C000
unkown
page readonly
35C1000
heap
page read and write
34A0000
heap
page read and write
35C5000
heap
page read and write
1A0A000
heap
page read and write
35BF000
heap
page read and write
1A16000
heap
page read and write
4402000
heap
page read and write
3935000
heap
page read and write
19F3000
heap
page read and write
3651000
heap
page read and write
35C5000
heap
page read and write
19CD000
heap
page read and write
1989000
heap
page read and write
19A6000
heap
page read and write
3760000
heap
page read and write
35CC000
heap
page read and write
35CC000
heap
page read and write
3651000
heap
page read and write
35B1000
heap
page read and write
35F1000
heap
page read and write
1262000
unkown
page readonly
1989000
heap
page read and write
1989000
heap
page read and write
19AA000
heap
page read and write
3651000
heap
page read and write
35CE000
heap
page read and write
35C5000
heap
page read and write
1A0A000
heap
page read and write
35BD000
heap
page read and write
1A17000
heap
page read and write
19CD000
heap
page read and write
157B000
stack
page read and write
35EF000
heap
page read and write
35C5000
heap
page read and write
198B000
heap
page read and write
3C33000
heap
page read and write
1A17000
heap
page read and write
3651000
heap
page read and write
348B000
heap
page read and write
4537000
unkown
page read and write
6308000
direct allocation
page read and write
429E000
heap
page read and write
19A8000
heap
page read and write
D50000
unkown
page readonly
1A16000
heap
page read and write
4431000
heap
page read and write
1A28000
heap
page read and write
1930000
heap
page read and write
19F3000
heap
page read and write
18CE000
stack
page read and write
35CE000
heap
page read and write
40D08000
direct allocation
page read and write
3646000
heap
page read and write
35CC000
heap
page read and write
DE08000
direct allocation
page read and write
368E000
stack
page read and write
391D000
heap
page read and write
480D000
heap
page read and write
22296FE000
stack
page read and write
198C000
heap
page read and write
35BD000
heap
page read and write
3651000
heap
page read and write
34A9000
heap
page read and write
1A0F000
heap
page read and write
1989000
heap
page read and write
19F0000
heap
page read and write
19A2000
heap
page read and write
35AF000
stack
page read and write
19A6000
heap
page read and write
35EF000
heap
page read and write
35CE000
heap
page read and write
4431000
heap
page read and write
19F0000
heap
page read and write
35D0000
heap
page read and write
D51000
unkown
page execute read
35B1000
heap
page read and write
1A15000
heap
page read and write
19CD000
heap
page read and write
35BD000
heap
page read and write
35CE000
heap
page read and write
40C08000
direct allocation
page read and write
3672000
heap
page read and write
142D000
unkown
page read and write
198C000
heap
page read and write
19F3000
heap
page read and write
35B1000
heap
page read and write
1A17000
heap
page read and write
3651000
heap
page read and write
3C33000
heap
page read and write
1998000
heap
page read and write
4184000
heap
page read and write
38D9000
heap
page read and write
19F0000
heap
page read and write
3C33000
heap
page read and write
26700000
direct allocation
page read and write
19A2000
heap
page read and write
3646000
heap
page read and write
3662000
heap
page read and write
35CE000
heap
page read and write
35D0000
heap
page read and write
19A6000
heap
page read and write
19CD000
heap
page read and write
1997000
heap
page read and write
1A17000
heap
page read and write
1989000
heap
page read and write
1989000
heap
page read and write
35BD000
heap
page read and write
2104A830000
heap
page read and write
1A17000
heap
page read and write
35BD000
heap
page read and write
36A7000
heap
page read and write
35CC000
heap
page read and write
1BFE000
stack
page read and write
1998000
heap
page read and write
35C5000
heap
page read and write
1989000
heap
page read and write
19A6000
heap
page read and write
35CC000
heap
page read and write
3653000
heap
page read and write
3480000
heap
page read and write
1989000
heap
page read and write
19F3000
heap
page read and write
35CE000
heap
page read and write
35B0000
heap
page read and write
1425000
unkown
page write copy
199F000
heap
page read and write
1A2A000
heap
page read and write
198C000
heap
page read and write
36A7000
heap
page read and write
1A29000
heap
page read and write
142A000
unkown
page read and write
19CD000
heap
page read and write
34AF000
stack
page read and write
19A6000
heap
page read and write
368E000
heap
page read and write
19F0000
heap
page read and write
34A2000
heap
page read and write
7100000
direct allocation
page read and write
3651000
heap
page read and write
35BE000
heap
page read and write
19F0000
heap
page read and write
There are 568 hidden memdumps, click here to show them.