pony | 46f18ac611cd974116aa94b4fb45343dcd727d9d07d95b12f32f4033fc66c8ad

Sharing

Copy URL

Twitter E-mail

General

Target

46f18ac611cd974116aa94b4fb45343dcd727d9d07d95b12f32f4033fc66c8ad
Size

187KB
MD5

e00c36be7554448aaddde4ad7592709f
SHA1

b43d3a5867117265d44ceda4c703051024e80588
SHA256

46f18ac611cd974116aa94b4fb45343dcd727d9d07d95b12f32f4033fc66c8ad
SHA512

2b4e6ebc09ce19023f95523e963f121b7feacca89207fb4cc49801afae0df741965212c3cc2d06d0130c03b45dc0238f50a1115fdbafcb6c2603787c8a69fbc3
SSDEEP

3072:yIE85ehGi9ipqUUVg8F1rzrOBqYjr/ITtsrVMu8jEHCyjTWtA8dOnMEzh1EQ:yIEf9ipqn1TOBq6/ISJMu8YHZjytTdOh

Score

10^/10

pony

Malware Config

Extracted

Family

pony

http://www.p2kings.ga/p2/gate.php

Signatures

Pony family
pony

Files

46f18ac611cd974116aa94b4fb45343dcd727d9d07d95b12f32f4033fc66c8ad
.exe windows x86

1f3b7eab7f8ef80c1901611824a3f65d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
ReadFile
CloseHandle
WriteFile
lstrlenA
GlobalLock
GlobalUnlock
LocalFree
LocalAlloc
GetTickCount
lstrcpyA
lstrcatA
GetFileAttributesA
ExpandEnvironmentStringsA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
LoadLibraryA
GetProcAddress
GetTempPathA
CreateDirectoryA
DeleteFileA
GetCurrentProcess
WideCharToMultiByte
GetLastError
lstrcmpA
CreateToolhelp32Snapshot
Process32First
OpenProcess
Process32Next
FindFirstFileA
lstrcmpiA
FindNextFileA
FindClose
GetModuleHandleA
GetVersionExA
GetLocaleInfoA
GetSystemInfo
GetWindowsDirectoryA
GetPrivateProfileStringA
SetCurrentDirectoryA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetCurrentDirectoryA
lstrlenW
MultiByteToWideChar
Sleep
GetModuleFileNameA
LCMapStringA
ExitProcess

ole32

CreateStreamOnHGlobal
GetHGlobalFromStream
CoCreateGuid
CoTaskMemFree
CoCreateInstance
OleInitialize

user32

wsprintfA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyA
RegEnumKeyExA
RegCreateKeyA
RegSetValueExA
IsTextUnicode
RegOpenCurrentUser
RegEnumValueA
GetUserNameA

wininet

InternetCrackUrlA
InternetCreateUrlA

shlwapi

StrStrIA
StrRChrIA
StrToIntA
StrStrA
StrCmpNIA
StrStrIW

urlmon

ObtainUserAgentString

wsock32

inet_addr
gethostbyname
socket
connect
closesocket
send
select
recv
setsockopt
WSAStartup

userenv

LoadUserProfileA
UnloadUserProfile

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

Files

1f3b7eab7f8ef80c1901611824a3f65d

Headers

File Characteristics

Imports

kernel32

ole32

user32

advapi32

wininet

shlwapi

urlmon

wsock32

userenv

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 512B - Virtual size: 256B

.data Size: 19KB - Virtual size: 20KB

.rsrc Size: 94KB - Virtual size: 96KB

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 512B - Virtual size: 256B

.data
Size: 19KB - Virtual size: 20KB

.rsrc
Size: 94KB - Virtual size: 96KB