Behavioral task
behavioral1
Sample
4c4f3046aec5b8dc622c45a11b83e9ccda0419c33436bd99a789352a53766a42.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4c4f3046aec5b8dc622c45a11b83e9ccda0419c33436bd99a789352a53766a42.exe
Resource
win10v2004-20220812-en
General
-
Target
4c4f3046aec5b8dc622c45a11b83e9ccda0419c33436bd99a789352a53766a42
-
Size
200KB
-
MD5
058791147b996ab9474dc5abbfedeb60
-
SHA1
a0f1c17d333fa0ae6273e8c205859bc41f5d0e16
-
SHA256
4c4f3046aec5b8dc622c45a11b83e9ccda0419c33436bd99a789352a53766a42
-
SHA512
3bee41848b6308522c8f7f6fbf075e551e0c3436f0cee9677c14b151eea8bd7b2d40e6eed8b3ee6c7211c0d2f6d10560e4d15161d65b36262e6856597a5a54c3
-
SSDEEP
3072:iW42D6/7SV576pMOIrCG1iBNtsrVNAPs:iW48Aq6+OI+TBIJJ
Malware Config
Extracted
pony
http://115.47.49.181/0NK6XVdsm4L0/DFs2evNyFAhS.php
http://115.47.49.181/0NK6XV/doctorlhasa.php
Signatures
-
Pony family
Files
-
4c4f3046aec5b8dc622c45a11b83e9ccda0419c33436bd99a789352a53766a42.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
drws1 Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
drws2 Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ