pony | da45aaa6efb864c480ad0414aa3532c850eb2d071638b1c497c2a5425c0c40c2

Sharing

Copy URL

Twitter E-mail

General

Target

da45aaa6efb864c480ad0414aa3532c850eb2d071638b1c497c2a5425c0c40c2
Size

88KB
MD5

43126a65594239b5661ff05c5c928cb0
SHA1

9c9c0d6674bb4a6950d3963c4e9cbfc9e4a8d739
SHA256

da45aaa6efb864c480ad0414aa3532c850eb2d071638b1c497c2a5425c0c40c2
SHA512

701a3d3aa20ca5b3f2ddd02c269decc0b1c01c7cd1434bbd70c87f4cd17d93a6feddbee526bdd7c9202b531056251df9e2496854196c41d55e84974bfb752cdc
SSDEEP

1536:x3V3e8KytqTZkYu5SCvaDBzgM+5zu9kS24zxAkOg8WTvMEIqkzZ3:9dOy+ubiDBzv+1H4OgYEIF3

Score

10^/10

pony

Malware Config

Extracted

Family

pony

http://activaweb.com.mx/default.php?oY8GzX1eFSRxvSSEzhebrCXGKU5Ttmr8aSd

http://old.serwis-krakow.pl/default.php?o1qJGyrJkoMdZqNmLXcLxf4Sc3eNNHU

http://tiagodasilva.comuf.com/default.php?CckCbvA1XOsyEZ5omIbcST6JuJ45s

http://tradelinkengineering.com/default.php?3GzyNTr2y3qGdEllaLypgJ3rO3B

http://cys.comlu.com/default.php?BOBY7CKuvhVO4XFydmoYQdR6zbXhF3WSTumVyl

Signatures

Pony family
pony

Files

da45aaa6efb864c480ad0414aa3532c850eb2d071638b1c497c2a5425c0c40c2
.exe windows x86

728afd0aeb7539a2a721ececf5f36865

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
ReadFile
CloseHandle
WriteFile
lstrlenA
GlobalLock
GlobalUnlock
LocalFree
LocalAlloc
lstrcpyA
lstrcatA
GetFileAttributesA
ExpandEnvironmentStringsA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
LoadLibraryA
GetProcAddress
GetTempPathA
CreateDirectoryA
DeleteFileA
GetCurrentProcess
WideCharToMultiByte
GetLastError
lstrcmpA
CreateToolhelp32Snapshot
Process32First
OpenProcess
Process32Next
FindFirstFileA
lstrcmpiA
FindNextFileA
FindClose
GetModuleHandleA
GetVersionExA
GetLocaleInfoA
GetSystemInfo
GetWindowsDirectoryA
GetPrivateProfileStringA
SetCurrentDirectoryA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetCurrentDirectoryA
lstrlenW
MultiByteToWideChar
GetTickCount
Sleep
GetModuleFileNameA
LCMapStringA
ExitProcess
SetUnhandledExceptionFilter

ole32

CreateStreamOnHGlobal
GetHGlobalFromStream
CoCreateGuid
CoTaskMemFree
CoCreateInstance
OleInitialize

user32

wsprintfA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyA
RegEnumKeyExA
RegCreateKeyA
RegSetValueExA
IsTextUnicode
RegOpenCurrentUser
RegEnumValueA
GetUserNameA

wininet

InternetCrackUrlA
InternetCreateUrlA

shlwapi

StrStrIA
StrRChrIA
StrToIntA
StrStrA
StrCmpNIA
StrStrIW

wsock32

inet_addr
gethostbyname
socket
connect
closesocket
send
select
recv
setsockopt
WSAStartup

userenv

LoadUserProfileA
UnloadUserProfile

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

Files

728afd0aeb7539a2a721ececf5f36865

Headers

File Characteristics

Imports

kernel32

ole32

user32

advapi32

wininet

shlwapi

wsock32

userenv

Sections

.text Size: 69KB - Virtual size: 68KB

.rdata Size: 512B - Virtual size: 256B

.data Size: 18KB - Virtual size: 19KB

.text
Size: 69KB - Virtual size: 68KB

.rdata
Size: 512B - Virtual size: 256B

.data
Size: 18KB - Virtual size: 19KB