Behavioral task
behavioral1
Sample
700-65-0x0000000000400000-0x0000000000419000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
700-65-0x0000000000400000-0x0000000000419000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
700-65-0x0000000000400000-0x0000000000419000-memory.dmp
-
Size
100KB
-
MD5
03beda497ac5aa60491ac29295d2d53c
-
SHA1
fa02b67ab44b39c4f3ab612455ea996b7eee0bb1
-
SHA256
4faf1b1e5a7295cf63feaed0d16d5374e7f7204288e14e9174738ea2ed460126
-
SHA512
6a63b6279901c66434f6fc175ed9827e12415854997dd341186e56aabc70acd6b0fbd49015d4affcf326de4344090db732cb805e405dd84f6a7e199bcb180415
-
SSDEEP
1536:UnSn0nSncgyGqTDRXmGcwSCfZDalZNg9tvo0iO3AX4ApTvMEIMkzmt2l:2SnWSnMuGc/CfZDap6COU45EIAtm
Malware Config
Extracted
pony
http://synclogs.com/clue/gate.php
-
payload_url
http://synclogs.com/clue/shit.exe
Signatures
-
Pony family
Files
-
700-65-0x0000000000400000-0x0000000000419000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE