Behavioral task
behavioral1
Sample
1116-55-0x0000000000400000-0x0000000000419000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1116-55-0x0000000000400000-0x0000000000419000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1116-55-0x0000000000400000-0x0000000000419000-memory.dmp
-
Size
100KB
-
MD5
5a21419b6f5cee46eb3a2b518a079bde
-
SHA1
7b98015e18b7e1d8a9a6953ddeb77c7505916469
-
SHA256
c4907025ee1d6390e93346e408cee2f75ec853d440aeccb4e279a23bb7e8409d
-
SHA512
eadd61dc4e8f82aa3a47f70c03fa3b35d9e590b31efc2786b94274c0a9fc30adb1fbf164829ab4ac9cd1f3156cb9ba4f7736c7943b572c0b4339f16332f0d159
-
SSDEEP
1536:Vsp4OpqT7i5Y1VqlWifA12mqRbCZA6+CoSYhO+KITvAE+g2kzmM:SNUKIPqRbCchO/1E+LM
Malware Config
Extracted
pony
http://jp.nurtureassociates.com/gate.php
Signatures
-
Pony family
Files
-
1116-55-0x0000000000400000-0x0000000000419000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE