Behavioral task
behavioral1
Sample
NEAS.95a7ae4cf10259e34e2d5914acd77180.exe
Resource
win7-20231020-en
General
-
Target
NEAS.95a7ae4cf10259e34e2d5914acd77180.exe
-
Size
96KB
-
MD5
95a7ae4cf10259e34e2d5914acd77180
-
SHA1
532a98e750ae1ad3a433a9dda7400f8c22c7b176
-
SHA256
84d90256bef4edd343a12ca5a3983fdf6b90a8060c19cf6631fe64a45a8f6e79
-
SHA512
637d949549aaee740e16cad4561da218d2b7d031e0f4bafc6106352c71f5a5d9e586e9221d08bd92aeb659a1e5f32ecd803869509e46734003bfe44eef4eb97f
-
SSDEEP
1536:sllwllwll9O3j9qgqTzHqWS0ecA/foU3kIs78VnwmD+8TvPkzkl:el6l6lsz9qXdAcCfodIUWnrCw
Malware Config
Extracted
pony
http://voladex.pw:36/fix/mark.php
http://bolakes.pw:36/fix/refer.php
http://camtest33.pw:36/fix/symbols.php
-
payload_url
http://camtest3.pw:36/fix/Sonar.exe
Signatures
-
Pony family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.95a7ae4cf10259e34e2d5914acd77180.exe
Files
-
NEAS.95a7ae4cf10259e34e2d5914acd77180.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE