Behavioral task
behavioral1
Sample
47b017f18ee9344405efa5e1e12f480f_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
47b017f18ee9344405efa5e1e12f480f_JaffaCakes118
-
Size
2.6MB
-
MD5
47b017f18ee9344405efa5e1e12f480f
-
SHA1
45428068c39514cd50e7ead7d15340235463c40c
-
SHA256
331c66c79ea3e023ae6fdebe53f612ff9b7bbae87c0339ea2f24a95a43267a87
-
SHA512
f702a272bafeef6a59f4a77433e77921bb638f1f7ce9a508f099d2b1eb0c174b6928f4dba6ee70c54bf38e0b36f22e58b694b700147b4fe8cc96c4af6697254f
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlW:86SIROiFJiwp0xlrlW
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Pony family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 47b017f18ee9344405efa5e1e12f480f_JaffaCakes118
Files
-
47b017f18ee9344405efa5e1e12f480f_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ