Behavioral task
behavioral1
Sample
4c07d82f2421dec84c669d204b7b6d41_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
4c07d82f2421dec84c669d204b7b6d41_JaffaCakes118
-
Size
2.6MB
-
MD5
4c07d82f2421dec84c669d204b7b6d41
-
SHA1
bd7477b63fac2e499fb3541560c807f65ad2627e
-
SHA256
4e342f4c0772a91de1b88c54c7724ce8bf3b0db5e72494f529700a7adb54a92e
-
SHA512
3165519fb1981643e47651a6b6545a96d0e20b432927c53027d5389b6c295a90e14f67f5bb9bd2643aff524e006078b7d7f3618946a768c3e362f25de184b304
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlA:86SIROiFJiwp0xlrlA
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Pony family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c07d82f2421dec84c669d204b7b6d41_JaffaCakes118
Files
-
4c07d82f2421dec84c669d204b7b6d41_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ