Behavioral task
behavioral1
Sample
a7237471d2e78e27a875e758de49a3e7_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a7237471d2e78e27a875e758de49a3e7_JaffaCakes118
-
Size
2.6MB
-
MD5
a7237471d2e78e27a875e758de49a3e7
-
SHA1
02ef93c906fa98a942c55db8401ae5368ed1a1ec
-
SHA256
7365ffbf8be0cd736ddd39fb9da2a4fdc975b66ca38c9d1a4202a96527b1e139
-
SHA512
1b567bc20b03f854cd3b5c222d8b57fcd759b50dfced2b118b7b3c3038cca4352fad0e41517dc776b22518dff77d6934e86cf1d7cf21d0d02cbb0419e7e47775
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlu:86SIROiFJiwp0xlrlu
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Pony family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7237471d2e78e27a875e758de49a3e7_JaffaCakes118
Files
-
a7237471d2e78e27a875e758de49a3e7_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ