Overview

overview

10

Static

static

10

b3636cd866...18.exe

windows7-x64

10

b3636cd866...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b3636cd86648fbb7d0a650aee26f6246_JaffaCakes118

  • Size

    161KB

  • MD5

    b3636cd86648fbb7d0a650aee26f6246

  • SHA1

    c0b17b5c0cb3aac437fec77f50dd6677ca648fa5

  • SHA256

    1bf9183e8f945618e3c22608cd428aef287423a6ebd884b5edcdff80e1c7f591

  • SHA512

    526a7b639001cec6be2c87b0622bcaad5cd6753804b87cebb734796d64294fc1aafe04bf0b62c11de6d992817dad95542bee36ea6c1f0b7bdb62541ab944df17

  • SSDEEP

    3072:EDTLZhs0uDI0rAfOXl+y+uql/GOtsrVrqhTqndtndhndKndI:CTLFuD6fOXlql/GLJrqqndtndhndKndI

Score
10/10
vmprotectpony

Malware Config

Extracted

Family

pony

C2

http://butterchoco.net/admin/bull/gate.php

Signatures

  • Pony family
    pony
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b3636cd86648fbb7d0a650aee26f6246_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections