Behavioral task
behavioral1
Sample
4f71e18cc95c21014a7599d8282b8687_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4f71e18cc95c21014a7599d8282b8687_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4f71e18cc95c21014a7599d8282b8687_JaffaCakes118
-
Size
89KB
-
MD5
4f71e18cc95c21014a7599d8282b8687
-
SHA1
db5dcb3255ee9a12f150ede629a4b0a27b052961
-
SHA256
1426b6d873eb48ee549db7f3180ee28f3d2aa0981bfd18dc50d260faaa87a8cb
-
SHA512
9a8d92d37e2005b2101da6be50a5adf5d89e35878d5cb6898b315b0993cab4d481e51bb8246ba0995454404e0440088ff96edc5294374381944f4ca8028453f2
-
SSDEEP
1536:iq7c33BqTMykuINnBMLq7CtrPkY6UWEG5OQnmGx2TvYEKykzm8:x7Ihau7Chr0OkJEKq8
Malware Config
Extracted
pony
http://magic-skid.com/gate.php
http://skid.com/path/gate.php
Signatures
-
Pony family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 4f71e18cc95c21014a7599d8282b8687_JaffaCakes118
Files
-
4f71e18cc95c21014a7599d8282b8687_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE