Behavioral task
behavioral1
Sample
e01c17b073ef0fe6b161b8f175245ce1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e01c17b073ef0fe6b161b8f175245ce1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e01c17b073ef0fe6b161b8f175245ce1_JaffaCakes118
-
Size
89KB
-
MD5
e01c17b073ef0fe6b161b8f175245ce1
-
SHA1
2e86a0313fa430b6c9a6b89818f6a376f12059ec
-
SHA256
2822c03a78c5f262b9b8e347f92557d6de20ef538623cfae0e3532e5a7689ea6
-
SHA512
c1159a0d5ce2fdfba1b6fb88bc61f73ea1a7bbcfd57158e58bf5ac1ed2baa0cd1a51bbed80f98250aa7deb4f5bcc4c490b4540ae12eed75062402462e981e3ec
-
SSDEEP
1536:mM8YPYAQqTzTm19EUEtKFhwlA808G/pB2OlPCATvoEKskzmnp:v8rACkDlASOEJEKgnp
Malware Config
Extracted
pony
http://ekpojayamma.net46.net/Panel/gate.php
Signatures
-
Pony family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e01c17b073ef0fe6b161b8f175245ce1_JaffaCakes118
Files
-
e01c17b073ef0fe6b161b8f175245ce1_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE