Behavioral task
behavioral1
Sample
14d212f9979c9d43b6bcf4ff61650ec10f2f1b61254337a84996923d5aae37e9N.exe
Resource
win7-20241010-en
General
-
Target
14d212f9979c9d43b6bcf4ff61650ec10f2f1b61254337a84996923d5aae37e9N
-
Size
2.6MB
-
MD5
be3e0eeac1e56582a4270ec7a60ca110
-
SHA1
6e5dc583dc5a889282c4db982a634f61529c7011
-
SHA256
14d212f9979c9d43b6bcf4ff61650ec10f2f1b61254337a84996923d5aae37e9
-
SHA512
b671f77912a26a562f34a79adb86844c3f779442efab0e24aae894e9171da640f30c51017fed129a33861ffa314a96f05dbd8f5f9c01692cf4fd0ec9453b813a
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl9:86SIROiFJiwp0xlrl9
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Pony family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14d212f9979c9d43b6bcf4ff61650ec10f2f1b61254337a84996923d5aae37e9N
Files
-
14d212f9979c9d43b6bcf4ff61650ec10f2f1b61254337a84996923d5aae37e9N.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ