analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PonyFinal.jar

Full analysis: https://app.any.run/tasks/8910acc5-a02b-4cf9-a070-0ed59b8712e2
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 30, 2020, 15:37:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

E94B18674B8336461C12A2ED48541956

SHA1:

B64A2E3D2DAD3DA4EF00D2E853F9DD76A42B32B0

SHA256:

18894DB26EE6EFF366A81D924B7F4C8E510D98793B307638E67721DA15EAEBBA

SSDEEP:

192:4QWL6k5IKdvdEhKUyB/SGcXj6gL6vh/30LTS+hoO03im13MNvFDQELd4M6:rEzIHQpSlezh/kLFg3imKNvFD/36

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Dropped file may contain instructions of ransomware

      • javaw.exe (PID: 1980)

    • Stealing of credential data

      • javaw.exe (PID: 1980)

  • SUSPICIOUS

    • Creates files in the user directory

      • javaw.exe (PID: 1980)
      • notepad++.exe (PID: 180)

    • Creates files like Ransomware instruction

      • javaw.exe (PID: 1980)

    • Creates files in the program directory

      • javaw.exe (PID: 1980)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • javaw.exe (PID: 1980)

    • Manual execution by user

      • notepad++.exe (PID: 180)
      • NOTEPAD.EXE (PID: 3264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jar | Java Archive (78.3)
.zip | ZIP compressed archive (21.6)

EXIF

ZIP

ZipFileName: META-INF/MANIFEST.MF
ZipUncompressedSize: 211
ZipCompressedSize: 167
ZipCRC: 0xb4d55ef5
ZipModifyDate: 2020:04:10 05:02:28
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe notepad++.exe gup.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1980"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\PonyFinal.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
180"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\keys.enc"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
3932"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
0
Version:
4.1
3264"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Documents\README_files.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
92
Read events
69
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
41
Text files
105
Unknown types
2

Dropped files

PID
Process
Filename
Type
1980javaw.exeC:\Users\admin\Desktop\allprobably.jpg.encbinary
MD5:D0CACA6D0F737E1F9659EF7960C5AB88
SHA256:1697035BD31660AFFBF5446F4D2CC5ECA45D1DCA0E84BA7E6E4876527811A031
1980javaw.exeC:\Users\Public\RunTask.battext
MD5:05B90B2C63743B26099668F97201CD52
SHA256:C54FD8C219729F857E36345F4A42D062BAE1DE111C9869848846B69DCBA3C57B
1980javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:72A211430AA21621299344ED71FA22E5
SHA256:D5CA2E629ECC78679B588FB581C5F874FA88A8C56850E64EB595FC827532556B
1980javaw.exeC:\Users\admin\Desktop\advertisepro.rtf.encbinary
MD5:F8203832AE0CAC3B3CAAABAB4652D0DD
SHA256:07C337169912C20F92405FF9ABA22381245CB25B3AA6A257A383B56C4A066199
1980javaw.exeC:\Users\admin\Desktop\blueprocess.jpg.encbinary
MD5:82FAA1CC2FF00190164B91D4B97D342F
SHA256:D2B188158B37EBE0CC81515B2772C89897C51BB34360976161D2B5506D5198D9
1980javaw.exeC:\Users\admin\Desktop\numbersasia.jpg.encbinary
MD5:486E06AEAC89349FB71512AFFC619F6A
SHA256:DA22E781717382199149C71A5CDDBC0BAFBDE3179AAFD7CE01458558566D86E7
1980javaw.exeC:\Users\admin\Desktop\keys.enctext
MD5:5CB9554E00571528A30E26B73C99CECD
SHA256:EBBEEFCBC17D01C759BF70F065E1C9FD4355587C402052CE5BC45F330435595D
1980javaw.exeC:\Users\admin\Desktop\caselogin.rtf.encbinary
MD5:C0F815EF1A7C08A8058DA4E4BB050B93
SHA256:CE5ED5C424AC2F6EEC82921E8FDB0D1B3C810368E19D353971522DD421047CC9
1980javaw.exeC:\Users\admin\Desktop\reservedchair.rtf.encbinary
MD5:720FF04DBABF01DCFF5ECB1BF3159C91
SHA256:F6706B09D8702A89F1664754692885EF131FE1C5EF9562CE808D7992209DC1B4
1980javaw.exeC:\Users\admin\Desktop\wallcondition.jpg.encbinary
MD5:9D0601D99360F8C78769B82510B1FA4A
SHA256:99D3186DE087AC6B0AF26F69DB922838BD6AE8EE847ACC80D995B68382B91E45
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3932
gup.exe
172.67.218.84:443
notepad-plus-plus.org
—
US
malicious
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
notepad-plus-plus.org
  • 172.67.218.84
  • 104.31.89.28
  • 104.31.88.28
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PonyFinal.jar