analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PonyFinal.jar

Full analysis: https://app.any.run/tasks/d729b7ec-0030-4442-a215-0ebb7d538359
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Analysis date: May 30, 2020, 02:39:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
stealer
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

E94B18674B8336461C12A2ED48541956

SHA1:

B64A2E3D2DAD3DA4EF00D2E853F9DD76A42B32B0

SHA256:

18894DB26EE6EFF366A81D924B7F4C8E510D98793B307638E67721DA15EAEBBA

SSDEEP:

192:4QWL6k5IKdvdEhKUyB/SGcXj6gL6vh/30LTS+hoO03im13MNvFDQELd4M6:rEzIHQpSlezh/kLFg3imKNvFD/36

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Dropped file may contain instructions of ransomware

      • javaw.exe (PID: 1784)
    • Stealing of credential data

      • javaw.exe (PID: 1784)
  • SUSPICIOUS

    • Creates files in the user directory

      • javaw.exe (PID: 1784)
    • Creates files like Ransomware instruction

      • javaw.exe (PID: 1784)
    • Creates files in the program directory

      • javaw.exe (PID: 1784)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • javaw.exe (PID: 1784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jar | Java Archive (78.3)
.zip | ZIP compressed archive (21.6)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:04:10 05:02:28
ZipCRC: 0xb4d55ef5
ZipCompressedSize: 167
ZipUncompressedSize: 211
ZipFileName: META-INF/MANIFEST.MF
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe

Process information

PID
CMD
Path
Indicators
Parent process
1784"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\PonyFinal.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Total events
7
Read events
7
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
44
Text files
102
Unknown types
3

Dropped files

PID
Process
Filename
Type
1784javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:EE0E00C9C5729562A23C6AE2C988B617
SHA256:2F86F2BE6DB0C4421D03EA93F1A8DE3FF7C52F7968DE37C56B6D9BAAC5316CD4
1784javaw.exeC:\Users\admin\Desktop\iiiregular.png.encbinary
MD5:21172CCDEAEB171D1C444063C6528931
SHA256:CF749A0DABE621799E504B3A93A11998BF4D17BA7502AFAD6AFB6A51C08A8851
1784javaw.exeC:\Users\admin\Desktop\malesoon.jpg.encbinary
MD5:0C2323FB3D49E7FFD3BE36F48DB8C84F
SHA256:B6D2988D47081B2C020168228850D94A695A918554C54713E3C2C27E2D2AA674
1784javaw.exeC:\Users\admin\Desktop\marketwhile.jpg.encbinary
MD5:0065D4E3A10012EEFE15362B06711820
SHA256:C9CCE390500F76F5B76440F07F9CD62D8179734BC08B848FD17305CF86822FD9
1784javaw.exeC:\Users\admin\Documents\jerseyinternational.rtf.encbinary
MD5:57F38838A8DC1E7D4034793CE9C1091A
SHA256:765DF6994736AD832EC23E511728DF88AC1325C4244CDCD8E1BFF2FDD1E5F2B2
1784javaw.exeC:\Users\admin\Desktop\individualproject.rtf.encbinary
MD5:028EF841E0C7FC82A71E7543AAA91E22
SHA256:06F4223ADD5493A487995196C77CA8CA937D5D55D2A4B8941B08AAC8F4B2860E
1784javaw.exeC:\Users\admin\Desktop\publicationkingdom.png.encbinary
MD5:BB3B2AA156D60C5C868FDC38D13FE27A
SHA256:FD33EC8496A357BB8DD337A0DE9847EAA4CE5E2760E1E9A26D6F47CB73025D8B
1784javaw.exeC:\Users\admin\Documents\keys.enctext
MD5:60270E10E2B6BE14357C90E9FEA9506E
SHA256:6135A8F6106862B9D6A29A9F252C1D46CA5E0C28D7E2E26144FD0F3D146019ED
1784javaw.exeC:\Users\admin\Desktop\keys.enctext
MD5:5E88B5D146D24D49EA22EC39F86668C0
SHA256:297C9A2BEB69853AD651F8D0EBD9906293B41BDD26E207C220A10FAFA73FD80C
1784javaw.exeC:\Users\admin\Desktop\flatstarted.jpg.encflc
MD5:808679F63F355036CD68942E2BC50A9B
SHA256:7E3C307E3C1D82542D9DB4D4D12E5FD91CD24AA7466E261F0CBA06A4AEC57EB9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info