File name: | NEW#838 ORDER647-_DOC.exe |
Full analysis: | https://app.any.run/tasks/b141bda2-a8a0-492d-8f44-f1c196aff299 |
Verdict: | Malicious activity |
Threats: | Pony is a malware with two main functions — stealing information and dropping other viruses with different tasks on infected machines. It has been around since 2011, and it still actively attacks users in Europe and America. |
Analysis date: | October 14, 2019, 11:54:30 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 05CFF8BE54FA2A54B8DEE2E146CE25CC |
SHA1: | 19694278171A6E7F145EAF3760A095AA81AEC874 |
SHA256: | BED4D636CE21F65E55DF10B4CA37F666B78C7CF1558D6E8A9533DDB38307A887 |
SSDEEP: | 24576:kwYOxE9OUGYvdd54sUu9zHxuXp0U1pUDGZES2z++cpKv8itvyz3L8K7j5/:k50+dd5su9tq0U1pUy+S2S+cpK8Uvlo/ |
.exe | | | Win32 Executable Delphi generic (37.4) |
---|---|---|
.scr | | | Windows screen saver (34.5) |
.exe | | | Win32 Executable (generic) (11.9) |
.exe | | | Win16/32 Executable Delphi generic (5.4) |
.exe | | | Generic Win/DOS Executable (5.2) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 1992:06:20 00:22:17+02:00 |
PEType: | PE32 |
LinkerVersion: | 2.25 |
CodeSize: | 363008 |
InitializedDataSize: | 1634304 |
UninitializedDataSize: | - |
EntryPoint: | 0x5987c |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 19-Jun-1992 22:22:17 |
Detected languages: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 8 |
Time date stamp: | 19-Jun-1992 22:22:17 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
CODE | 0x00001000 | 0x000588D0 | 0x00058A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.52247 |
DATA | 0x0005A000 | 0x000012A4 | 0x00001400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.95297 |
BSS | 0x0005C000 | 0x00BE2A39 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x00C3F000 | 0x0000215E | 0x00002200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.01372 |
.tls | 0x00C42000 | 0x00000010 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rdata | 0x00C43000 | 0x00000018 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 0.258612 |
.reloc | 0x00C44000 | 0x00006750 | 0x00006800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 6.64064 |
.rsrc | 0x00C4B000 | 0x00184E6C | 0x00185000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 7.31805 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 2.2958 | 744 | Latin 1 / Western European | Russian - Russia | RT_ICON |
2 | 2.80231 | 308 | Latin 1 / Western European | UNKNOWN | RT_CURSOR |
3 | 3.00046 | 308 | Latin 1 / Western European | UNKNOWN | RT_CURSOR |
4 | 2.56318 | 308 | Latin 1 / Western European | UNKNOWN | RT_CURSOR |
5 | 2.6949 | 308 | Latin 1 / Western European | UNKNOWN | RT_CURSOR |
6 | 2.62527 | 308 | Latin 1 / Western European | UNKNOWN | RT_CURSOR |
7 | 2.91604 | 308 | Latin 1 / Western European | UNKNOWN | RT_CURSOR |
50 | 5.17753 | 9640 | Latin 1 / Western European | UNKNOWN | RT_ICON |
4081 | 3.29671 | 436 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4082 | 3.28099 | 468 | Latin 1 / Western European | UNKNOWN | RT_STRING |
advapi32.dll |
comctl32.dll |
comdlg32.dll |
gdi32.dll |
kernel32.dll |
oleaut32.dll |
user32.dll |
version.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2188 | "C:\Users\admin\AppData\Local\Temp\NEW#838 ORDER647-_DOC.exe" | C:\Users\admin\AppData\Local\Temp\NEW#838 ORDER647-_DOC.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1756 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 68.0.1 | ||||
3012 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 68.0.1 | ||||
1792 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3012.0.43858104\646726711" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3012 "\\.\pipe\gecko-crash-server-pipe.3012" 1136 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 68.0.1 | ||||
3872 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3012.3.1313555930\489307633" -childID 1 -isForBrowser -prefsHandle 1688 -prefMapHandle 1684 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3012 "\\.\pipe\gecko-crash-server-pipe.3012" 1708 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 | ||||
2852 | C:\Users\admin\Yarexs.exe | C:\Users\admin\Yarexs.exe | NEW#838 ORDER647-_DOC.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3300 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3012.13.635377391\1519966725" -childID 2 -isForBrowser -prefsHandle 2180 -prefMapHandle 2184 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3012 "\\.\pipe\gecko-crash-server-pipe.3012" 2808 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 | ||||
2848 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3012.20.757065946\2023719086" -childID 3 -isForBrowser -prefsHandle 3796 -prefMapHandle 3800 -prefsLen 7129 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3012 "\\.\pipe\gecko-crash-server-pipe.3012" 3812 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 | ||||
3696 | "C:\Users\admin\Yarexs.exe" | C:\Users\admin\Yarexs.exe | Yarexs.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2480 | cmd /c ""C:\Users\admin\AppData\Local\Temp\3822187.bat" "C:\Users\admin\Yarexs.exe" " | C:\Windows\system32\cmd.exe | — | Yarexs.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
(PID) Process: | (1756) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: CE38061B03000000 | |||
(PID) Process: | (3012) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: 13CC081B03000000 | |||
(PID) Process: | (3012) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 1 | |||
(PID) Process: | (3012) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (3012) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
(PID) Process: | (2852) Yarexs.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | 4565757hdh |
Value: C:\Users\admin\AppData\Local\4565757hdh\4565757hdhR.vbs | |||
(PID) Process: | (3696) Yarexs.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR |
Operation: | write | Name: | HWID |
Value: 7B33383234433639372D333234392D344533392D423743362D4133333931393537394639327D | |||
(PID) Process: | (3696) Yarexs.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR |
Operation: | write | Name: | Client Hash |
Value: 0662C0584606C45C8F7DCFB28A127628 | |||
(PID) Process: | (3696) Yarexs.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3696) Yarexs.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3012 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
3012 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | — | |
MD5:— | SHA256:— | |||
3012 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | — | |
MD5:— | SHA256:— | |||
3012 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp | — | |
MD5:— | SHA256:— | |||
3012 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.bin | binary | |
MD5:5027177F513CDAE07DB2330E1DED5934 | SHA256:0C53F16051E738287A4612F68E296238087627E594CFD6DDFA1FECC2E998328B | |||
2188 | NEW#838 ORDER647-_DOC.exe | C:\Users\admin\Yar.bmp | image | |
MD5:78DA86DAD267EED8E0E177C11608CC5B | SHA256:0CA2994AF599EDDF58A7085BE1E7C6B93F5E8DF79BB3BEFDC32CD7147959B046 | |||
3012 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:354459382F30B8994109C88659DFA1F3 | SHA256:E3E8E2B7E7EECA231620D83C70FA5A926E8B9CE74C51F595F71191DC0B50527E | |||
3012 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flash-digest256.sbstore | binary | |
MD5:0E8FE60CCD7E9B4C32589A5743A95302 | SHA256:2B124D4026850A3CFFD28DBACB58AEC28F7DCD4D40BC14E52BBE96D60CE4E749 | |||
3012 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:DE9496ACA551ADE408EF6466A11833A1 | SHA256:8F9C7FDB3E0BC01024E43A8E242468FC4DD4F74C725E32A883571635203DC10A | |||
3012 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.sbstore | binary | |
MD5:4A1220FC03E11726F09E9981834345DB | SHA256:6AE7FC0FDBE217104F4034BF6A580A461106B50309ABCCFF6E309124DCA5EF39 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3012 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
3012 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
3012 | firefox.exe | POST | 200 | 172.217.22.3:80 | http://ocsp.pki.goog/gts1o1 | US | der | 471 b | whitelisted |
3696 | Yarexs.exe | POST | — | 103.116.16.4:80 | http://kommanditg.old-englishbook.icu/news/images/telephone/pictures/tax/taxes/asnel/gate.php | unknown | — | — | malicious |
3012 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
3012 | firefox.exe | GET | 200 | 2.16.186.112:80 | http://detectportal.firefox.com/success.txt | unknown | text | 8 b | whitelisted |
3012 | firefox.exe | GET | 200 | 2.16.186.112:80 | http://detectportal.firefox.com/success.txt | unknown | text | 8 b | whitelisted |
3696 | Yarexs.exe | GET | 404 | 103.116.16.4:80 | http://kommanditg.old-englishbook.icu/news/images/telephone/pictures/tax/taxes/asnel/shit.exe | unknown | html | 315 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3012 | firefox.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3012 | firefox.exe | 2.16.186.112:80 | detectportal.firefox.com | Akamai International B.V. | — | whitelisted |
3012 | firefox.exe | 216.58.208.42:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
3012 | firefox.exe | 52.88.123.140:443 | push.services.mozilla.com | Amazon.com, Inc. | US | unknown |
3012 | firefox.exe | 34.210.34.117:443 | search.services.mozilla.com | Amazon.com, Inc. | US | unknown |
3012 | firefox.exe | 52.33.184.165:443 | tiles.services.mozilla.com | Amazon.com, Inc. | US | unknown |
3012 | firefox.exe | 52.84.198.21:443 | snippets.cdn.mozilla.net | Amazon.com, Inc. | US | unknown |
3012 | firefox.exe | 172.217.22.3:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
3012 | firefox.exe | 52.84.198.125:443 | content-signature-2.cdn.mozilla.net | Amazon.com, Inc. | US | unknown |
3696 | Yarexs.exe | 103.116.16.4:80 | kommanditg.old-englishbook.icu | — | — | malicious |
Domain | IP | Reputation |
---|---|---|
detectportal.firefox.com |
| whitelisted |
a1089.dscd.akamai.net |
| whitelisted |
search.services.mozilla.com |
| whitelisted |
search.r53-2.services.mozilla.com |
| whitelisted |
push.services.mozilla.com |
| whitelisted |
autopush.prod.mozaws.net |
| whitelisted |
snippets.cdn.mozilla.net |
| whitelisted |
d228z91au11ukj.cloudfront.net |
| whitelisted |
tiles.services.mozilla.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO Observed DNS Query to .cloud TLD |
— | — | Potentially Bad Traffic | ET INFO Observed DNS Query to .cloud TLD |
— | — | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .icu Domain |
3696 | Yarexs.exe | A Network Trojan was detected | ET TROJAN Fareit/Pony Downloader Checkin 2 |
3696 | Yarexs.exe | Potential Corporate Privacy Violation | ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System |
3696 | Yarexs.exe | Potential Corporate Privacy Violation | ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5. |
3696 | Yarexs.exe | A Network Trojan was detected | ET TROJAN Trojan Generic - POST To gate.php with no referer |
3696 | Yarexs.exe | Potentially Bad Traffic | ET INFO HTTP POST Request to Suspicious *.icu domain |
3696 | Yarexs.exe | A Network Trojan was detected | MALWARE [PTsecurity] Pony encrypted POST Data Request |
3696 | Yarexs.exe | A Network Trojan was detected | ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98 |