analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Scan Document_doc.gz

Full analysis: https://app.any.run/tasks/2c564c8c-842a-4827-a644-3a46e98ea36b
Verdict: Malicious activity
Threats:

Pony is a malware with two main functions — stealing information and dropping other viruses with different tasks on infected machines. It has been around since 2011, and it still actively attacks users in Europe and America.

Malware Trends Tracker     >>>
Analysis date: December 06, 2018, 02:34:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
pony
fareit
opendir
Indicators:
MIME: application/gzip
File info: gzip compressed data, was "Scan Document_doc.exe", last modified: Wed Dec 5 12:40:17 2018, max speed, from FAT filesystem (MS-DOS, OS/2, NT)
MD5:

757DCCE0A491504B54A9FD22E160B28C

SHA1:

0C98F20526B263AD3FF4D2F73A08976BE9FB1F84

SHA256:

EDD811F1C66894EBB9F1EE7106CD1404E6C9BD170BD4B6C25C6AD40E191E1CDE

SSDEEP:

3072:3Q0XJ8/JXdl0kYmJrC8yNCI1zM+7EZSotfKst9UeYIeDqITRPe9qPBi:AyJ8/JXdlKmBCTCAo+HoeemqITJ/Bi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Scan Document_doc.exe (PID: 1948)
      • Scan Document_doc.exe (PID: 2712)

    • Detected Pony/Fareit Trojan

      • Scan Document_doc.exe (PID: 2712)

    • Connects to CnC server

      • Scan Document_doc.exe (PID: 2712)

    • Actions looks like stealing of personal data

      • Scan Document_doc.exe (PID: 2712)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2956)

    • Application launched itself

      • Scan Document_doc.exe (PID: 1948)

    • Starts CMD.EXE for commands execution

      • Scan Document_doc.exe (PID: 2712)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.z/gz/gzip | GZipped data (100)

EXIF

ZIP

ArchivedFileName: Scan Document_doc.exe
OperatingSystem: FAT filesystem (MS-DOS, OS/2, NT/Win32)
ExtraFlags: Fastest Algorithm
ModifyDate: 2018:12:05 13:40:17+01:00
Flags: FileName
Compression: Deflated
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe scan document_doc.exe no specs #PONY scan document_doc.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2956"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Scan Document_doc.gz.z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1948"C:\Users\admin\Desktop\Scan Document_doc.exe" C:\Users\admin\Desktop\Scan Document_doc.exe—explorer.exe
User:
admin
Company:
LEGALIST
Integrity Level:
MEDIUM
Description:
"Intestinally7"TOMY6
Exit code:
0
Version:
6.08.0008
2712C:\Users\admin\Desktop\Scan Document_doc.exe" C:\Users\admin\Desktop\Scan Document_doc.exe
Scan Document_doc.exe
User:
admin
Company:
LEGALIST
Integrity Level:
MEDIUM
Description:
"Intestinally7"TOMY6
Exit code:
0
Version:
6.08.0008
1904cmd /c ""C:\Users\admin\AppData\Local\Temp\1352515.bat" "C:\Users\admin\Desktop\Scan Document_doc.exe" "C:\Windows\system32\cmd.exe—Scan Document_doc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
813
Read events
786
Write events
27
Delete events
0

Modification events

(PID) Process:(2956) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2956) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2956) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2956) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Scan Document_doc.gz.z
(PID) Process:(2956) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2956) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2956) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2956) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2956) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(2712) Scan Document_doc.exeKey:HKEY_CURRENT_USER\Software\WinRAR
Operation:writeName:HWID
Value:
7B36313032314235362D363143352D343331412D384242302D3937324639443230424639467D
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2712Scan Document_doc.exeC:\Users\admin\AppData\Local\Temp\1352515.bat —
MD5:—
SHA256:—
2956WinRAR.exeC:\Users\admin\Desktop\Scan Document_doc.exeexecutable
MD5:A3FA4947F648D7C0C8079C7E54155450
SHA256:03A357C8FAD6A1120080A3DD9D65C480EE89A4E928D79C423626ABA93D652BF0
1948Scan Document_doc.exeC:\Users\admin\AppData\Local\Temp\~DF41829527720A0773.TMPbinary
MD5:5396A94CB274FD1B604900F50E55EE32
SHA256:2A5BE419316A8F410354C92F5CE186FCA2769B5513136776341DF624EB6A6E80
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2712
Scan Document_doc.exe
POST
200
103.18.109.178:80
http://aspirationgraphics.com.au/ss/panelnew/gate.php
AU
binary
20 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2712
Scan Document_doc.exe
103.18.109.178:80
aspirationgraphics.com.au
Net Virtue Pty Ltd
AU
unknown

DNS requests

Domain
IP
Reputation
aspirationgraphics.com.au
  • 103.18.109.178
malicious

Threats

PID
Process
Class
Message
2712
Scan Document_doc.exe
Potential Corporate Privacy Violation
ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System
2712
Scan Document_doc.exe
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no referer
2712
Scan Document_doc.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
2712
Scan Document_doc.exe
A Network Trojan was detected
ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98
2712
Scan Document_doc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Fareit/Pony Downloader Checkin
2712
Scan Document_doc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Fareit/Pony CnC Server stdResponse
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Scan Document_doc.gz