modiloader | 94d5191a508d0fb9c8a9885af14a77da37cb329334cf8d9594ce7851bb5b5810 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

94d5191a508d0fb9c8a9885af14a77da37cb329334cf8d9594ce7851bb5b5810
Size

674KB
MD5

03f45e437db9f3c58652ec9b7d818223
SHA1

ba051ca7d7ef379468be8ac89e490cc78f9386bb
SHA256

94d5191a508d0fb9c8a9885af14a77da37cb329334cf8d9594ce7851bb5b5810
SHA512

fa32b78273523e0c69e040c7b45fea830fc7cbd769856761cde4e74def1aadb593c3562fb41218166b57311c94fe92f05400e2e81ddcc8c0c5637eb3971b36e0
SSDEEP

12288:+ERVq31AQHW3W4KlqckjwfIVLUn7f2wx/hCzJjiRKTE/+33Tt:P3qeG4KUchcu2P2//Q3Tt

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Files

94d5191a508d0fb9c8a9885af14a77da37cb329334cf8d9594ce7851bb5b5810
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 610KB - Virtual size: 610KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 23KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 20B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ