modiloader | cdc59d0320b25aa0c67ad799eaa3476f3ef044317f578b8f573fb802d15c1547 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cdc59d0320b25aa0c67ad799eaa3476f3ef044317f578b8f573fb802d15c1547
Size

48KB
MD5

22549b6de8c79ade44058e7f99e1462b
SHA1

1ff8cafdb5e3015bba54eb839cc72eea4b9bb2fb
SHA256

cdc59d0320b25aa0c67ad799eaa3476f3ef044317f578b8f573fb802d15c1547
SHA512

d1e0153c2b3aa43c0b612ef7ef308dde6c30e3b20532385b7cd00b86388c5b8808f7f8b5ef115903d4d28a9700039a293d3a05b173a3f3a0a691128e578fbd75
SSDEEP

768:6mpM8NHn9/NyvOSj71F3Wl31TCU2txOwV8JtFqidNbh3Rc3iy6:6aLf4Oi1F3PtAFJtFd5j

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Files

cdc59d0320b25aa0c67ad799eaa3476f3ef044317f578b8f573fb802d15c1547
.dll regsvr32 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn

Sections

CODE
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ