modiloader | bde228b1253364d7fb574ee9e4a4d8f8058e581f323e1a174c35ba7089cfa3dd

Sharing

Copy URL Twitter E-mail

General

Target

bde228b1253364d7fb574ee9e4a4d8f8058e581f323e1a174c35ba7089cfa3dd
Size

840KB
MD5

ccfcbc315f2f64267ecbc28d693b1b12
SHA1

9fd1f7f67a708aeef0d9cc3e2160261b4eac2376
SHA256

bde228b1253364d7fb574ee9e4a4d8f8058e581f323e1a174c35ba7089cfa3dd
SHA512

ceaa1887a450f82a146f0a491af12bc54833520152404ae9455cf501ea635c92ca10f2ad6040e65c7639cdedf3d4965e4b36ce5f1bb09c29c75852888d6f4818
SSDEEP

12288:HJJXnsTI10JLFSYQnb75ifKWX0PBSad5qtpY7QZzVTYdmc7E4RynRUI:jXsc0JLZQxiyBsC5EVTYV7XMp

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Files

bde228b1253364d7fb574ee9e4a4d8f8058e581f323e1a174c35ba7089cfa3dd
.exe windows x86

a07464c18498b8eff4e10b975f11145a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

GetKeyboardType
MessageBoxA

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetUserA

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

wininet

InternetReadFile

winmm

waveInUnprepareHeader

netapi32

Netbios

wsock32

WSACleanup

avicap32

capCreateCaptureWindowA

msvfw32

DrawDibDraw

urlmon

URLDownloadToFileA

ws2_32

gethostname

Sections

CODE
Size: 608KB - Virtual size: 608KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 9KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 20B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.code0
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code1
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.code2
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a07464c18498b8eff4e10b975f11145a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

mpr

version

gdi32

comctl32

shell32

wininet

winmm

netapi32

wsock32

avicap32

msvfw32

urlmon

ws2_32

Sections

CODE Size: 608KB - Virtual size: 608KB

DATA Size: 31KB - Virtual size: 31KB

BSS Size: - Virtual size: 9KB

.idata Size: 12KB - Virtual size: 11KB

.tls Size: - Virtual size: 20B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 38KB

.code0 Size: 32KB - Virtual size: 32KB

.code1 Size: 34KB - Virtual size: 34KB

.code2 Size: 87KB - Virtual size: 86KB

.rsrc Size: 32KB - Virtual size: 32KB

CODE
Size: 608KB - Virtual size: 608KB

DATA
Size: 31KB - Virtual size: 31KB

BSS
Size: - Virtual size: 9KB

.idata
Size: 12KB - Virtual size: 11KB

.tls
Size: - Virtual size: 20B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 38KB

.code0
Size: 32KB - Virtual size: 32KB

.code1
Size: 34KB - Virtual size: 34KB

.code2
Size: 87KB - Virtual size: 86KB

.rsrc
Size: 32KB - Virtual size: 32KB