Behavioral task
behavioral1
Sample
959964a85f0cfcd3c6b6be57926879ce85c4e896d1333fcd2555c8eff2a855cd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
959964a85f0cfcd3c6b6be57926879ce85c4e896d1333fcd2555c8eff2a855cd.exe
Resource
win10v2004-20221111-en
General
-
Target
959964a85f0cfcd3c6b6be57926879ce85c4e896d1333fcd2555c8eff2a855cd
-
Size
1020KB
-
MD5
8cb11d0e14ffcaf871a580c6c9bba99c
-
SHA1
85cf22303e0b3ed0fb235e61b731e563a3e6ee61
-
SHA256
959964a85f0cfcd3c6b6be57926879ce85c4e896d1333fcd2555c8eff2a855cd
-
SHA512
5ac2696713c6e14edd524e6376f994e6430cdd77cc6d215e722b1bbf0a68444e18d1497c03558bb2d4c99819999c21f79b1fed295ab9a1970c02dada32bb6edd
-
SSDEEP
24576:8jwXCDtJ/j9KwIDtsTtSlAYylVbvQf/CTuWr:8jY2ODCTYlA1VbvqIuWr
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
Files
-
959964a85f0cfcd3c6b6be57926879ce85c4e896d1333fcd2555c8eff2a855cd.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.data Size: 728KB - Virtual size: 728KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 248KB - Virtual size: 248KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ex_cod Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE