modiloader | 1fedfc97d52dc13ed6cebde7519bf7a8 | Triage

Sharing

General

Target

1fedfc97d52dc13ed6cebde7519bf7a8
Size

730KB
MD5

1fedfc97d52dc13ed6cebde7519bf7a8
SHA1

a5586c63c2e4eb65ce4c3f1a3070e7e01fbba470
SHA256

4851611ebb2a33698be0ed454cbaf495d86925ef472c6cdc5b799e259c573b3c
SHA512

aa67f72731ff7045ae899d4ba2cf861149c8524c92e38de2eee0bb707745a87bff6a0c7210abdf3a3ebfb49e3d34edec4588f3ba167368c8a8b64a311aaa829e
SSDEEP

12288:Y9nTQAiVtuiwlF4w+dGnS0LzPgm8cryDYTS7b9ihfJEdp86nH3UqCILs9:Y9nNMmlyeS0LzgsryuS7b9ihz6Ox

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fedfc97d52dc13ed6cebde7519bf7a8

Files

1fedfc97d52dc13ed6cebde7519bf7a8
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 500KB - Virtual size: 500KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 20B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ