modiloader | 08f366a0da689827686e40dec32f2ca7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

08f366a0da689827686e40dec32f2ca7
Size

689KB
MD5

08f366a0da689827686e40dec32f2ca7
SHA1

61316f307f57c45ba7e7bbd5553fa1baab1e986c
SHA256

423015da60ded3ff8832e70ba6d868d8e5deee6d9c25f91f59d818e8588ee485
SHA512

a27be93f74a6d242b0d069f23b4d58dcbd22887ddf79d0527cf7b2ca9b594dbc75d239fc21c89dca84ad6a3bcceff2c3d55bb0f1cdbe4180b20fa63f85c1fb55
SSDEEP

12288:RK9tGgozqi5paO0lp9USQVUeyrkA4nK6J2v5rdTgxWaSTc:sD2eas1USIianh4JuIaST

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08f366a0da689827686e40dec32f2ca7

Files

08f366a0da689827686e40dec32f2ca7
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 657KB - Virtual size: 657KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ