modiloader | 0a2c514182f637a61096aab7934538d8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0a2c514182f637a61096aab7934538d8
Size

89KB
MD5

0a2c514182f637a61096aab7934538d8
SHA1

d47102a9461994e359a293d21a4648ae0052f5df
SHA256

29115352258b572fea6e33a919a8bbea47f8edb48141d53f3761af3ea6f2e0f9
SHA512

50cf1dfadd4aa6debb5c81e2a7908d4432728b5d32615cc274b2d9ad4e6d0beb083947064aaf77d485b75590d55c2c84e8e02d1163b2f0670d13eeba357d44d3
SSDEEP

1536:g9qSQ4pmwgvv/iNDWckbAljeEv3Ds6l65npVGHRvmKRmsEAuWVi0+:QTmDv4WcCA9eEv3DsC6t8ffESVi0+

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a2c514182f637a61096aab7934538d8

Files

0a2c514182f637a61096aab7934538d8
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn

Sections

CODE
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ