modiloader | 0eb7059ac83118996c6d63295ff01f12 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0eb7059ac83118996c6d63295ff01f12
Size

142KB
MD5

0eb7059ac83118996c6d63295ff01f12
SHA1

f0b2f8630c125f4002e3d90f4bedebeeddabaec5
SHA256

ca5e734742c45141747349420bb2ae4ac7fbafa25b219d43db83ce48755f5743
SHA512

7468ccd0b3a8098edbff78a9cecafaba9fdf07cab91726d99e4c1fc4241f12dc8d1665e7b490c1283873e7075f0f48602348cd3918689dfdd2ffbe6ab79d45df
SSDEEP

3072:D9jXfyIum1MxsBO1WaFN1foAbzU8px2L6IBa:DNfyIum1MxkO191QAb/x2

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0eb7059ac83118996c6d63295ff01f12

Files

0eb7059ac83118996c6d63295ff01f12
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 48B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ