modiloader | 14ccbfe3b6a2500db30ad86cabd977ba | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14ccbfe3b6a2500db30ad86cabd977ba
Size

475KB
MD5

14ccbfe3b6a2500db30ad86cabd977ba
SHA1

611987abab60685ec7f35dd0f7c3f2ea30d80755
SHA256

33218a13466798127e58f7c8b68ead48e4e6098d5b0624e3ba97e3e6af231808
SHA512

9a2f70323e3589a57a3c0f36a54a1015fd247f3554ab6951aa55bbd63e60eb99c4c5affe1be6b4d532201165d28db40a99eab4d8c7436137686e33a2505a02fc
SSDEEP

12288:b6A+y1vbS+Vnjz936pOwQTkcB8XbwBMYBuN:eA11vbS+VjZiBQTklLwBMYQN

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14ccbfe3b6a2500db30ad86cabd977ba

Files

14ccbfe3b6a2500db30ad86cabd977ba
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

ServiceMain

Sections

CODE
Size: 418KB - Virtual size: 417KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 6KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 73B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ