Behavioral task
behavioral1
Sample
1ec1661361138f6ea1c2897663a78e1e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1ec1661361138f6ea1c2897663a78e1e.exe
Resource
win10v2004-20231215-en
General
-
Target
1ec1661361138f6ea1c2897663a78e1e.exe
-
Size
26KB
-
MD5
1ec1661361138f6ea1c2897663a78e1e
-
SHA1
8d314760f586dacfe472e16d2f2d19e617efb71b
-
SHA256
e2a3862ddaf7065df767a7ee482d99edd0cae1022b0b93d8637e5bf791f0a034
-
SHA512
aa160413db98779c3d52d92d1482aa37a893efeca5bd172eaf8e011368058b9c6280783aa9dcc5a8d71152c6f1b5bf2e93cc645e231e94745097f23e58566670
-
SSDEEP
384:QHvQPWzqES+yiVtI89z60Unr6ngQdtbDvd3PkU8diIiz0JmXBaxrP1+CA9:YbDI8NnowdRl/XXzD83T
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ec1661361138f6ea1c2897663a78e1e.exe
Files
-
1ec1661361138f6ea1c2897663a78e1e.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ