modiloader | 50dfcf243d704dc4d8932606240c3721 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

50dfcf243d704dc4d8932606240c3721
Size

173KB
MD5

50dfcf243d704dc4d8932606240c3721
SHA1

1b59cbde2a41196d9e9e164e323177a5b856c126
SHA256

37ff58789c478cc2e0988228e76a1a6f26545a46cea7f7c36514da60bc71f385
SHA512

fb0f8e182cd521d9bb195c95379f0a8a622277793c4584acadaf29fe4828941820775d4691d6aeb3ecf66305e492927419d9ef18ee381e808c62c684ffec1619
SSDEEP

3072:dtDulZKusIzZjDDeqCe5ToU21kkH2ip0KuPk2afiMpltkrkbtNLWGt/Y:d6KuswrIU2ykH2ipsPnafFlerkb3LrtA

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50dfcf243d704dc4d8932606240c3721

Files

50dfcf243d704dc4d8932606240c3721
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ