modiloader | c02cad8c40557719c6c680bb3d424a24 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c02cad8c40557719c6c680bb3d424a24
Size

396KB
MD5

c02cad8c40557719c6c680bb3d424a24
SHA1

c316a0df98b681df6319e44918361fc0d9e415b1
SHA256

fcd12f25543ea02d702550ebce5c27d531eba7ad726e64c90f567b1404ebb926
SHA512

3fc0dd46fdbeffd64d81150ee53db9d31dd7680a83606b7df991848e6e4c838c4c62b1a4b3031c6cadc22aed50e00552a950e3c8b172960e7e6846f7c07e8928
SSDEEP

6144:CE9yDzN5oqKVsJAC328uO6s1wQW877buWxjy/qj+aA/pa:xEDJ5ofs9BuOB1wQW87XuWxM

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c02cad8c40557719c6c680bb3d424a24

Files

c02cad8c40557719c6c680bb3d424a24
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 327KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 18KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ