modiloader | c4c818395a86966d49fd688240076059 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c4c818395a86966d49fd688240076059
Size

329KB
MD5

c4c818395a86966d49fd688240076059
SHA1

7bc27414d84f6b31cb7518ba04e25d098c1e01f8
SHA256

1f93660b75f7fe73e3f2de140368e9ef0482b9ba684b6dee2bf59950f8290baa
SHA512

b736bb899de6930ec3e26f66882e4a1ab1c50963c230544496742442ba3190cf791f3383433aa6b1b3de3ebcfb52aab937450d621df2dc2c5b2a53b50804ecc1
SSDEEP

6144:lCpdSRwu7010vKp7DNgFlulu8Croa9nfkAmZT7ay9jTBqEC1:OsRwu4HpfYloS8A+v79jTBu

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c4c818395a86966d49fd688240076059

Files

c4c818395a86966d49fd688240076059
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ