modiloader | fe730c8832854a4905afa8b3d0045afc_JaffaCakes118

resource	yara_rule
static1/unpack001/TextPic.exe	modiloader_stage2

resource
unpack001/TextPic.exe

fe730c8832854a4905afa8b3d0045afc_JaffaCakes118

SHA256 c9c08642e0b5db94773fdb8847ca4a3915d1626ed1d3e0efa11fdae3e2b74d4e
MD5 fe730c8832854a4905afa8b3d0045afc
SHA1 62c251ff6d9185693243da9b054566ad1d9ad65e
SHA512 79b195d2140f8c12275509193826b2651edbeedb127b34ade670ef9f4d3cc93787ddc49df6ee57913450a256f7fb68046d4051492b48e1e6730f2612b9d5e780
SSDEEP 6144:atva1tRyWZdYviJwLqlk+wq/IOiqv+2pB+sdg8iQDrEvjhnaWwVgL9R/UdILSU5a:3ZdoicqOSxRvL8vjNe8gyhA
MD5 SHA1 SHA512 SSDEEP

License.txt

SHA256 046ee8602be585061e93463630ea75761c92dc9bcd4306062f6902181463f27f
MD5 e619538af866f1368fa73d91c19aed4d
SHA1 4212be443669acdf275ac135b5641f211e7517be
SHA512 f593264830378e705a49c4673ccf6a2410d1cc8e93b971469a53353eaef70bfa080aaf4558a238368e239344d95c159f17a79f49a39dada23e6933ade470f102
MD5 SHA1 SHA512

TextPic.exe

SHA256 5ddfe98d00b60e8de5ab8433016ffa63e1860bcf3dbe5ce76560cc7c3e79a674
MD5 c3bc3e30cc02eb0ef024dfb667f4b7e4
SHA1 1b4a0cb2d55e31ef08300f9699b867c8c1425c0e
SHA512 93f9cdec815f8a85512e4415f48b903570e8f4eea6cebac4cec0b7cc552b79dbd38c7dadfd1ed02f3d3837a6da6d9334a415d8c477fc97ab243c9a0b9a5e2169
SSDEEP 12288:GVZjRjcFHrPJ4rPKEwzf1HD28BOto5jteU2EWKHJmz+qnBC27XKgj4a:a1ijWK9f1HD28BOtc0D+Had4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ModiLoader Second Stage
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

563808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

547KB

Virtual Size

546KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

readme.txt

SHA256 e3510dc48d0ec0910b71ef241c270ee7ed4f20372fb27cc418985d301b4d615a
MD5 38f66aacb7b0373fca3e99c7b8e79e47
SHA1 0aef24cbf8c9d5ff77e8e5c2f8a574ad636188aa
SHA512 0136d5416192ed813f6e94ff74d0e4aa77b1b0f2cadfda74de0adb5b999cbb00408f953ee94e966e7a80298adefe46b0a6655e905e9397203b143e56db078e84
MD5 SHA1 SHA512

skin.skn

SHA256 a606fd5b6052ffdf18ea2619f0943465a9ae4ac8a095de6bc54b783717795f94
MD5 14aa1b01b1ea9b3e3c76909a66a4485f
SHA1 17e603e9b19582a3e9090eb6dcaa068b5a0fff14
SHA512 9d5b27b1a5cacf929d19ebbaa4cf20314a6d021e8a085f46e578fe06baa628e037de9b38e9fe66f0c76d19b8dbf2251484609ce3ff4f8f63e0ff53af427c93fb
SSDEEP 3072:4jsG0dO1FOiAhyDz+5lWxw9U9nkydvK2BrL:4jsBdO1Qcf+jWxw9UC52B
MD5 SHA1 SHA512 SSDEEP

下载说明.htm

SHA256 e4ebd3a562014143ad591012573a11d29865d316aaee1fc1e4ffdf5843c568d4
MD5 6f3eb28a2956fcf3c1e5d80bb52b04d2
SHA1 b567d21a706593c95b36596b1a56984afe46dee9
SHA512 cc04b125df0834c8821e838d15b6787d4a152cde53f02f5a5e45cb17353cb6e26c3601afcd8cbcd08a9c6fb25e3b8a5e277f91ca0b84c1c451b5d93fbd1e5e68
SSDEEP 96:v7OQeRA2RWhsFf6HIvtVg0zU/KNe/idddddddddddddddddddddddddNddddddav:zX8A0JFyLqs4/z5w1U4j2NckC
MD5 SHA1 SHA512 SSDEEP

polyglot

Sharing

General

Malware Config

Signatures

File Explorer

fe730c8832854a4905afa8b3d0045afc_JaffaCakes118

License.txt

TextPic.exe

generic

readme.txt

skin.skn

下载说明.htm