modiloader | ff7e0b3e3b29ae2a60d38b08a5ba7f13_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
ff7e0b3e3b29ae2a60d38b08a5ba7f13_JaffaCakes118
Size 687KB
Sample240421-rtqj2sdc63
SHA256 37033abed14d956eb50e374c1f34f2b234f2b3a4d9815ded5ab189e145d3cee4
MD5 ff7e0b3e3b29ae2a60d38b08a5ba7f13
SHA1 3c7944d28ef6dc59c95d2da07828257b58fc3844
SHA512 a9fcad0b1488f487a399806cba64c8fb08d8337c733620f722fef2f194becb45dd4d7b93ab0343789f2057db1665a58d6448791adc75faefc4a0a3bd3d8eb31f
SSDEEP 12288:Nwlo7Th3bsG8uqSjQDF5uTUjxOhDBW5BTLSg1jOVTCK:KWZLsGOvh5c1hBcT3VOVTt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff7e0b3e3b29ae2a60d38b08a5ba7f13_JaffaCakes118

File Explorer

ff7e0b3e3b29ae2a60d38b08a5ba7f13_JaffaCakes118

.exe 687KB

ff7e0b3e3b29ae2a60d38b08a5ba7f13_JaffaCakes118

SHA256 37033abed14d956eb50e374c1f34f2b234f2b3a4d9815ded5ab189e145d3cee4
MD5 ff7e0b3e3b29ae2a60d38b08a5ba7f13
SHA1 3c7944d28ef6dc59c95d2da07828257b58fc3844
SHA512 a9fcad0b1488f487a399806cba64c8fb08d8337c733620f722fef2f194becb45dd4d7b93ab0343789f2057db1665a58d6448791adc75faefc4a0a3bd3d8eb31f
SSDEEP 12288:Nwlo7Th3bsG8uqSjQDF5uTUjxOhDBW5BTLSg1jOVTCK:KWZLsGOvh5c1hBcT3VOVTt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ModiLoader Second Stage
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

628404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

610KB

Virtual Size

609KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ff7e0b3e3b29ae2a60d38b08a5ba7f13_JaffaCakes118

generic