modiloader | 6407ba6620d622e7c03ac8c9786b9f50_NeikiAnalytics | Triage

Sharing

General

Target

6407ba6620d622e7c03ac8c9786b9f50_NeikiAnalytics
Size

1022KB
MD5

6407ba6620d622e7c03ac8c9786b9f50
SHA1

92347b9edffadcf361e0a77406dc866b22eb3561
SHA256

22db50e39cb96be4d89c7a2b45af43079a5117561b2398286f9c2faf7e6200ee
SHA512

fd1b877c43595298f65da7961abe7f157ec29cb31c9b6ad1a205c77c2eabd3ff7633a772b2eee7dbadc2d97924199c06b707c68c70a0f440ffed4f6230a5cb28
SSDEEP

12288:W9IGowD7jM80aaOjky7SY0x51x+aDVn4Xw9K6s/EPfPHGne4+Zx+jSqnFT3iZZcG:qImyXOK1xplZA6EEPHJ4OsS+FTyvu

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader First Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage1

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6407ba6620d622e7c03ac8c9786b9f50_NeikiAnalytics

Files

6407ba6620d622e7c03ac8c9786b9f50_NeikiAnalytics
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 825KB - Virtual size: 824KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 14KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 36B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ