modiloader | 077deb53ad82390b3b07f8623be41479_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
077deb53ad82390b3b07f8623be41479_JaffaCakes118
Size 1.3MB
Sample240620-tc4fpazdql
SHA256 c311de0b4f7ee69e89c90665e5c700152ac201d6532770292545f9d89c98c4ae
MD5 077deb53ad82390b3b07f8623be41479
SHA1 7f98922a3d79236bb73fae14d10dec1ddd479f34
SHA512 35fc540b6aab0e33fbbc456d8d9ad04b75aa79932906a32424dd05b89440f296e6780655d6a6f10448192117b8630729286edc1e3390d8fec872d4714a031d00
SSDEEP 12288:HhOVDAe2LuTSL4HICIfx4IrqXfVlsOVzJS2+i0VjdFcfm0zn++0FstF4:YueLIrqDsOrS2BYjdFR0zn++0Fs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx modiloader

Malware Config

Signatures

ModiLoader First Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage1

Modiloader family
modiloader

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
077deb53ad82390b3b07f8623be41479_JaffaCakes118

File Explorer

077deb53ad82390b3b07f8623be41479_JaffaCakes118

.exe 1.3MB

077deb53ad82390b3b07f8623be41479_JaffaCakes118

IMPHASH 4e5bea0cef36ec284dbdea980f826623
SHA256 c311de0b4f7ee69e89c90665e5c700152ac201d6532770292545f9d89c98c4ae
MD5 077deb53ad82390b3b07f8623be41479
SHA1 7f98922a3d79236bb73fae14d10dec1ddd479f34
SHA512 35fc540b6aab0e33fbbc456d8d9ad04b75aa79932906a32424dd05b89440f296e6780655d6a6f10448192117b8630729286edc1e3390d8fec872d4714a031d00
SSDEEP 12288:HhOVDAe2LuTSL4HICIfx4IrqXfVlsOVzJS2+i0VjdFcfm0zn++0FstF4:YueLIrqDsOrS2BYjdFR0zn++0Fs
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

ModiLoader First Stage
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

788608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

QT_Thunk TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA GetModuleFileNameA lstrcpyA WritePrivateProfileStringA WriteFile WinExec WaitForSingleObject VirtualQuery VirtualAlloc TerminateProcess Sleep SizeofResource SetThreadPriority SetThreadLocale SetSystemTime SetPriorityClass SetFilePointer SetFileAttributesA SetEvent SetErrorMode SetEndOfFile ResumeThread ResetEvent ReleaseMutex ReadFile OpenProcess MultiByteToWideChar MulDiv MoveFileA LockResource LoadResource LoadLibraryA LeaveCriticalSection InitializeCriticalSection GlobalUnlock GlobalReAlloc GlobalMemoryStatus GlobalHandle GlobalLock GlobalFree GlobalDeleteAtom GlobalAlloc GlobalAddAtomA GetVolumeInformationA GetVersionExA GetVersion GetTimeZoneInformation GetTickCount GetThreadPriority GetThreadLocale GetTempPathA GetSystemInfo GetProfileStringA GetProcAddress GetPrivateProfileStringA GetPriorityClass GetModuleHandleA GetModuleFileNameA GetLogicalDriveStringsA GetLocaleInfoA GetLocalTime GetLastError GetFileSize GetFileAttributesA GetExitCodeThread GetDriveTypeA GetDiskFreeSpaceA GetDefaultCommConfigA GetDateFormatA GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCommProperties GetCPInfo FreeResource FreeLibrary FormatMessageA FindResourceA FindNextFileA FindFirstFileA FindClose FileTimeToLocalFileTime FileTimeToDosDateTime EnumCalendarInfoA EnterCriticalSection DeleteFileA DeleteCriticalSection CreateThread CreateProcessA CreateMutexA CreateFileA CreateEventA CreateDirectoryA CopyFileA CompareStringA CloseHandle Beep GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte SetCurrentDirectoryA MultiByteToWideChar lstrlenA lstrcpynA lstrcpyA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetLastError GetCurrentDirectoryA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread CreateThread WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetSystemTime GetFileType CreateFileA CloseHandle

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA RegQueryValueExA RegQueryInfoKeyA RegOpenKeyExA RegFlushKey RegEnumValueA RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey

comctl32

ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_SetDragCursorImage ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Add ImageList_GetImageCount ImageList_Destroy ImageList_Create InitCommonControls

gdi32

UnrealizeObject StretchBlt StartPage StartDocA SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetMapMode SetEnhMetaFileBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SetAbortProc SelectPalette SelectObject SaveDC RoundRect RestoreDC Rectangle RectVisible RealizePalette Polyline PlayEnhMetaFile PatBlt OffsetRgn MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsA GetTextExtentPointA GetTextExtentPoint32A GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectA GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits GdiFlush FillRgn ExtTextOutA ExtCreateRegion ExcludeClipRect EndPage EndDoc Ellipse DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRoundRectRgn CreateRectRgnIndirect CreateRectRgn CreatePolygonRgn CreatePenIndirect CreatePalette CreateICA CreateHatchBrush CreateHalftonePalette CreateFontIndirectA CreateEllipticRgnIndirect CreateDIBitmap CreateDIBSection CreateDCA CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileA CombineRgn BitBlt

mpr

WNetEnumCachedPasswords

ole32

CoUninitialize CoInitialize IsEqualGUID

oleaut32

VariantChangeTypeEx VariantCopyInd VariantClear SysStringLen SysFreeString SysReAllocStringLen SysAllocStringLen GetErrorInfo SysFreeString

shell32

ShellExecuteA SHFileOperationA SHAppBarMessage SHEmptyRecycleBinA SHGetSpecialFolderLocation SHGetPathFromIDListA

user32

mouse_event keybd_event WindowFromPoint WinHelpA WaitMessage UpdateWindow UnregisterClassA UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoA ShowWindow ShowScrollBar ShowOwnedPopups ShowCursor SetWindowRgn SetWindowsHookExA SetWindowTextA SetWindowPos SetWindowPlacement SetWindowLongA SetTimer SetSysColors SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropA SetMenuItemInfoA SetMenu SetKeyboardState SetForegroundWindow SetFocus SetCursorPos SetCursor SetClipboardData SetClassLongA SetCapture SetActiveWindow SendMessageA ScrollWindow ScreenToClient RemovePropA RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageA RegisterClipboardFormatA RegisterClassA RedrawWindow PtInRect PostQuitMessage PostMessageA PeekMessageA OpenClipboard OffsetRect OemToCharA MsgWaitForMultipleObjects MessageBoxA MessageBeep MapWindowPoints MapVirtualKeyA LoadStringA LoadKeyboardLayoutA LoadIconA LoadCursorA LoadBitmapA KillTimer IsZoomed IsWindowVisible IsWindowEnabled IsWindow IsRectEmpty IsIconic IsDialogMessageA IsClipboardFormatAvailable IsChild InvalidateRect IntersectRect InsertMenuItemA InsertMenuA InflateRect GetWindowThreadProcessId GetWindowTextA GetWindowRect GetWindowPlacement GetWindowLongA GetWindowDC GetUpdateRect GetTopWindow GetSystemMetrics GetSystemMenu GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropA GetParent GetWindow GetMenuStringA GetMenuState GetMenuItemInfoA GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardType GetKeyboardState GetKeyboardLayoutNameA GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextA GetIconInfo GetForegroundWindow GetFocus GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassInfoA GetCapture GetActiveWindow FrameRect FindWindowExA FindWindowA FillRect ExitWindowsEx EqualRect EnumWindows EnumThreadWindows EnumDisplaySettingsA EnumClipboardFormats EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextA DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcA DefMDIChildProcA DefFrameProcA CreateWindowExA CreatePopupMenu CreateMenu CreateIcon CloseClipboard ClientToScreen CheckMenuItem ChangeDisplaySettingsA CallWindowProcA CallNextHookEx BeginPaint CharLowerBuffA CharLowerA CharUpperBuffA CharToOemA AdjustWindowRectEx ActivateKeyboardLayout GetKeyboardType LoadStringA MessageBoxA CharNextA DdeCmpStringHandles DdeFreeStringHandle DdeQueryStringA DdeCreateStringHandleA DdeGetLastError DdeFreeDataHandle DdeUnaccessData DdeAccessData DdeCreateDataHandle DdeClientTransaction DdeNameService DdePostAdvise DdeSetUserHandle DdeQueryConvInfo DdeDisconnect DdeConnect DdeUninitialize DdeInitializeA

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

wininet

InternetGetConnectedState

winmm

waveOutSetVolume waveOutGetVolume waveOutGetNumDevs waveOutGetDevCapsA PlaySoundA midiOutSetVolume midiOutGetVolume midiOutGetNumDevs midiOutGetDevCapsA mciSendCommandA auxSetVolume auxGetVolume auxGetNumDevs auxGetDevCapsA

winspool.drv

OpenPrinterA EnumPrintersA DocumentPropertiesA ClosePrinter

wsock32

WSACleanup WSAStartup WSAGetLastError WSACancelAsyncRequest WSAAsyncGetServByName WSAAsyncGetHostByName WSAAsyncSelect gethostname getservbyname gethostbyname gethostbyaddr socket setsockopt send select recv ntohs listen ioctlsocket inet_ntoa inet_addr htons getsockopt getpeername connect closesocket bind accept