Behavioral task
behavioral1
Sample
215ca962174e5ffb31feb3e305a87040_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
215ca962174e5ffb31feb3e305a87040_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
215ca962174e5ffb31feb3e305a87040_JaffaCakes118
-
Size
236KB
-
MD5
215ca962174e5ffb31feb3e305a87040
-
SHA1
92b65221778b58aa703f408cbea525dfdbf5f930
-
SHA256
b54c460f4701d33b846218f49bed7a42e8ee209e81f19f44ff9d31e2a8be76b0
-
SHA512
7e21d258971fbab6fa69f378d35cda590ce7c591f7f6893ea8cd5b451f11b4dfc06efcce6252729302eeb1c2aa2f4c9dcdbab7924cded0c387475fd9b00d5bb4
-
SSDEEP
3072:ZpUe/VIWEF6lhnxTpRWYMt0+bF3735PcXSkuWC45mMzxK9uwqmmXVUq5lwsE8zpk:ZpxXPTpE7PiSJWtVdoGp6jZ
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 215ca962174e5ffb31feb3e305a87040_JaffaCakes118
Files
-
215ca962174e5ffb31feb3e305a87040_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.nsp0 Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp1 Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE