Behavioral task
behavioral1
Sample
2b0c17de8f1cc0bab88c873ad2ae5161_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2b0c17de8f1cc0bab88c873ad2ae5161_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2b0c17de8f1cc0bab88c873ad2ae5161_JaffaCakes118
-
Size
517KB
-
MD5
2b0c17de8f1cc0bab88c873ad2ae5161
-
SHA1
2b7a904c9417843094b805c5e493c1158760c942
-
SHA256
1d017b2c68b42011171f86a97b1bd20dd46a35b71a5fcea3c6b3fe33709430d9
-
SHA512
c12f42efee0b56d60ea6d885039d4dc5a31670bd79fac66846e40c4612f402180622ef607e32be4668cc215162900f9a9fa98a0282fb20ca3813019645b94acd
-
SSDEEP
6144:+1ITdBNJh0FPp8KVxSzwR0sYj/cf0rfBYBDkKZWGZFb5P1WrPGV0A:BTdFh0tFxAwRc/cfOfBYGKEGbb5m+x
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b0c17de8f1cc0bab88c873ad2ae5161_JaffaCakes118
Files
-
2b0c17de8f1cc0bab88c873ad2ae5161_JaffaCakes118.exe windows:1 windows x86 arch:x86
cf7bcaca6163794dcfc99a8990613c45
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteFile
SizeofResource
LockResource
LoadResource
GetWindowsDirectoryA
FreeResource
FindResourceA
CreateFileA
CloseHandle
GetLocalTime
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
TlsSetValue
TlsGetValue
GetModuleHandleA
GetLastError
GetCommandLineA
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
ExitProcess
CreateFileA
CloseHandle
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
shell32
ShellExecuteA
user32
LoadStringA
MessageBoxA
Sections
UPX0 Size: 512KB - Virtual size: 512KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.packet Size: 1024B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE