ServiceMain
Behavioral task
behavioral1
Sample
34e8704a37331da6eb7f92f7c58ef203_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
34e8704a37331da6eb7f92f7c58ef203_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
34e8704a37331da6eb7f92f7c58ef203_JaffaCakes118
-
Size
391KB
-
MD5
34e8704a37331da6eb7f92f7c58ef203
-
SHA1
6a39f00c1defcc8a1c8b9092aa6e4a15247e059f
-
SHA256
a96eabc5f9d56cda918199f9714d650d15682ac2f8a47e1f2f14eb0f9f0fddad
-
SHA512
2a110b3e8e71c741d7f4b0dd3ed22406ab529da2b9ffc2532662e209f0099aec8f43a8070ca2d4e47f05df8202abff79334e5e55b8708af3fad6fcec384ac4ee
-
SSDEEP
6144:bSWB5uzKnT8aeOnvfz+0gWmQ5MONq0Z0TcQY/DGrHShTBhuE/Y:czKnIarnQWmQ5nkjTPY/DGryhTuE/
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 34e8704a37331da6eb7f92f7c58ef203_JaffaCakes118
Files
-
34e8704a37331da6eb7f92f7c58ef203_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
CODE Size: 329KB - Virtual size: 329KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 73B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ