modiloader | 382c3dd22a05fdb33a488669732c1ac1_JaffaCakes118 | Triage

Sharing

General

Target

382c3dd22a05fdb33a488669732c1ac1_JaffaCakes118
Size

527KB
MD5

382c3dd22a05fdb33a488669732c1ac1
SHA1

6e28eee71a9de116f138eaccd483d3abba5013db
SHA256

20dff2c0cd0ba75a28bb8aab4c4a6918eb40828224ce86abcc20c690856dee09
SHA512

22fe1cea565a301ce63d7fb0dccc5bae28504066dfc5567554bbcf4dac84ea2002087055b49f0504028c0b23f4c7f519cc470685b25fae287748554997547008
SSDEEP

1536:1fwIER6Y+VgsB39bk6pdGxj9NMhsvX0kCTlEF0O4dWdzfbW2UVS97J0dtnp:1fwIeP+usBdVds1vEkjuO0WdmrTt

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
382c3dd22a05fdb33a488669732c1ac1_JaffaCakes118

Files

382c3dd22a05fdb33a488669732c1ac1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 602B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 518KB - Virtual size: 517KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ