Behavioral task
behavioral1
Sample
47329b9d6ff76e389418b4e9ff086e4b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
47329b9d6ff76e389418b4e9ff086e4b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
47329b9d6ff76e389418b4e9ff086e4b_JaffaCakes118
-
Size
156KB
-
MD5
47329b9d6ff76e389418b4e9ff086e4b
-
SHA1
6bc3078f87ca9d6c80cd5c2682bb50a8e7d5585f
-
SHA256
5daff4e98881753aae86f097c6b704c8301dea585b2e43822229f83ad6ad3de5
-
SHA512
5d9e955321f6e1429faf22eb8df5ea357c08694aef258d967631db66239f9b220d3344fda61d10f796d4db7122e13637ca4f1fe39aba706b6bbe6c7af98e0145
-
SSDEEP
3072:COmNScULTg7bRgqxXp1SaPcUl0Hc5xLXb:yNqLTgZg+46cOwc5xLXb
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 47329b9d6ff76e389418b4e9ff086e4b_JaffaCakes118
Files
-
47329b9d6ff76e389418b4e9ff086e4b_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.Upack Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE