modiloader | 4963964c6c946961a1c0f6afb0776f14_JaffaCakes118 | Triage

Sharing

General

Target

4963964c6c946961a1c0f6afb0776f14_JaffaCakes118
Size

35KB
MD5

4963964c6c946961a1c0f6afb0776f14
SHA1

af1becdb047de870cda49f9036e84fb52b1ec6f9
SHA256

a969d78d1039f75d35a049b5a799608ef834b32d154a183a6365ddce25f5cddf
SHA512

5ae9125d1664594b481f03482a9117d3b81d4ee6f9099dc0162f3013bf802c4599b511d899ec39933a11309f4b40c2acd062416dff0f9484420aa994f168ed6e
SSDEEP

768:Ks8Nd+zgQTB5+aBTCjMAd7G+EfTte+uf2Qb9Rb:Krd+zx2a5Cj/dC+Gsjz

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4963964c6c946961a1c0f6afb0776f14_JaffaCakes118

Files

4963964c6c946961a1c0f6afb0776f14_JaffaCakes118
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ