Behavioral task
behavioral1
Sample
6348a0543028d65ccd30ca5a5d7dd285_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6348a0543028d65ccd30ca5a5d7dd285_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6348a0543028d65ccd30ca5a5d7dd285_JaffaCakes118
-
Size
368KB
-
MD5
6348a0543028d65ccd30ca5a5d7dd285
-
SHA1
f3e30ae094826d8ef9a0d0eb15dbe466705dee73
-
SHA256
77848553a2e1ebbab082b703f4105857d92d20f6b9e496143f219add920195f0
-
SHA512
877cb956d9b6a9a6a03bba9072dd1bff3713f44156929130b0cf2424c12e140e83d2abf923e9042f033829aef75e85c2f5b52891d7ea8cfeb070edfba20cd557
-
SSDEEP
3072:PmgZfY9KX4UJOZ8M2HGNN5RckXSqRkzWI2G8PWFM/e:FZwUX4jZ0HW5RfS552G8+6/
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6348a0543028d65ccd30ca5a5d7dd285_JaffaCakes118
Files
-
6348a0543028d65ccd30ca5a5d7dd285_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 359KB - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ