Behavioral task
behavioral1
Sample
646e1566dc324f27dfb219088600ec07_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
646e1566dc324f27dfb219088600ec07_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
646e1566dc324f27dfb219088600ec07_JaffaCakes118
-
Size
1.2MB
-
MD5
646e1566dc324f27dfb219088600ec07
-
SHA1
e7fd379ec3b9313e7078508a2af4302132e8a02f
-
SHA256
fec692a335068e6c2ff75218afb8bd2fdc75b5049e0894a3eed5638bdfbfc412
-
SHA512
58cb77dd363726c889ffdb6c2075f83da5ddde28557e46496f557a1f61675cf2d0d17d0eee28711298427fc0cf9bcbd844622558eccb6c94bf8f7bcdbdef8990
-
SSDEEP
24576:aTZIrcACeWv8gGeWv8CjmLxQ3sS5XREDgQeWv8:aTuCeWv7GeWvpiazREsQeWv
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 646e1566dc324f27dfb219088600ec07_JaffaCakes118
Files
-
646e1566dc324f27dfb219088600ec07_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ