modiloader | 69299636a2fa6a5f6354e8440daa4d1a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

69299636a2fa6a5f6354e8440daa4d1a_JaffaCakes118
Size

102KB
MD5

69299636a2fa6a5f6354e8440daa4d1a
SHA1

187c05ec435b426f4b30934b0500f87c810991a4
SHA256

d5b0ec44da1ea4cdb05707992d0172e6c4bc04a5abd0879d9696790f374115ec
SHA512

e5c8ba8bf58dfabaa4b99afc3a70994d4b0e98cd392eac6865a2052324b71ffd505ac19ff41d9f0a860306411cc6389e24594d0f009d96a2bf7e290d71cdf2b5
SSDEEP

3072:a+iMEQxhk7MQFoP+N7igidA3nEn55lg+FvW:a+iMEQxh8aPYMfFvW

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69299636a2fa6a5f6354e8440daa4d1a_JaffaCakes118

Files

69299636a2fa6a5f6354e8440daa4d1a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 750B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ