Behavioral task
behavioral1
Sample
6a40e83b42b965b1b7ca756913bac43b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6a40e83b42b965b1b7ca756913bac43b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6a40e83b42b965b1b7ca756913bac43b_JaffaCakes118
-
Size
679KB
-
MD5
6a40e83b42b965b1b7ca756913bac43b
-
SHA1
09ce9daf17b48e8ebddf00457d2dccd0aaa10553
-
SHA256
4494d17dbeda29bcf48f2886ab4a126e6912bdff606a019232e0caef08c1d92d
-
SHA512
f189d6559f3498e26eb57562824647a2eebf2f9b8ed258bc21afe66800cb3a3adbc1c2c7062668923bd4606ba905f4ac4f3461e9e2da705102ce72421f38caa7
-
SSDEEP
12288:B09I+tyyYFM1K/NKqWbhbWrrZMAsuLt27T:MVyVFM1ClW2ZMAdt27T
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a40e83b42b965b1b7ca756913bac43b_JaffaCakes118
Files
-
6a40e83b42b965b1b7ca756913bac43b_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 614KB - Virtual size: 614KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspr Size: 32B - Virtual size: 32B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ