Behavioral task
behavioral1
Sample
76798b3e843299365fd224f0bf0a30ac_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
76798b3e843299365fd224f0bf0a30ac_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
76798b3e843299365fd224f0bf0a30ac_JaffaCakes118
-
Size
546KB
-
MD5
76798b3e843299365fd224f0bf0a30ac
-
SHA1
7d0e06f034ca7c67f0b44d3e32ec7f0a58ff3edd
-
SHA256
69478c0f2b49592b2c5fb884e60ecc06923e84ad4fd6373c650c40299b42275a
-
SHA512
1780b3e30326e33970a3218e156088a5380d7da64606fb16ed8db3e031728c955818456956c643b496b34007c74df1a5e5215c67800f33cae3a23db3820b89ac
-
SSDEEP
12288:3h/aG6A+y1vbS+Vnjz936iOnQMkcB84spBKYBuR:3h/eA11vbS+VjZd2QMkljpBKYQR
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76798b3e843299365fd224f0bf0a30ac_JaffaCakes118
Files
-
76798b3e843299365fd224f0bf0a30ac_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 479KB - Virtual size: 479KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
520mm Size: 22B - Virtual size: 22B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ