Behavioral task
behavioral1
Sample
76dbe18ecd5b5b89e1b67422f6dc62c4_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
76dbe18ecd5b5b89e1b67422f6dc62c4_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
76dbe18ecd5b5b89e1b67422f6dc62c4_JaffaCakes118
-
Size
589KB
-
MD5
76dbe18ecd5b5b89e1b67422f6dc62c4
-
SHA1
57b9316a5ee60fe1cb400a52438985059bd9efe2
-
SHA256
62abfb784ac9f7432053dbf9ec8b6818a298674b50a0912e26b49d932b86539c
-
SHA512
f7cbd16dd55027a3bded09537ecc12e81572cd9b8b6f8f46e86bbe09f6ec5acb46cde9e06096ae84402f8b8d11d2d2abfff26ba6c1c160247bf991940fdb826c
-
SSDEEP
12288:OiqXDSUn+eAqnnkGZus0ELd/Oaf+fcVADdreCVT:OiqWAyqnueEaf+fcVADdre
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76dbe18ecd5b5b89e1b67422f6dc62c4_JaffaCakes118
Files
-
76dbe18ecd5b5b89e1b67422f6dc62c4_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 552KB - Virtual size: 552KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ