Behavioral task
behavioral1
Sample
d4994f6c208e555552978ca63fe72363_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4994f6c208e555552978ca63fe72363_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d4994f6c208e555552978ca63fe72363_JaffaCakes118
-
Size
3.5MB
-
MD5
d4994f6c208e555552978ca63fe72363
-
SHA1
0b1d81c1b7bbec42ac4cb37f6fcfe8f47aa911ac
-
SHA256
912d408012cd7a25ea6284b3a835c30659d2b9fe203abb04a07f175de698b68a
-
SHA512
c677e949400b2988a2ee266384dd8f4e35e9e796f7539ada710824d72e88a877fe26247b53c2ddbd68083294411d5d4b34212943c7d44b540b4b31bb3f8837d6
-
SSDEEP
49152:C3GMo8T/kx6d6NEZMdA7W9Imd1RWYz4e1xHa/HBqcAOa+LT:C3Bo6vdfG0W9BdLz4xBKOdT
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4994f6c208e555552978ca63fe72363_JaffaCakes118
Files
-
d4994f6c208e555552978ca63fe72363_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
Size: 664KB - Virtual size: 708KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
WinLicen Size: 2.7MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE