Behavioral task
behavioral1
Sample
e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118
-
Size
63KB
-
MD5
e38fe16fc51b3c42bef629ed62969f64
-
SHA1
cf295c7d03811b12dd897d3d9e711525c97e7897
-
SHA256
2aa84a58339db121008c76c2ce37839c11978f630ea862149d87339da0fb5e2f
-
SHA512
47f60e9081a501d06cabc01f5fc8d4c3cfef75ca21d5ddab3e578a5375dc3aa458dcba8c1fef35ad4c414938ed64b881793df3994e6933c16b9a27ccc5719b86
-
SSDEEP
1536:HJqEVsjMnWP8GfbqxlspHBhf07ZpJjOzov:VVUsWUHlmuZpks
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118
Files
-
e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ