Behavioral task
behavioral1
Sample
ef4a72a05964e44be244e4619e3eed47_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef4a72a05964e44be244e4619e3eed47_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ef4a72a05964e44be244e4619e3eed47_JaffaCakes118
-
Size
2.7MB
-
MD5
ef4a72a05964e44be244e4619e3eed47
-
SHA1
8b0463b635c9cfc2d88300f8c9872b6a931675b1
-
SHA256
6ab2ffbb7aba2d4b2db3e9278cc8bdba460c9e46baa2f4adc2f004bf85df71a1
-
SHA512
f176ae5bbdb9dcc189225adb12ccc353082a2400526817e40c7c63c0b53e106cd75b90eac7c04db6870b416dbf79a348b8682f027708a0ed61084e891ae525a1
-
SSDEEP
49152:l9TMmPonATjhuIYJ3erpCX2e41YrVioUaNFYzO5tfDZX2IicWNa8B7tybRhHNmzw:l9TMmwnGhuI0e4XT41Yra2FY+XX2Iicz
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef4a72a05964e44be244e4619e3eed47_JaffaCakes118
Files
-
ef4a72a05964e44be244e4619e3eed47_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.naked1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.naked2 Size: 576KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ