modiloader | f3c5e2979473915ce47514b9a9a0991e_JaffaCakes118 | Triage

Sharing

General

Target

f3c5e2979473915ce47514b9a9a0991e_JaffaCakes118
Size

90KB
MD5

f3c5e2979473915ce47514b9a9a0991e
SHA1

005501244bfe45e4a4f02ff5ca0dc2c728e56057
SHA256

d804fd595e9008d7b90bf18c2ce3680a5a7f9bd609629db3cb2dc602cd5c2cb4
SHA512

3a89c92f490141a058ea294e2457fe6f123fe525fd00b6effed87b3bd8bd62228c957c489c7e1117319820cb7347c02ed58cbed946823b3f41769a832f099488
SSDEEP

1536:C9Pcb2OD+70Q8kIlHEOkXGHOUkXdtg/WqrT7J1O1CX1XFfpup7c9ipR:gcb/D+bFgjkCX1VQRc8pR

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3c5e2979473915ce47514b9a9a0991e_JaffaCakes118

Files

f3c5e2979473915ce47514b9a9a0991e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 333B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ