Behavioral task
behavioral1
Sample
952f1d3e07108dd38f5669cb8e132d55_JaffaCakes118.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
952f1d3e07108dd38f5669cb8e132d55_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
952f1d3e07108dd38f5669cb8e132d55_JaffaCakes118
-
Size
313KB
-
MD5
952f1d3e07108dd38f5669cb8e132d55
-
SHA1
55c3dc70699d6d3eb47feb1609067c9e8ccbc11e
-
SHA256
bd7ee5655669b5b175b85e453c05b22e1afe7e68db8c2126a0be1beaefba3413
-
SHA512
15bf9839e3d227b5baaf5e4038b632f4c7f095a2aab0800f063d3a118324a5fef9b7fa401eea63380442f1326b5983ac8c6418a6f44c121b9b5303cffc8fe7d9
-
SSDEEP
6144:yG377xS2Vp2CeiorXhwTBN53ppcCJJvHPdQoS:hr7xS2Vp6FwTTbJJvH1QoS
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 952f1d3e07108dd38f5669cb8e132d55_JaffaCakes118
Files
-
952f1d3e07108dd38f5669cb8e132d55_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 204KB - Virtual size: 204KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 106KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE