Behavioral task
behavioral1
Sample
c8dcd363a277d0fb9b1edbab1c4f514f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c8dcd363a277d0fb9b1edbab1c4f514f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
c8dcd363a277d0fb9b1edbab1c4f514f_JaffaCakes118
-
Size
708KB
-
MD5
c8dcd363a277d0fb9b1edbab1c4f514f
-
SHA1
67e93343a7b8188e937b131e0736ab7c7ba37ef0
-
SHA256
e0ff592b195b3f5a040f6ba06eee7b3726657443017989245c486cf37bf6511a
-
SHA512
1d0e32fe4a09818be43e411c5280ebc7dc0e0db3106bc8f4784afabbf1a1aae19cb9700616948915996efec36e0c7b3f31ef96acbe17f19229f73bacc93a9279
-
SSDEEP
12288:tglx4CxSr1hKdOactGbPbo9Lb9zqS5flnyw1pra6iGR/TkuL:Gljx81hKdOalbPbo9H9WKyw11iGR/Tk6
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8dcd363a277d0fb9b1edbab1c4f514f_JaffaCakes118
Files
-
c8dcd363a277d0fb9b1edbab1c4f514f_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CDLock Size: 608KB - Virtual size: 607KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CDLock Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CDLock Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CDLock Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CDLock Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CDLock Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CDLock Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CDLock Size: 175B - Virtual size: 175B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE