modiloader | d1ba603ae30ed4c03082f7b38f6e6d6c_JaffaCakes118 | Triage

Sharing

General

Target

d1ba603ae30ed4c03082f7b38f6e6d6c_JaffaCakes118
Size

735KB
MD5

d1ba603ae30ed4c03082f7b38f6e6d6c
SHA1

63c329d1467b20fa7629bb4fc01f7070c27f32da
SHA256

8818ee2902287da0a214143a7bf94e3fc11dbd4b1054cd4f6b12baf5d7580966
SHA512

f8e8183fcdfdd530e2de2963b143424c346c6b27045f28ad77ca7729b814a7cdf99fe1817ccebf8fb4da5574a47e488d1250c7074ce7703dafb027a2ab78366c
SSDEEP

12288:rmX53KYzEkDAqAlqTfkHyirIIDCc8Jt+x7u+8wlFCR1EmMlXTEK:rm5BzEyAlqTf2yn6sJwCECR1EmKXT3

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1ba603ae30ed4c03082f7b38f6e6d6c_JaffaCakes118

Files

d1ba603ae30ed4c03082f7b38f6e6d6c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 629KB - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 5KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 20B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ