Behavioral task
behavioral1
Sample
d5b21632c98e67989669cb23167b5dff_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5b21632c98e67989669cb23167b5dff_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d5b21632c98e67989669cb23167b5dff_JaffaCakes118
-
Size
1.2MB
-
MD5
d5b21632c98e67989669cb23167b5dff
-
SHA1
0977e6e0ae0a9bfd8aaf70ab301f95b37e7357b0
-
SHA256
c9fd5f9937a5ab7c2ac5b09c4af91e97239d44c1fa01d043bc8ec84c2061403a
-
SHA512
6f89c50087bdd8885a8753eba01f0578adc552a20d160fb70283d2f3609b01c7e1738919467836910d2e6fddd05430a5eb599684fc7948960104edb1c60ddecd
-
SSDEEP
24576:4c22T7BRS46kqBYhcATDP2+B3L3gXIAbPR9:4yFhrTDP2w738B
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5b21632c98e67989669cb23167b5dff_JaffaCakes118
Files
-
d5b21632c98e67989669cb23167b5dff_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
�*!K0 Size: 660KB - Virtual size: 660KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�*!K1 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�*!K2 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�*!K3 Size: 372KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�*!K4 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE