Behavioral task
behavioral1
Sample
JaffaCakes118_6fb5cbb27fd187a60bcbca42bd221a5a.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6fb5cbb27fd187a60bcbca42bd221a5a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6fb5cbb27fd187a60bcbca42bd221a5a
-
Size
1.1MB
-
MD5
6fb5cbb27fd187a60bcbca42bd221a5a
-
SHA1
74e51a2ad61959482fc51e0ea8f386f154a264c4
-
SHA256
64e9a2c3997b14ca24353ab4fc1c3da5816d64727ac1b1043d50e7320ae613aa
-
SHA512
d2e78e5868f298a750b0136148d8d589af9ba49c177cea2c8792c2d9790cb26b4a581cd7b6eabdf10d2de450d0fb1014fef8b474ff1d7bad070c0bb3691ffc94
-
SSDEEP
24576:I+atOPKlGiEICoecb8L2TTPtTYnPRYeTZdHWnpnxAXZmt8:IibD/Me2T5TiRYWHE1mIe
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_6fb5cbb27fd187a60bcbca42bd221a5a
Files
-
JaffaCakes118_6fb5cbb27fd187a60bcbca42bd221a5a.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.packed Size: 768KB - Virtual size: 768KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.RLPack Size: 367KB - Virtual size: 367KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE