modiloader | JaffaCakes118_c6c33e30078c9577b66f92106906c75a | Triage

Sharing

General

Target

JaffaCakes118_c6c33e30078c9577b66f92106906c75a
Size

48KB
MD5

c6c33e30078c9577b66f92106906c75a
SHA1

cae6512fefe0c03e46930940647f169d4d2abd70
SHA256

2a321ca4cee795ed1a6dbdd4570bbb8a6edcf3fe6e3163db4d8f5c61a9a2b879
SHA512

738ced1b733c8229304b1dde073662b62606df26a94f957ce62c68fa4fa4710c73edf7b20d579b2f2e2dff77c0df9e299aded05524e9d46719f16fa8817d8f88
SSDEEP

768:111qkE/N4jSpYxgcEIrhyQvYP1h3BtB16YYmfnVZT4T2eWHMTo1LCDFgX8m0qArF:P1qkE/h221fQQ8oVZT+WHSoJ0YTQ1

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_c6c33e30078c9577b66f92106906c75a

Files

JaffaCakes118_c6c33e30078c9577b66f92106906c75a
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ