modiloader | JaffaCakes118_00ca404579121f88d4ac1b8934146005 | Triage

Sharing

General

Target

JaffaCakes118_00ca404579121f88d4ac1b8934146005
Size

17KB
MD5

00ca404579121f88d4ac1b8934146005
SHA1

051d3155ffd3075a729ba88aa2b65e42358f2d8e
SHA256

768fb3bf2fb98b914d90df05e91db2ba14378b4e64c85e82ec09a8f45b58d3dc
SHA512

89b7f659df52d8d34cac2fb04923dc6eeea3b7ffc2387ead74e0b9234050ac4b286980280dbc82de765409cc1be4c943d1bf5a31d8858694fe21fbb70b036103
SSDEEP

384:6phOmDzSIR/VJZ3apj6q7a846Yr1nbmVGMB7r2:6ph7rtvGh+88byGM9i

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_00ca404579121f88d4ac1b8934146005

Files

JaffaCakes118_00ca404579121f88d4ac1b8934146005
.exe .vbs windows:4 windows x86 arch:x86 polyglot

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ