�K�_�" .HO4�R� ֞�B)���H}�.�����U�,�D�[8iP�>R�4�R�}/ջC�<�BwC��'�m8J�.';�)�!�F�kU�s�*�ū0���o[���#Ɋ������*5�U���\S�G����<��fa�}�f�����U�CQx)��{wM��eP�q��e����I�(z��)�1}�K�j-�-��]�� 0��[p��u��i��W��1$�s�` ����Y�ey�姞}��K�$��U�X��wz��<�,/�N��5�)�CY8�x*���&Hヘ����n�d �1&uB���_�\'�3J��S��/:�5e��;9W5f}�j����u2�/�jmOK������O�z5V;#�E�V:b�/�W��p�M'��*jjUF�*?#Ü�c���(���8WЩEqc��i0,�����z��;��L,bE���&yXר�Ӣ��{l��>��E�s���2�������|��q�2�ڀ���i7{������_sq��y"���[r��@�/�-#)��Ʀ�1��0SVz�� ��oа���@�G;��Um��o�������_;a��[$�!ߏYɻx��!�O)��#�����Ԃ��ˋ��;����ِ�����7xl,��dP&em{�9���j�}��I�<��|lbss�5"Z�vSR�ٰzV������p����%� C=��[�ONY"{;ض�� D�C�bӮ:�V�n�k�1MݬƂ� �jg��͠���(,�>�wvG����ҿ�i��k�G1"��<=?�@���xGyy.�����R���x7*������5�yM���}W��d��c��`���М�'sl�;������@G�}j8��k[���ď�r�����d�oXC�J��9]�?Ϭ���T^k��a�I^շ�S���%��V�V b�vWs:W(���w�OֲKg!��)3�����\ ���V�vlќ�)� �������-f��Y��81��[70��u�f�@#��Aμ���*�P��4���Y?�!Q�D� QTˊ�:��������YG\�Z�]7q���H6�t��M��j�A�L���Z��ۆ�!�F�i�T�p�t/9��4��ǃh�� -=�*��+�f����x�`��<�T�iMd���)$ȹ;�W��n�RJ \{��,篾K�����o�i�c����;�C8����:hk�/�F�䫊�s!@�=��m��q������/'N�A��n�[��F9�W��rNGf�X�������h�W�?:��[��7V�(�s�_��V���r�UX��:utB�ҫҾ"I����\��� ♯j����` �����3W>�1 '���a�����7�]s'�U-ėw�4 =�R{˃������o��G�X�T����)b<��R�cR^��V!V)G��i�����l�A��X�w7D2tOhӿA~�� �邍~E�&�YeJ�=ǽ���1�YrA;y����g�8-^�Ԏ:0q`�q�����!/��C������fڅC#�&56VO��(Z��|�t9:9�y��y����O�f�u��&���4ow^��b��t}X�fQ�h���L{L���8H�Ƶ~�$UT�Z�L^젏{>�F�m��49ivF,� p,��^�xUN��-l:)�}Ҏya#+|�.m�\�~5�^D��! �����%�{�rQZ��jX��sfǶ�!����Hl�Y����n��p8��K�Aa.lG�v�>X+ޜ�bf�6>c)9�@ ��Z�,�S{L�vk�,��L{U�Vtο�WGf����l�ʌ�Нݭ�MZ誴� 6C�������r�pu�ac�e�"7���خӭ>5¾��b�յMkm�,i�0TQ��`R�Nχ�O����)���v'�7�=��Oj�z�ҍ�@C�������1�Z��%t d���J��zM�u�{���K4q�+��x� �����E�/Fd���VR�3v�^�P�y9:���G��*���M�l�����������`P��x�Ɇy����>�����-���G��s or�����ZJ��v(�&G�դܜ�?U���O��OP��o�JxQv��`���+1��e: ��{_!�EP3��I���)��`�'��Y��*h��fJ�-� '���b������b�m)�4- aX�I95�<B� a%���4<q�[m�@ь��P�v��s#�*1'����y���F!����n�a8�oB�����UK̗�rQ�՝lu��8QT0z��{HRo�z��=���e,�����&{$Q�A$��l��P�Joc$.�Nnm�5�+�Nc����Pj��(�ɍ�7Q8C'@쾁Ko_���+�̷��_�/��� ��/���Gȍq�S�̴^�|Ӣy��c =�-��Tsp8 �ގ��کJ�y�m�! ��$�24^1���;�T@Hw>��g��x0Q�b�cd�+ ��?q� �$�"!R`��K����0���B����K ��v/���Z����z���o��\Ɨ�2�w�$�@:3��G��XTwEJC.��91cC=̫��(��$���B���^N���{����Phy�����RZ ��k2����ovrN\�D[�"�ߊ��ɖe��@�NwX�Ԕ����]�y��nx��Wڞ�0r}j�DE�C��v�}�Bq0��+(���y����'� 00��TC�G߾i۷»)�l�J����@f�F|v�XA/$�w蓚�����hf�M����k��|�Zh9`�& ��ܤqB�.�@q�T�Ԏ���>�a��ci�JƇ^��t���i�^0Y�1��31?{F�p��?�4��B������:�����f��e��Z}�M���:eMA��-1oc&�Be(����0>�J����.!��l"���E��y�,�*���8)��^Cǟ$��1���.f�Y�Q�ѡ�#��0T�3no�˷p���Y؎�6*��_ٴG�X-�2 ���:�O�W{ �)�\��a��ם�z�v�#�����U���K��\ & s��C�{��NT}�yC$x!����ݣ�(�C�^6=��L~����/�Ld/蛢�7�
Behavioral task
behavioral1
Sample
IHLoader.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
IHLoader.exe
Resource
win10v2004-20240226-en
General
-
Target
eb52096e09431153285d7952c15fb865_JaffaCakes118
-
Size
275KB
-
MD5
eb52096e09431153285d7952c15fb865
-
SHA1
8f18e39d6d324a30df99d8191b80a6d026175c77
-
SHA256
a55a40328c94d8cc58b3e45bb0cafc4d357f2d8581a56ab5efc3d0b0f47ac11b
-
SHA512
dc2ca207ebf0c884da17bb62f355406a6162666e90a2a3b1b061405b7e509bc0c420e4d385c0c68b34f29264257224e5ffd2762dde9ecf159cea9f7d81e00cb2
-
SSDEEP
6144:XHVFbbAHDfi5RxIA5cIX428QTHM741SObM+VhOzM1s5SbKh9ygC0:X1Zc+qf8M78h6r4y9yr0
Malware Config
Signatures
-
resource yara_rule static1/unpack001/IHLoader.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/IHLoader.exe
Files
-
eb52096e09431153285d7952c15fb865_JaffaCakes118.zip
-
IHLoader.exe.exe windows:5 windows x86 arch:x86
cbbbf9b52561a0df95418abd12377c99
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetDlgItemTextA
MessageBoxA
gdi32
SetTextColor
advapi32
RegOpenKeyExA
shell32
ShellExecuteW
ole32
CoInitializeSecurity
oleaut32
VariantClear
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 247KB - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ