�ľZ�i�SC�zD헑��rpލ�}Q�汚N��vb=���Ҵ��;A���A`�|����!��%Nw^�jHM� a�m%�j:�l+���v��> %��[.�f5�:"1�����q�<��m�ao��l�f�3�D�{�z������W���NI=�2^�S��AZQ^�@kb�v�o��Ҭ˛nn�֒�(y��i��K����ȕ� ھm�KT/��&\����Џ�W�,����.�{�d,��8[d ⷩ�U���T��mk|{�%�|f���4�����UK�ys��Z,Jz䆾C��E��Ƒ ���7JVi��p��wj%���\�.]�WS��d��]j٤o��2�ϣ�O4�9�y�?bHvIv�y��U�����]�IÖ��tn0����Д�t�[�˶�': �,%.iRK�ٰRI�DŹ�?.��3BY59cm�7 ��R\R m��vs�տ{)&��c�%��Z�KjX�P#�pų�1�/�6B���S�<�A�P���t�+l&�V�Sr����7�rQo������W��:k_����,*��n9K�Ii���Xz�-k<���u��v��g����ҝ.�봶����MK �S�h��危0��Rm��R����<����������1J�,5�֥=`���3ZAo���_�I�}V*j���3�f=�U����+��դ�Gu��X2�o� `�=itĮ�v�}�e���is�Ϙ�/'���������p�/�4�b��<���Q?x�ߛȐ5��B���[4��?X�Ŀ��8��Hrc� AYA�#�����_ u�1��%%�N��Uu?Oy�w"��o2���Y�^����锡-ϴq����Ր� uP���;�9/0B_J�!3�ݺ<���W�Fj������ �'��k�S�/�����9=,�K���9Ru��nkz�жq^rh����y�|P*�%x7ό��_��C��Ve@N\YHڿ�c�� 0NN����2wl�iM�1{'�A�*���&Ţ��7�.<e��/��������κ���:�����g���$��P����v������ऴ7ˀ�,��z��������+�j>~�E��-���Z�Fם�燞�y��ɂ��K�@���QC��^�!��wBgv3�K�1�x�Z�i����ZW_e��fbw8��}��U�:M�FHnWs����϶�Q/�mm��d�#6��0�����(2���l��N�(c�V�D��4l|\���o��}�o|�f�����gs���, �RdrHF���˦�w��L0+�1�:B�)4�$<zw�aۨrs[E���ܷ�&I}�/�����!cn�y�e FB�2�l���8��B��&;H��`7o�LA��)�Y���X��dأ!�;4�c/b��9W?"�N�k2�F}_�f��0@v��WfEt�?}A�G����(��N\�"v���>`O?�S�/M�7���jf� �ֲ��b:8 �~��{�{j"�����D �Fn��0Yw���4�v�v}i�"��H��W_�ugɤ?CV��#������o�.�=�mr�f.��^��oh8E��;'�Qff�(�T���ݧ���XHg������NW��A�c��7�1�P��Q��ID��v��p[Z��-`��: V[�>":[���cE�S���]��[?;ۮ�z����[���E����h�[���<Fy9��S~4��$D#��QbH{Iu�ɍ����$��;���� �֔�>���Xj��r �`�L���Ȧha��&ZԤ_���6 L0�����iV��Od���e��ڭU��kc'��"��ֳ�+)��n��6z���F�� {�4�"�������f?;�NyFs��*:����<%e+��}��i�{����ѭ"�r,+�Z�☰� �����ɊT�'����r�&�2�k���o�^�߇����s*J�k˵N3!��;N^�b���v���ɷ� -���j�aކ�6�I"G�\��6�s�X��ۺ�j��]���A@%Ɗ�gKn�dZ�r�6��x ���Lf�[��L��Ŀ����OY�z�<Qg(� k�W��ss���d%ɘ���)��xF" ��Fd�|��ٓ��)�e��ie�%-�S���k�>��R+;��� ��|�Cd6�Y+$�ބDw�V/eS��~�V�<����)I����t�T�������;Rٍ[�q��QV��Fו?�Z�X�3 |Z����\�����bM��C+�����$K #�GC4O;�)��NNW�5Q����j��wIC[m����}f���"�tGx*g-"���j�����Z�����p)�[@�.��O�0>.4��R��tU WrCJ�d�� &�>�{�q1���N��f�4�r�Z[t'T��?�)z��������1��A���뤾^K�8�r�P�p��X�vI2�u^O⋴n��d�Ӄ��߇^>w?1�^�Qe�s1�?���aE2/*z�I^Z�F���}��G���mzvD��P�*p������[�fE"��[��+J�G��F>v�ģ��D�8�c��z�? 蝖2�&����e}9��;��<���>���#ws����nxL������D4�U"��I_����}�w����^�) 8Y]̋��O���*(����ݲ��Z�6�l1�g��ǫ�P����ۼ�#�*�F51����u��@T�DŽ��b�P~"��ɳ��gY��>h¹�Tw'��4��`�xg�2mH�~�*��N8� ���2�\�(SM5ZN7���J��4dH�G��,�YK#W3���>?;lӨV�/��pI�6,��Hx�y���a^�E��+��1T��xY�f�Rvl�����g�@��M�)zlr�����Cq���"�>��d0%��}����� ��ȭ��!�lhP?d=�6�B4�S ��[V�8�����W�jI����ub�jL�ձ�����~gR�LD�GJ�.���}�BPZ�G)�,S�S��|�>� ��!�+��?g�=Zo�1D' �1[��2�K�sct�S?g�̗V��F%�!��֕=,g�m���k̈^}�o3
Behavioral task
behavioral1
Sample
lowHax/Loader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
lowHax/Loader.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
lowHax/lwHx-HgH.dll
Resource
win7-20240903-en
General
-
Target
df91bd7f3f791d4f3521257d59108a24_JaffaCakes118
-
Size
444KB
-
MD5
df91bd7f3f791d4f3521257d59108a24
-
SHA1
ee3eadd0fc71a2a9bf88b9aaee7ae223eab5cb88
-
SHA256
778cc0e93f124070f185cfdaca85a296ace47944df28a182a45f30824107b66b
-
SHA512
35e37a82a4c2356992c123a75f12afe02f5b064cb4074687c6473693f172efddd5c1e08298f664b3a5205dfe00cf04c60faa320f54df15112d9e7f7c7099f96d
-
SSDEEP
12288:MYpA0ReNIU1BYExD+f7ifSb7vFn7jFFv1W7LZrKbJvN/S:M4/RcB1ZMfiYZnF510KbJpS
Malware Config
Signatures
-
resource yara_rule static1/unpack001/lowHax/lwHx-HgH.dll vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/lowHax/Loader.exe unpack001/lowHax/lwHx-HgH.dll
Files
-
df91bd7f3f791d4f3521257d59108a24_JaffaCakes118.zip
-
lowHax/Loader.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 352KB - Virtual size: 352KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 159KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
lowHax/README.txt
-
lowHax/lwHx-HgH.dll.dll windows:5 windows x86 arch:x86
46a39e4da5adfe8eba0fc2464f8148c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
BlockInput
shell32
ShellExecuteW
msvcr90
_encoded_null
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
!.txt