��~�'ǐ���}y8q���ʺ��� �`2�Yֺ�V�s_��G����'㠝y���I��V��-~h�D�<ߦ��݂�eu����͢ ��~%8YA�B4�u P�DB���!��F*��ۧ��%�����8R���{˜!.�%��x�N-�5��q�pK{�V#�r���.6�6�3ˆ�J5|@biK�uί�Jt�y���Z���?z-���b�L!!Z�R�� �v�]�%��۔�5��T�Wyr�=��5��h�Ģ�½qz7��u2::�W�-�� �Le�zG��oit���x\��YD��F�y�C�^��iшGx� z�Z�6f/�10�@� @Ws�<T�W+�] �}2���Һ&�=u��b���HuB�L�{s� ����Sݷ��]���E�%U�� �ѭF��z�K!��� �*U���^�8����l�3��I.�l��+`c+_�br���go'#��4>>�e�j�M�W�#���1_h2��p)X�@G�8^���lBEӔ+!�1�����*��#H#H &֢�y�z����#��Xa�9���(�6� �E��<��A/�\g��ٙ�_:�6���Sr��b谖�%���h�UX[���"8":�9�,*��=�����Q�3�1ű�S�Ⱦ�{�(�����9��� 3]�4�#?E]Xk�~�L�e�g�8 DOk�@nk�57S =�~K���O�%i��c5+�ݥ2��T�a�#!KD����@�{o�o�?�uȑ�{��#�Ҝ�?����[f� �K�)Ѯ���j��L�!W1e�����tP��{&�����1�ܴ�͍݄����i@��p�b�3�[؆8��`ijƏ^,�*��h��hi<ҔǞ��q�.Q»�|*%��ƴ}�������s��c^��ar�e�����z�4��oF"���a��jj���������?�B1���%K�{��h��Pa*v���5�bhz�^�/U#B�qm1�N��/3C�h���H�md���z�Mk'�0A��ؾ�J_��I�A�J��P���o���QF7�Ѓ"K��&����t]�Ө�^����7��L?�=05��!��P��L�{�8�u��@4 ���v�BԎ��L�j�u}Z����P!4���n|+�INB�4�ͫ���\���������kp��� _��Zma��-|�zr�GE�D���ƅؓ�� N6Y���idI�Rơ���ꥆ�(-��oƤz�:�������Avo&�Z��Ƶ��-2�_gۯ��F��;$��k�*�����^Zo�����[�<�`1r��-�=&����r:Z�y0�[���<��z��j[^\A��WM �z���j�d��o��>����� _LZ,eSE��`9@&�x��/�����ݰ>�s��ŚC��>]=7o�C:ռ�d\W_N�ð3oRthy4^���}�����ŷ���>�t$^�,B���r��ω���Ar�cG{ ?A�DHc1�#�t�Rܫ�����V���}�.g)M<���}�z"Tt�V��ӰD��ڊ\�AJ��[ز��+�����=Q�0����&kq���91G7q�Dѭs���;^*̼v4~T/Jɣ*Ћ���E����γ�@C�aLkJ��=��A�Ӻ8.ez�W=��Rk�A�/�}���^r�� �4�|`z��a {���r�2W_X'�G ���u6��t�I�-S���٥6�g���Ҝs�q-o^�M�,BI�AJ}��G�,��6�CsŢ �C��z��Z)�Y/7v5f%��u�ة����*�3�_zLW� ����W@��������G���>�$�3��]�����pm%kt�fs|F���3b�Υ�N��I !G�f�Xp���\l��M�m�<ӵ�Ν�m�q�l�I8ɚ�u��;a�h^@��o3M�a�Qpol9V���fL.�"�x$��U.ɲ�����=�?��t���\'�<5���Gk�gņ�fD��8��`W�\�|�7���`����xy�aQܟ�%�n2f.i +��Tm�̳��1,`��{��'dQ�P�pJ��5%Ug��ynS�Ȝ_����Ku�ۨ2@Cu�`P�_��?��h��݇�Y�W���6r��l�C8#Q��0'dj}�X��YՄ,c�h^v܆!�i��ʠV��((JG@ȯ�Aw��pD*��Xq��D��O�f��o�.�B�^x�@w�d?�s����L]�,��Sڜ.�J|����*kDD���h�Ւ�����'�(V����'��!ܤ;���|H��� �p_�\{Z�&T�63!�т���g�d�)�RB�2���Q8~�_!T���# yE�W-g�S!$P#�p�0�s��]��� ͳ�md.�����]�0#�atK$4#�lj�_1V��pkfz�P,D}�:0pM �&���ԾMË�?�ak�w��B�9�#ٳR�Z�>�Z4d8 ���=�I��ی��ei��ǩ���,���n��Y� v]֓�\a�>3�T���~*�)r������S{X5�~Ğa� ��>�6�G��ρ ��+Lvn�ɡJt#��j�kV�H� 7@5�R�����CF��ȗ"���,��N�*P9Dɔ�(ȕT����O�-��X%��������uv/��ܲ+�Ĕ�څ�����4y�,�ERT���4��䠀�1�碹OG��������}�+N���n=%1�?�$/Rd5B��+�r��c�g���Á����і�6�}d�lr��=��]9�-�A�o�A����=0��܀��J����r�]����]`�CB�ߛ�ZAr#֜A��b��c!��K/�ᏔJ7h���@7��CHe��D�>?[�s�ۙ�[ �Y�/$h�4Q�����9�>�L�r�C�]�>�!E6�N���2��Z��8���il�1���'�~=���JU�]D�[?����$�+��u�݅TN O�V;��݊}8r�i���0�H�7���~<�����ƅ�rɷ����� B��i'��I�q�x?��¸[����SE�"`Ez�#l�uJ��os�Z��[�7hK/�(1ki�!0��`'��>́�&Z�{��5Zd�
Static task
static1
Behavioral task
behavioral1
Sample
SleepD+15TR-LNG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SleepD+15TR-LNG.exe
Resource
win10v2004-20240226-en
General
-
Target
c27666876d961978189367faaa25773f
-
Size
1.9MB
-
MD5
c27666876d961978189367faaa25773f
-
SHA1
dda489af59b676be16b803b8a38819233f31c5c4
-
SHA256
42be0b5f67b95907c73a703b3d9611cd64e4dd20b9e33dbaae7f67cc08eeca43
-
SHA512
561fce32517d42e166cf388420b2443f5b0a924130d43c0cd7e30335f2faf832d232b082c63c88bf81c64dce9ada5dab6fb53ef350dfcca6dc62084014c0dea3
-
SSDEEP
49152:TNEA7Kzx8/I3LQgZYqTjkIzsjJHi+sZqISmfqnzcRG5+th/:T7ezSsLBZYqfvgsZqmf+6GM/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SleepD+15TR-LNG.exe
Files
-
c27666876d961978189367faaa25773f.rar
-
ALI213.txt
-
SleepD+15TR-LNG - I.N.F.O.txt
-
SleepD+15TR-LNG.exe.exe windows:4 windows x86 arch:x86
e71be929b41f3817b797481013407253
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaExitProc
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 942KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt