���F����6O;�=���+y��6��y�K���� :Y>�A =4-���"c$����@>��t"�r7�P~�S �u^�d�� h��$8�Q�-�;�c�,L�>uu�^=�JO(br�:�aF�l'��d�CuA���s.h�@|sԽ� m�?9&�aѠ�KJc�d���_G3�DOm�l��?��aO/ZF��r��/�����D�o���p��8H�+�\(�O��"�����$G�ݱ��Ɇ ��M�4g�V�`��9pj�S˟�=)Y�c�� �l���$�w�wqCC���4��sG��d�tϐ�p� �O|���y1�SOs^ύ+��������~%�q}T���A<3Д�ӯ*�F�\s��E��)�B��:H�u7�������a��`������&�t����Y��$�X�'�aЯ���y���B�)�C_��\$�N�G��,���ѿ���ΰi6���\��}���:o���K0`��0�v ~�2��o3�g��ɰ� �e�I7/R eD5�7���0X�/�g�[&��J�埣W�S�n����m�+;�&��%��=z������9�U���qx���|��_H-^�ݽ%N�S�������aG�P�ɲi0�Ӛ��@�n��,\1wo0� �B�FQ=G�|��|������N@4!���!�z�~>ec�cJ�c�F���B�%�F[�z~t\ j�T� K��H�'��ٯ'f�������E��[���\ּ��q5���7���G��rM�<ѧNX������$��}�Usǜ?� �&m��W���1���`ޟ��w;7�"*3���m;��":N���o��y�[�w�ftJ����=��6�?,,tAڏg���`td3�H�t���7=⿕a�������OԷ6{��t`�̛F>�S�p\��Jh�w���9�� e��P@v�>ou�/S��>8(�N�8����b�T�]�-�K�}5���_3����p�RI��9���ȸӽ����n�f�ׄ�D�3-B���H���>��]z���~;��b�C���Y ������߄6�� �'b�iq2�R p�����(�CG)�Fl����aL��Ǧ5)�LS{����ъ���A�?[�R'�1FG�t����S��[غo'}v���jm2���bP� O��+ӱӤf�2E3ͮ���x���a��O�X�3�Xs�����.D��> e9 �'�ړ��S�����E5& ��t�-~�ed�Y�vxSҀ��p�!Y�:�����w�X0g�P������6�}����M�c���G����[Y!��Pֲ�\y�m��V͎��Ѝ0�R�;�,��<�X$:C�W�B )�Y�Y6���SC��|�e� ���[����#Q�{�����Q�G �V�%D�6��K��ۥ��t3i�x�i�M,��L�� ��BT3��RX�q���@�B"YM�T�㳫bF����{ �b[�\8�#�59��)�����Ep~�T��E�Le#�*��p��;�>��x�xu����a�mN�����*��9}ߨ'1�\G�e�R\)���B��}!�գ!�13g��g����pl�̿S0D�ES��Ok��'�bvs@T&�a�19PT?�1ҿ�4��K=�)��+�Tv�BL���Z�v�<��n]�cվ�&�u@M���pt�K������@���y??[��6�i�X\���;)4](u �� ^�L�=�1& -�1_����S ;��r�~zTf�0�%Fa¬M2@{��k�����Y(�g�{��X|�g,���_j�2Q~&���A�s�hz���T��0uB|�$ל��<^f�������+:ԧ�E�p�&Oٿo��݀f���c����W۪o@�� J��=Otm��u�"��8C���CN�ODH��ȉS�)�I�����ĩ4�R��b �������� �R��jZPat#A9�͋�V�������Z�B�9ӃEG j�u�C�S��Z$�7u��BJ�W ���n���e8w��ep�9�v��)h�B ��i�W�O/�l��k�]����e�xL���� Su�����͂%xr�m!AM�bB��h���@�&M����0vW�$��bϋ�Zϓ�w�Q*}���% /��ϰ4٨���}q`U������]ހW��� �VN^ô�݁*���F�n~I�B���z��7!������ze[���]I:�"�1��_w�jw���1�S���mc�d�����%��TS�D��3D�hѱ����C<r���FwE1�ax���o�ᖗ#V&�������&�!�d]AvKO�^�q�"z?:�{�4Q҈��XZX�B'��?3�s��³��Йw]�m��z��4c`��>�@ ko�X��Q�N͍�;ӧo"V)iJ���G�40i)���!�S�̾�e:��)8Ky������1vI9Aw��Cq�ۮ�Gέ!�aJ�Xȣ�����a/�XЌ��$�)6RWX���}.\7�aJ ?"P��I��4$�@^��\dJ�� +=��w��'|QeT٫8�#7\�fd���Gz,��;J�^�:a쫞$Q�O�d? �`�G��h2�����+��蛁շ���d�������J��ݱ���ed �1��b �D�[�x�^@�ݐ��7+b5�ʇ��C4�d�����+ X�Hk��G@�/�|&�� � �� �ĕ��ڴSc���n"�4U&i�U����V�[�����Ɠ�M����yc����_�������� 2�Y8daO3S.�����[_�7ѽZ�ƚfz�)�5�G����\s�n:���Vq�roh�[Ģ��sO>m�+������(�/mx\~xI����nK� W%u2�y��rL���X�H�L���0?e��V���L�j?�/=�{:�0��&}�[���Z��\ !뢍��xNt8�p���{�O��J��Z�����W�lm��(F� OH���ɘƫ��-�`�=Kf[�J�F%�ᄱ�G��n��U�&I��>�+C Э��M����c���4&;������(��`����J�<����·��:�|3$ɚFŹN�X.G���V�;����"�?�I��_���45d!
Static task
static1
Behavioral task
behavioral1
Sample
SplinterCBL+11Tr-LNG_v1.03_DX11.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
SplinterCBL+11Tr-LNG_v1.03_DX11.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
SplinterCBL+11Tr-LNG_v1.03_DX9.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
SplinterCBL+11Tr-LNG_v1.03_DX9.exe
Resource
win10v2004-20240802-en
General
-
Target
b982741ebe724c786a4ff6a66c201a68_JaffaCakes118
-
Size
4.1MB
-
MD5
b982741ebe724c786a4ff6a66c201a68
-
SHA1
af2a2d885907b038e2523e95f491ea34a97d72b9
-
SHA256
3e248f0e05a47d8e2b8caed2a17558d586cb88c44bc0158e6f71e826dd97b0fb
-
SHA512
e39066795f14c2588b3018254eca0924acd5e669f4e3b0f531d8a9054c46f33a57022e4035c80a434d21a66b9861f08756b1deae93034fac0e9589693c34ee43
-
SSDEEP
98304:7ew2wyHeGOf8B/8aOSyaiPfDbwH+XLH/EAFGqvYKM:7eJneGOkBZy1nDbwUT/dkoYN
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SplinterCBL+11Tr-LNG_v1.03_DX11.exe unpack001/SplinterCBL+11Tr-LNG_v1.03_DX9.exe
Files
-
b982741ebe724c786a4ff6a66c201a68_JaffaCakes118.rar
-
SplinterCBL+11Tr-LNG_v1.01 DX_9_11 - I.N.F.O.txt
-
SplinterCBL+11Tr-LNG_v1.03_DX11.exe.exe windows:4 windows x86 arch:x86
d2954e7443620fc1ab971a465598a10b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryConstruct2
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 954KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
SplinterCBL+11Tr-LNG_v1.03_DX9.exe.exe windows:4 windows x86 arch:x86
a99dc83478c483149f8c336f3309445c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLsetFixstr
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
��y^s�~�c��*����*e�c�4|��n�FW��"��Z��G!�r�@n�v������}�����re�Eo)�v�06[25Jp�,��FQm��~���L����X+�r���Y�,��o����`���n#F�^�TBz'z.9�F���^��іu5?�I�8qykT.���XSg<�/�x����lz�y������K��%}JH�w���V��&�r��9���N�p߇��R��?�9C 5�<��I�2��a� rq��`�e�h�+�4>����-�+��\��^*䞗$���,%�s3�hvC��@�s��7 UKW3G8�^��o %������*��l}YL��C��p��v�4�^����=~�$�O8�C�abp8[5p[�{"����n�8���]��ߕ��Vh������kLy`���o<�g��gPi|8�zat�̞e��p���8:�R ���f���34�6�=�����U��Z�+���>*�'o�GX�ۅ����t`�~>��;�B��/Rv��n�4�d_Q�ua���&�dž��H�P܍l������� Sn8j�_��"*c��G�s�.9��F��鐔�� ��7� J*�ܪ?VF���L��<�"��|��Xb��-)p:�?�'dlz�*հB�W���'f�.p��`.�J" ��}���R���c!�3]:�s�z���#��5��E(����N�]p���7�����UHX��q���7�ġ:���9f�Kp-sx�p���p&*�)��ɞN?�I֢�x7[��s����2�[��S㣇+C�]�����W�CP��ta^)�������Ā1;���,%b�'��h������W�������� Ǹ, %�t���a������ߵ��Z�UN�LN��Mt�g��4�wT��a�V��aO�0��'U�q";/,�����N�s������<���MqAL�܀�}��~J`+{,/O�`9b1[�*|H�PDZe��I��(YLk�_>�=��m�g�͐� P�[���&qm�9;�~�>@�T�IT�%m�\bd�\�dn��T�Kz�����C��1#�%�[��͇��� �"����ˌk_V��rP1����$%-lT��z]{b&�-K��C6� 9�Ss�e4����H����]��X��7�W��)cYIF����6��P�y�őA��ۅ��>�8��^��@���j��q�0�y��QC��N�%�5!� sY�PC~��s#M�Wy��~���ֵ:y�`}� �������Y$;Љ����N� �d���K${��UQ0xtN��2b�,�2�aU��Z�Cɬ�BA��fU�������c����%( bI����dh�x �'=E�s�S+��U�y������F�^�����Y���}�b�!�V��_tH3��������%X0�v����G�=�M�h�����Aev�$g��B��*�[��V�Q ��(�7��E�YR�Q^���Q�w�̤LU"�ǃ:��, �KE3��w_����·B�M�yV̑|{rX'�"Ƥ�,�l{{��6��.! �+'�i]%��ɲ���\h[tʢ6��0�"i�q2��r��0:�� &�[.Kk&�Ql�i���9�d_mQ��i��!�NV���W+)������K��E˳�~� W�+e몈k*��E����]~A�hJ��J���0Ƀ���2���yDt��*^M���4W�O��bYX}��jDT%)��u�@q�~]�:�itS7������P[�x fJ:gR2��֔�6(ѱb�a�)���f�=[ y\F� �~=#'��ˬ���4c���:�ϯ���r�퉏*@9H<���*wI�D��ۿR��+��;�+P�.�H�\\-����B���Vi|�JأTO.7�<D�IZӲɖ�������;>uј��%�a =/�`R&d�\�1)�N(��(��i˔�Sҧ�D�>h̫�݅MO2�}�M����/�i7�RV&Œ�pƷ�����K OP�U�B���%�|$O�7�q��8�d����a��[�� P�W�}G6LtU�F����S�y9-���[q�[�l�� ƚ\�r�#rwb| F�����La�9�e:�vU�"��u��f�cԙ�ʬ�q�����/�*��� �8f1~ .��Oߏ B��Z �Dz�w9�_yש�&@���|s�4e�no�e���AAŷ����*�S��ڒd�se��C�h��k9B. Jd%�R�|����zġ�"9 ��$Z�+��v_��'�prA�jr� ��c����m¶���=:����C�E�������L�,�PzO�FF7��Y�p��K�,O�\�~xi�9����k0�ț��a��Rf�x~X��r6���nMd�,y.Zb�`�-�l��|T����L�N���}�a�y�@�� 8^vW:��=�8֯���Ct"��T�FU�����tp������JZ���R���y�L�v�A�'��AI�M����;�<D�t� �����5��HV�G�F �J�nEi,���g �\?E8��ۚ�Qk�F�շ/���!X%�s����*������w�ع�B��B��\@��5h/h��lM:\�n�Hg�r��ba�%U�ڳ,� �0�� ��.���i:�Z`��V1�M��th�N����Dž1'��Y�,ć����M'��mu�~���1��L˓� k-Y���y���s���T�����@�!�108�p(�hl���WXFS�={u>A6���p�D���(��Hj���=uO� ���&���W C�.�J�ii��c�����ȀXx�'o��)��i����g����k�����}��ǶH;��O�V�៣��(i{��2�3��I���h����Lp��u/�d+�WFapf"n� x��� x���9"�b}A��dA�㩧l����X2��v�a����G��x� ��c,I��D(�;}��6 l�B�h��8\`�����T�`�����̌����`�u�օ��t>|}+x��&5?js"F��C`�zge\ZW�1��⒡���~�����2�Gp��`�W�b��`[��-���φ�a�ooR�,4�!�����Z�~϶*\��
Sections
.text Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 954KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE