#PFW��&�r�OӝV��zSl!-��m�/�L�1~����.؊�_|ݷ[�*�5W>Վg�����m���Nߎ���0uJ�~�+I�\�r�¿�3�Hɺr�Y�>E.�M�7���\�|_R�5d22l�8w���M�a(n��{=0�s{�N�_���\�H��샞��?g��>A���(�/4�1�� �mk&���6B����>1w�@}*�1���&�җ�� �4bE������~�,nǞ�Y���c�T�ъ��o�5��#�.p�Ǒ�E���}� /��kP�ZW��4������;&5�/�=�����aR<�ПVd��:B�� �֩��� ��}V�����.'�0u�{Ԇ�f���x���=�&� #���~�E�gq7O��n����M�] �FUp)!|R��Xہ��a}�U�gWe��r��� -�[� uƹ��mX�X\s%'����ٛ��]������)��8�r:Q��tp��K~�0|7�?����T�8h�3�`qW|��5�W�I�`���>�k*�]��,{2���$�ւ��vy�#�1*��g�A����� bx]�Ɠ^N��M��8H��|�V�1�x1��O��-��<�!�M3U#�{�O��١�o��M1�)����x�椧��zaq�fhX��\���Vr�Ě�f���L�z+{ H�,j����*�d#h���("ݩ�V��PS4u�a�u;<��M������x>j���&!�\ۻR۩� ����Cʸ��/��,*��m*�������>�p��c��tcf����������I?(2��B5�DǍ�������m��i�P�Cd���V�+���7�� n���&�Yds� ��Y���N�-a=�=3���OE���"x��qv��#a���d_��}���}�i�A�z���FȄ��9�v�D��(��+��'o��<���A�*m5�;69sTzz���T��t���g�����H�� �f�7~(Rr��ct����N�d������%��Q��h�b�#�ް�x��J���`�j=592{o�_ ���fͽ=�\��&1r�tS���Hc������^ ����[�M2�.��� g�p�z� 6�[r�B�m�<�P�'��Y�E����y>���p7�-E0����il�{��-�I�;��/^n�Wj#8$������ ����*'���u0z�=��4J!5��b_��d<� 9'8��κm�p�������y�ɔ����F�f��ث Ջ�)R��w����?��n<�,I´`U�W���6�t��J����H�������ē\�f�B>�g��;39��3)�$���n���鶲i��糼�[v�h�Hs�㰍refI��ڑ���:�L��gDӾ�I��'-;t�xP�F:�~�;��'�a�����"�R���~�|S>WX����J����j����EaA���/��S,}*C��D�p�3'�,�.��;�.3��ړ�\��ز�<̤n��ə���J�oU�l;�[� ������YՒe����KE�Ui�{��\���������;]�g�_�}E��� sqw#�����~-H$Q<Y�͝ǀ�"�S�������_�n������ը�&"��듚�Op��}_�yM������S�9VS���b�D�B�L�G�6_��@���&�s�D)1����F����'���g�&c����G�X�\���6�֠� Z=�^�������V ��QMrgP�ʚ�n����*�&$���a�$NI]X�M�{�t� ��۞�rܳyv�U8؋gv����v���0��u_Xסλ�����+F_E�6���\v[J��ݏ�ы:�ª���Ec�ݵ7v��o9M]��:;#�U|Q��EE��,sS�M�~�W�.=}��)���.��;Ƅ��A�������J��2��U?��ul�!���gA�G�����؎JW,�*,O,�4 ��3���8: �O[E�:Ό�X�����z��+���Q����³�׳���e:=T�f���� ��xa���<wqc�{�z,�X8��z�B��CY �f[��N�NmY;�þ~�0.��72����p1lM!�ϥ f�&��S�8��I��v=�s�Rɗ���O؞�9 �i ��&0���h�)Xc��l���,9h?~�d����#` ;S�|=&7�A���ź���6q�Q0 �0w��t��8L��3����"��!B�{���'Z��㨹$x +�:��ZhL�1��(�r9��� >�x�����i�^�_n��~�Bg����g#�.z��k�3f�8�~�����l3�j�ݦ>SӦ�K��#��0��6��S�"�$�җ0����[�A�I����5 ���H.+8��k��8�y�$7eK�����܉f� Ua���Х�/o�%��v��߁Wa��PSCI�/"5H�jI����֓���2i�����X��� 1�p�ۓѳ͗t\ʅ����"�;[La�}�H����LGM�$���6p(�\C��Ck�]���RQћ:�"��C�@��Z8i7��?��94Y���b��4�/eX�A�� �1d]�/p� .����¹H�\_����m<��� ��Ŕ3Eɏ���g�6#!�ƻ3p&R���Kb�t�قi�h���.��ʗ��*'�dB�<����� �%w�1�V �At�#8�# �p*3�`��}�彳r��<��ٻV ��&[M��X4�^�.O�g`O� �as��,��z+B����+�m��?�*0�#�ww�ӎ+�S��NqX��7l-+7#���v?�8 ���u �B�8�ȼ���?f��!60ɗ��b̺�ğ"Ng�K��rwӜ[��ޗ.��"�:���R9�<�]��H���6� ���E�JWE�"S����t�d�����L��լ�_ҥE�I�r��ߪW����ɲ�y�xi�$B������Dכ��vfz���S�:7~|�խ��mR/�lI���7O4���!��Ev�C3��?$�<.R@�y<�A� n�����ܛ�JJ���T��͟� �7�u @��{�� QGRt��M�V�o�],�@]�@Q��\Z?���= =
Static task
static1
Behavioral task
behavioral1
Sample
SleepD+20Tr-LNG.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SleepD+20Tr-LNG.exe
Resource
win10v2004-20240802-en
General
-
Target
dc8da70ce2a38fb84760d75528a625ce_JaffaCakes118
-
Size
2.0MB
-
MD5
dc8da70ce2a38fb84760d75528a625ce
-
SHA1
17ee488f86f183f87cbbda55013b750eafe31d63
-
SHA256
a8fe95741e3b70558e2b4ed2b4fe14a2710f8a2d6affc4048ec6c916d6a3e71e
-
SHA512
805a798ec1db0ff2b0695c63ebc7d1865bb0e873908f440974e956572191f12b43ec1f152473835521e5b2971ed0d6b5e0fcb68686312d4c5580933f8e74a068
-
SSDEEP
49152:8x03iRIwufwUJByfomyawJM1vMgLGHCP8NTYTwJOQlDwRv:8xDRIwuff6wG1vMgXyiqOAo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SleepD+20Tr-LNG.exe
Files
-
dc8da70ce2a38fb84760d75528a625ce_JaffaCakes118.zip
-
SleepD+20Tr-LNG - I.N.F.O.txt
-
SleepD+20Tr-LNG.exe.exe windows:4 windows x86 arch:x86
f6cacb4a15b2dc15d4d347adfcc43d26
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord646
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 942KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt