�Og� j�xkh��}��:�)˃��a9)�n�c��I��2ɘ4�<h�|G�Jz�$H�Hbb�h��8�rf��,�фHzS�..�����e�c�M*q���`)�9�0���dw��7�^S���XX7{G��6Dgo��6���V��d�L�,HcL'���/^���Ȕ gy��=��ye��m��c�}���7-��p���@���cA�Hth�N���ju��_��G{����Zfu��U�0:�̖�]��Q���!�(���H�����#���k�m�y��\�S*��"L���tȰ�v���3�$�wS�)��-����L^"�`s8�~vӢ�0���Y��S�y��v��H�n�{:�8��g@�E -���%K�ނ����%��c��ُ��f�� N9Ԫ���?�BЪ�E4R�wJ<��0V?DRӺ�GĎ䉿텙�E������t�1�MH���B8l+M2����\S6:�*��:�6Lx��SJ�p�;�pAjcZ�����$U&u��������R����;ce�N3ЬI#q���#���`"c̣잨2�bci�����Қ�ui}������ݙ�X���P��t�%�0�?o!�Ƃ��t)�U��>p?��v�\c�q���A�~�����'�` �*'�&�����t�c���,#����q��C� ��{#m�e���w*0zM6�ha�˽T�yd�����_��5;NY��h��F��p봝1rx�{']�$9`��v��<��n8)�F�s�F�����O��zG�E~L�VU�Q�$����_���_yj;��7~w����rk�`��?�J�M-E��:��0�m� ��3ke��x�-8� s,���8��;��h�{����+����Y�?����\� �VZ^��.�P3[��V�Zj���1DŽ"x=Nd���6n�1�r�BuN���O�Fx�{ #aV@sc�ѽy2qS�JR'�����d-O�+Cz�9"�t�����x&�>��)b]���x ���R�)2�=�������|�[�$é�/�t�I�� P��w�D> ,V~�P^�0 �o7H8L9,�����ktt�D���.���'�n�~I�d�0��s��C�&�'�`j��#LKB��+������s 7�E@j�|��u����-a��elo�96^����!��A���G�����' ��@3 Y��؎H�S������0�H=��W66Y|kY�,w,���A�A�#7q��֮�搜MY|F��%�?l]�/*���!�4��uH�I6U1R��?�j��u��b��q��ݠ���V)8���K����z��0x��A��ՠXoP����f��V��\��P�p큑��D��>�@J[�by��9�YI���lV��.���Q�k6������o���S��J��*�+��橉��`�uJ/�IR��y^���C�;����&J�=O|���kgIKq60K��m�L����j���(|d��Ǥ)�$��Qo�O,'�>�_�`#;�����g�ƛ�u#�_y��p���_څ�o�#`^���>ftݔ\�A���UT%��O��1 �{"3�|��]��@��Ɍu�-��X��2�>I&S��$dM���Ԟ#9�L3COS� aG��g����3j|C���#�������$��$g�X0%3�g�~�Ke�.�s��R���5E�=�$����dω��n��Ar �4[q��m���'R��.`�\�(�9l�_ևXa=�����ξ����>ܓ����c��3֞�U V[u�>��R����f���-�)�6?�9������/1�,��>�0]ၬa16�� cXʓ+���?��#��ː}{J�C"z�l-���N[���<�ˏr't ���ٱӔ��I)u�R9� �>gz�����I��ً�������a����\�͠QR�}-����H��ۦkB#�����)��x8����I=Je摞�C4��1�A' N��ۖ���O����!���������[s�.�-u���ힺxW[��HPs0��F�_*�4X� /�^a?brD�B�6S��}It *� j��(����l��=,���Gw���s�&֦;!i��I97(�Gj��K�?�N?@��h��K-E�Ij����=z(����M ��E�a/��@S��~] ��6Twd$0�u���3�w=�R:�l��h�\��ԙ�`��)H3MP'd��O�7��p�@+|+��Y�h�N5��\�)<�e�p�������p�����P�kO��+�p�xπ_��4G�N�y�����=�����4�������+�y� �}{���"�0�|�g�zٌ�i�?!Z�� ��HRkI���yɨ����+ґӓ'� ���������m�C�×�l�B��q��C�{Zb�yA{�Ig�5r��>�F&�W�K�P@�QJ���buSE�A��ݐ����r5�U>-��1H[��ݮ2�,^A����ICzoB�@�E\� �z�K�2l~W/���-Șh�Xp�t���%\RO+}︫��w�tb�y�+��'ΘG���i.L�;bl��2����zm��\]BѰ,`m�nO��P�&5����|� �KB�46� ��� ��M�d���Y��j'��b�a��O�Z�2���j�����TwC,pqe8W3BߞE�kႠ� �5A��4>�r�>W��s�h��]�����ɠס�A�]��9�E����؇<�qf9���Ѩl�6Mu�J�p�����l�Npb�+%����| �;m��X q]��-����E<��C�G\IV�8h������m���\�����<}��FҮrN!�_ta#s�QR��[�\І�q'��_�W� ��*�V�Q� �y���-����'Q��=:�O�� ���<��泚��v�fEW�g���pg<=�:���f�SzJ��|ΒSW���|���M���nP����ߜ�M���Ɯo��ُo��7[����`cueS��%G�1���,�!9��a=z����Q�wMH ����w��wب=���!�����T�&^��y����)7�Is�5uX�3QCF^�p�� ʙa��g�oA{X�B�YT����/߽�ѣr�Hi���mН>�q�v$s�؆#�n�̌{x&�R�S ��@d=��>?���ŬeT7��f/�}P��2&��g�5e�_; �{�ѩ�bH5���mvfB%*S���u��O�t�.�G,���Y�����7a3����ԫ��@)�x���IiƦU�]����V�p��I�'�B:&�=Q��Ӫ:�H%/G��t�Gh�U����D��o�%��)��)����|����mq~���1X�� 5ӈ" ��O��I}�m/sk1��WGs�^�e�?u���^�ŜG�>��&�Dž%���o�S�b��3&�l#�c_�[P<3�k� �g��g�7�I�o�&f~��|����C�} T+������-q=/��y����͐GE�^�!���N%ې���B�� dc�ҶɌ����&�ϋ;�ɹ��>L�=�]?q�~�#"��j�ު�^�����'�Ei�9n9�Q�9��.�Z��_�/�H7�н��K��l�֓j�X�>�O+-�B:?؋�d���
Static task
static1
Behavioral task
behavioral1
Sample
Sniper Ghost Warrior Contracts Promo.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Sniper Ghost Warrior Contracts Promo.exe
Resource
win10v2004-20240419-en
General
-
Target
0369502248718b9c3ebd70f310734b19_JaffaCakes118
-
Size
5.5MB
-
MD5
0369502248718b9c3ebd70f310734b19
-
SHA1
eeb5ad66ca9a5696d01c40124a1a53700a55bc72
-
SHA256
0157f77dca50f6ca7cdb3f7845f5f8c717c9d9776e9e64a17ab0e776723d7d16
-
SHA512
4ebddedf049ee13d948ac34cf12e1b30360a61b3d6f7139a91dc5f4c879e1ebc5d2d0857b19198cc48480bc93a86b855fc5493858f28507255841da5d5565ab0
-
SSDEEP
98304:X0EZcyXcITf01iHj+xfdfgEDn3fxYEwoMcvXjDQf254Mk8Y9tJKm6mIagX8RDHN:X0EZvzflMZgEDn3ZAcvXIf2iMkN/J36c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Sniper Ghost Warrior Contracts Promo.exe
Files
-
0369502248718b9c3ebd70f310734b19_JaffaCakes118.rar
-
Sniper Ghost Warrior Contracts Trainer +20 v1.05 (Cheat Happens)/Sniper Ghost Warrior Contracts Trainer +20 v1.05 (Cheat Happens).rar.rar
-
Promo Trainer Notes.txt
-
Sniper Ghost Warrior Contracts Promo.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 41KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 18KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.4MB - Virtual size: 12.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE