h�Z��8:�������]2���Z�TCg*�Kv���\��F�KJ�U�V����1�OA�7b�����"��)�����ȵB�kh��tur�X��s�k_����֚9M������o������aH�9�9�_uz���� ��jt%,(�t��>� ��ix�@R����-�u�J5_��6gЗA�Gò��1�ԯ�wOk�Ⱐ�)��G����H��)D�|>`L�W��]�.��7�+J�]U+���d����Boj�/��5S�wfN�e_��_��#���u*ǹ}e�2e[=��H]Ç���+���Wń�w���2V�l�Q����yn M�#$��5}������vw��oəl��Ta.$;I�KO4�\���{���1g�ʐ�[9�@�B��a�"��� ��u�*u%��}�����������&`�W����i[l��5�7�h!(t^[�f ǚ.V�y�5Pȹ�첎���v.�RvhY ����>:�_��;�0aD�[��k-���\2P�����O�,�H��i��ͩ��ۤ����+�|�� w��ń�8bI��R�?�8+�v]�)�N�1���xjAA�n�D��#��]�r�12�5(}�v���*�����s}ӻ�L�Q��b��D�U1E�[���ɺz��EVf:h��V�yf�ާ���e����fm�P6N��� 5ǴF�(�g�S�h�e��w�U�g���o|�G��Q��&&U����3q��� f�qn��%;�{}fU�W@�M�3�4T0^��?ɕɥ|��������C��H3�U��`�����2�'�%M�-�Lg�[�Nn�����n� ��tT�P����q'�a��nh'����k���;ꨧ�D%0���!v�����)D�x����R�+�j��KSZ,��s����d�f��@�uq.��/~��^���j�^y���ޟ"�K���zO���v2�mf�4��N�c�7��[pZ��#Nz�]#d�'}TH,K� ��[�bt�;���<Y�����e�λ��A9��Q2�xϲô�3�p�ކ�����^�EP}�!�D^����%�F���ᦉm�_�H��ǟ��kw����g�:˪��>F�e}�*�to��`k�JP1(s�|��ߑ�e�����d)M=ꩍ*��.E^ �eXM� ��U��/�|ڡOO�E�pn����:��B�8;�I{F���2 @�É|�\+���3s8�3��\�\�� _�(mt��xO;�� ,��T[!l��PDIvJ�lo{��L�r�i�-I���O���g'���|���q<S���I�A�Č�h��G�rQ�8.����D�T'��)ԛ�;=R(C�t%CL�>����q9�Q=�tQ7_��� ���'�J%�ᢂ]�%L��Y��&��K��m`��Kq��D���1��aT��8�\�}1��0oI��x��rN@Z�Ie��yCB��!����1zцd^L�w���[������,KsQ��Ev��˓U"J'���L���E��5���-� 0���P�i݅A�m/�7��T���{Ot/a�[���x{���㺆�Q�A�|���q�t�=�żW��q��~Q8EŮ/�����:r�toL ��=a��!� pYdi�w8T�m�m+ �^ߤQ�vZXL:|�&֪%��S�T8�o?֟�>�$2��t�a�+c�8B{=.^�@Lڨ:A��X��q�QRv�O�Kh���z�d<��ȉP���Wa��⡾ߛP��vW���ϳ�6A���j=o�]�X*ٜ��i�m�;������3�l�O��mX �Iᅚ��О��$�a�ï;�R|��rO!��#�а�1�Z�O�_ǡkVǒe ����?�Kw��}Sީ�&dZql���4� ����?qA�I�S����/���:��D}܄����wٙ�Y�80HZj ���G0q8 �̼� �T��t�84��9�J���,��rϳ&孲�Qq�Vƴb �y}P�a�i 5�� f�����3`�w2u;���GG�mO�MS �e���Q�d�9K;��5�Ё�o���E2T,��������1���0�R1��= L�*��N_u���:������@�i�%7�c��#z��K��&�YJ�\�"��xT�N4F�^�;��*G��7��LF�J�&a� -�BXC{����_���'��TB`)� T�vR����>BEj��0�5%2�Ж���"$CG3e��g�i�XH��cLIid����̀wmj3G�SH7&p,�QS���HGtJ;�p(�=ƪH�ĊM�)!�Z:�I�����d*!��X�a����%�H�����H�z���z�W�M}P';bxG�)��E�����!���ρKTc2tE��5�DT�⻕���(��1*�c�AM�ۿS�J�_��F��S$�p��w'�F�� ���p�ӄd���+k@� ��3ۺ �l ��Ap�N/�����F���� q�$�r�~�8�:3�̃��a6�=�8�� |QE�ǁţ����I"�ԃ�T��=�͓Q������㤵�����2�hc���W��`�1IZ!�1(�1]��feB��rc���dQ������/����c�[�d`b�/��O�0"wa���w,��f�����U����ɲ��j�@Fh�Į�d�1g����k�e7�- ^�Q6Y�-�}�)�-瞵�{#��p��l��D��;�o"�Ϸ �u���:y�4�_��6p����˔RjXBZL(����D�K�X0��Lfӵ���z��*��2`��gtj�T��D�a���ɧ"����@{��`�+���P������ ���V�n�����nyƈ�+�5ߧc����v���& �`�Mdà�--#���Z^��Q|Z���_^����]:'�R!N��օ�z�51��B8�cՊ!"�Wq���s�n�]Zt⑮��s���M� �W��Dz���!�MҔ�{/�J !�KqR"`����4|��Y��͡؋!��OE&ȾD���+��<k���.�Q��)x��S4�Z��[�E�=Ɵ$�L 艟^����L�Y�f�*�S�f��I� ��0��L�� �ˊ/@]���-u~qZd�:2��?�k:�}�!o�OeS���.����g���PoQb�*�+X�:����h��B˹N�'�NL�L���pʉ���B�/N"*��<}� ��<�k�c�Rvި������+�]���P��LF�D�����)��D1�BN���B��$��DTU.�����?� �^�б�N��<ݞ��;�$����&��P����cL��� dN����QS.q�_��Y �_�I������iL��i�� G _��B�_�d��Y��a��Hj�ƚz��RE���L�t�.�4`{I�ZZry �G�����r�JF�&��UԟC�(I�lⓤ��� :�c�9:G�5��q���E�r|M=����$Z�b������e�JR��b�g��a��T� �R�`��G��4(1.7���}�؏8&���Ų8�V�KNC�x����FWaV�]@<�D��3�������ǘ�)�AH�U�!ꬌ��P��:�W鮶_�����g'D���]�dG� ���O��SJ���Zo��?z��xLՓ�b�vٴ�b��ߖ���XG`[3?Ʌek��P�!г�h�\�.Y7clD$�,�������K��M��(�S��H)J.� Y���js��� ?�B���i'�)�#$W= �Y��ű>��i=�]��`ح{O_ 'R=����h�U��K�<د�L ��;n��[$B~����8"P3�`?�
Static task
static1
Behavioral task
behavioral1
Sample
SnowRunner Promo.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
SnowRunner Promo.exe
Resource
win10v2004-20240226-en
General
-
Target
2d376a1687ace5b1acd4d6bb5ce796f1_JaffaCakes118
-
Size
5.9MB
-
MD5
2d376a1687ace5b1acd4d6bb5ce796f1
-
SHA1
8d8e746ee55a75140f2adac43dc1f17e3753fd86
-
SHA256
71c195ca926870dd27132ef11b91f6a4e0b29a4350de84cc39135a07a089a723
-
SHA512
a14d89913dd7748e28db67740b48b3755d27cc64a5b2b8ea9fb1a0591869c9a7f900fa5416bd5cb68a2c4931b4f8ba3243860fd7b100a932e41515c1b913a7b6
-
SSDEEP
98304:qUEXbFsP4O8+M1XcDywGNkPHsY+JpoFIpjo4NU7h3JZzr/l99MjSJR+N/2o2bb+7:qhXB84b+JDUNYr+JpmY83vzDrz+xYb+7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SnowRunner Promo.exe
Files
-
2d376a1687ace5b1acd4d6bb5ce796f1_JaffaCakes118.zip
-
Promo Trainer Notes.txt
-
SnowRunner Promo.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 45KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE