q"�J���o��o����o���YN_s�T�o�Yq����� �$�Bݍ褐�ʰD�X�6�@g�.��?�zsx���\7;�\��p)u}̽g�q{�#:������9%�:.u��I�c��c'u2)�/�OJ���S�3$� ۈz@�?�Th�ޔ���nW ���u���a�?=a!�y�����M���H�y6gQ���>��b�0�>��H'aK������l�Iy�N,��M������ÿ����X��BQRC�[�K&?I����SX ���!�J�~7�(�պ��w��7(���#%�3_���"`��i��!��%��\�W�*�y- ���66���Y�J�*r2o�(T� �Z6eK3�4��p���?jB�K�m˙_�J[�{ `��OU�&��F�{{�x�8sڎjʼup�O�JT~��aoYa�/����] >�d��Ʀt������xZ`Յ`�4JhK�F�z����N.DW����r�;���Q�"�E!Z������XM3������U���e��֖�J�Ul�TΏN4#�%�D5�����,uY�3�3.H�G�_������r�yK��&���-�L ��d��3�3&��Tp�˩�P�ֿv�n�P�mN��U�[�[ۺ��[��S�nC�?eCSO �7���-Ƀ���0g$',L�;��'��A�?w^N],6��Q�n{Av6��%c]�#A�� [ۯ#λ��ӧ���RJ�6M�=j ���m8b弑ˏ� Z���u3����G�|)��̐F���j}�ī��\�[n��(��V�j����xr�A�!��O����5��c�h ����j���h�m���q�NZ�9^|@]� _�d;��$w�tj�� �|� �>�g�'�A � p>N�`��[��?qƃc�x�S�e�1#�,�LSJl�����Lc�-b1\٩��˙���^Q�h��t5j�T�vȬi��:�7��!�e�O���|�����.�|��+�+;�Ğ!3�!���쳯��S��e�^h�7���7�2b�� s�������Q�7�K�C�^E�3�e�c�u��9��ݜ�k��c����rK�($�6��W��# Q+z��m|�P��X�������crp�d4e��M�v��㖥o#* �����%��㿻 q�zWfm�BS������e��§*�������hČI���e�u4X��)�����_�,6i���vT��'��4?h�c��v��P���������Y��=bԅ8��t ,qe�Ԕɒ��{�\�N��6|�:!<]���Fz7�uJѨ�k.O�J�LM�Aӳ� ̗�J��TI/����N��cI�צ����"�z���VW{ C��:iz���y�s�I� �[��1 `{T� &I�� �t� ,B�Y��`���-�4l�p:)�j�4��w|���gp�x� �������1^�}��9Y�t�ap@C&(�n'��Ԝ�V!�:�A桁>/bm��վhW����B�H�����\$�q�'D����Gs̿�sy9S�6G��tQ}Rw����r�0��锹@���+;��4QJ#��u/@Y��`�T�G��9:�@�p~�7_��z��xPx��a��7����&��4w=����s@~n��?9/�o;a��tΔ���?۪� |�U� �J�)�}�m����/�ʗq�棾�G�9kx�,����0�9t���hjP��Ԗ��u�AM�T�I2���+nD �:�h���K}�?z�%�ׇK�6����#+:ź�Dv\��w��&D�Lr���ؑLk(ib.X�ݚ����=�Q�LY��}g�~�� ���ڕ -�g��o�P�ޫCǍ[�8�Us�+�{hE�9\}���,�ݢX��g����[e�l����;��&��4�;[4�A��]m����M$Se���Vs��>�C,DW�D����L��w�.��|oJB�����:�g� p��)��BҪ]����$���*�Y��T;r�&�#���Du�<�y%���gTpS'�������P�o�Q���6>������(��M�߲Vڼ#��8�ڍu�������{� ��9~�G���"��yy�\�D�����2�i�C�X�L!�"~+V�~L\�Lrw�?!(����+�M&Xy���$���С*��� I3����S*e��.���+\�)[.1Hb�>����Q:���� Tv�*Z�*�Yj�Lyb]zdV ���� �P�Y��W�Ft �L�u�[+0Ps*����� ��Ӆ'�#A��0�g�&5F`P��_w�@��7LKU�m0���<��a.��q���N9@�.n��J� T�[�d���Lװ- mPd������pЛbR��~dZN{��L��dY��dv�댘��2�{�'�W!ᡲ�M���V�������İm]�D���]g����n&�"��#y���������e3�R�C�a��E��G@rR�~+҃C�ɉ�>�l� ��_o�W[{�(�J)��/��⻚��,w��ҹ=L�hJ�Pm����ΥGvBU4'�z�u_E��gPb<�{.x�����,�]]�����Òڞ<őW�h��N�]+��^�wux檘�;�ȉ�N�H�&rk�SW����.�.�:� ���YYf4��䯲H�{x��e���xgw��ge��Bip��� �ϳ�,�-��B S�~9����5�I5�GƼ�y�:!tm�{��`F2Ř)3���5Ձ ��d5��p/>O��R/�j}�OU ��r��7i��ޭ>�k��@�S��)}���f�����v��� �;�r^�1UB�=a���QϥQD:�M��������_��Ξ�.]�D(M�}���ng���:�l���l��W���q�6J[�`$�����e[����V�L��䥝q�`G���bX�XwH�Ι,ٗ?�g�;)r<�L���^DoԂ�nf4�ѽ�� �@^�>.�h���3]�:��"9KG��JL�'�i���2�� /l�PUָ�_���%�̋�ഊ��T�z�م��QN0G��ж���V��p翹�7�4]VX�#֍]��TǶy��O]Ln��_�n��뷁��r��1Gf�͉i����wao�M�������Qp�N|�d�6�Z�@��:�.���<��j'�/+���e�>t��Q���-�f�X(��b�(v?�=c����:���Ľe���o�i�#����������U%�l��^-o�q����ǭ%|z�LB�Z��S[�C�A)F ��������l��W����!��y��J�!ů����X1��B�D�{���/F�m���:ii?�ʫUb�=�(��KGy7�l���Y����W�������wS2 �q�FF�7�l*@�`�L���j�M2��'ʄ�*���D㚠���W��1����>^9%�VH��� ���(^�4r ��"���Gr����C��Ѵ +�E� �+c>�A<M@�8:�JbD:k,�պ���|:�~x�]if#[ �WF���� oN��F�f�ڐ�"�u�s3�ڄ�v�6�S��t����D7���Kz#[<rcM緕S���t������p���ߟ�~+УA�t~�`=��fW�{��*�w,>��-�t�o��o�&E
Static task
static1
Behavioral task
behavioral1
Sample
Borderlands 3 Promo.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Borderlands 3 Promo.exe
Resource
win10v2004-20240426-en
General
-
Target
6869abd6c10f9987d20279273a8dcd5b_JaffaCakes118
-
Size
5.5MB
-
MD5
6869abd6c10f9987d20279273a8dcd5b
-
SHA1
ff2c1adccd88704931236a0529c9924a992215dc
-
SHA256
121c66c3f8dc92e47fece3eeb0c6cb0e435ce62d405da37a895b1b90cc6f6e63
-
SHA512
84f7810971b993996a83f430e939b002846703ef2542d4a3bed3479e81cf892703a3c3331c265b1e74c11e9c4302727af2b5822fa4c2bcbf76586c163d03ff8c
-
SSDEEP
98304:R3TxLYAV4s+V7ulPLE5FDUoTUhvGoShbTtk5oC6iMt5hG6FNRlCFdW7g95:NxsAIhWLmVTUhVS9i5Y53BFBDg95
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Borderlands 3 Promo.exe
Files
-
6869abd6c10f9987d20279273a8dcd5b_JaffaCakes118.rar
-
Borderlands 3 Trainer +69 v1.0.6 CL 2141850 (Cheat Happens)/Borderlands 3 Trainer +69 v1.0.6 CL 2141850 (Cheat Happens).rar.rar
-
Borderlands 3 Promo.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 45KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.5MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Promo Trainer Notes.txt