����F����H�T�wcȩl��jU���Gܹ�Йd�!��}��s���H"+{������T�u�A3Q�3$�G�d�_@�+��6�q��6Ud�����8�\���a���{倱O+ NJ�������bZ.�D��!������ћ ��@�6?�Ć�h�ƚ���|~�+�=o|< ��9)ӆZ���C$;(� �@ 8nf��]�oS����?��btO��/%�Q���wz�5��'�����"5��J�Gt-�`�aq邼<v�����9P���Q��J,���x��v�?�&����_w�L4ԹJnN�3�E8X})����چ��t�_���X��h�h�\�b��D�����?�&،��3�6�B��`t��+s�ނ����<��o9lX��rd� ���žj�� 4T��0?=K���A�t�gڈ��-���� ]�|�S�n'���\D*v�,<����������p�/�uA����Q�h�4��v��o�"���G�f�CCMA'9)j��%���[ˏ��F'Lf�?Ȉ�t:ˎcD 9C�W���v���� �����ת{U��~��>��IV^@���6�?�Q�C����ؤT���Y����Ni��C�`JM�J�� �}�7�X�o�Ѹ�@Qc����Ԙ���ӵҭg����q@/[��������|��~���,�q/7q���F�V#F\�o.�]m�/Uy��'����� ���r�9��lKI=���U�o��s�4mS E�P@�2L�w�r�nz�^K�P|����l�n� ��� ��H<���*�0��a��R��'���xWz� j'"�6C�_����Fk����WB�:�EuE�T2-��w!��)�c�������r�s���>�DK{}������`E7mܹ e�����pD&��0��>.�����P�c��֯?���-�|���'��nEך��|}6ד(��|�w�T�ٹ��;R���������n�!�|�]�x���B��{�������[f �+���a ��$�<6��rݮ*�VL����(�ZgNp���3�ώI�����aݛ����;��D�=��~���- r<k/���)��A����]�3o�,ໍ1�N�c��˙�\Ƌ�0��AD��¡-��u�8䠸�Q��qB�rIJ���\2{6fȟJ�K�����*G������z���a���z��$�,��z���L�d�T[vɞO���+��]~'-Y�#���2<���Y�o���I�(q�Uf��! Z�њg��l������x��X�f�6l5Tt.b[(Q_`�A����Fٱ1��=�JB��UІ�U���m�6���#[�I܌�6 �"�V�* �z�Θ,�2s���i���]Nx9Ӏ��unUPh@��4=K���n�����耨1�?�wz�c��haK��L�/�`_����8[���He=]��{qn�:�Mi2��dj�@7wKj[{�jO�)�X�}#r�D��5i�!yЧ�+JP�]X���`��%r�������z��+�O%�C�sM�b�f]r�> Hk+ �jh�(��^3d�~�敱>ş����QS���r�?}Θ5��|L%�H=!%�n]�K"�|.�9��+��D���/�K��v�{��2KB���f'ﱳg?[�pk��'$�b���� �ԫB���-W�r]�H �|I���ܗ��`�"ߙ�$�Ou' � ��]M��^04�n�G�i�X�N��u� ��}�a -��h(��%����{t�c��;>h�h���o�#cr'IK�6?�yEKπ�߷���ͯ��c4/�����8���=��n�0NJ&a���w�x�+^̪�*����OG����`ܯ�L��Z��� �}F���⬁у�X�꾉�.k� ��LI�ߪ��ӏl���e�������q4������p�Y��~�����������*�I��C��D�D����2K�] ���â2�?gg���tm�iWɘ�Z��D�̭4��)�� �9�����;�*��w�[������?�td���)Gr��k�����%��RW�H�Å]ڨxB�@��^וVX1_֜�q�N�x;���ݪ�.^�.����.�VV[_��@0�� ���ﵠr�wku��Sn�f)F�c��?��Ɣ���� ~@�|^b�����<`���0�eQ�*r�^�O��j�D ZI�Р��~O�3����*��CF�v �E7�[�N�V�bs+C��sg�e���kN.�_1�e,�� �5g�ؚ9Z�#�U� �Ekm�@�d�Xp=)i���)a�;�岇|�Dl���l�g��-gr��Vk�;8���Ύozʢ�' �Ϯ��f#r5ҷy��=��}mk�lD��X�ɟ��Y~�&���d����/'(�y7��G\�>����;���յK�9����G(q�)�E��n�E�Ȑ�L�Zm�Vlj�*[փ��ua*K��vv���BkI��M��m��W*�?���C�0m�����tT����z���` ���Be��ġEڑ��+�SL��Wʹs7��ޱ��m��aV -����|yG���t�'����� �� ;��䶊�%� P���G�$��rp���ɞ<���_���f�E�ᅐ���7i��2�KA�� H�flJ������BM���e��KCEFh �Jd��XAr(Z1h0��'��K'��t;�/ج�/�{���|�&�,a�a�ɫu:��+At�k�����~0�y�:�Ò��{H�+>�z��S��f�]����̅�c����ޢnX��L�ޛ?���@����Df� ]AIi" R<fy��E8���y��쟼�e!y}�d*��6_�5@zXhrwqk��<���!���y�G�q�,��ǟM���[F^D�;�P`-�Fy8�PO�i��~9Qw�T��w� ��B��E�1��tn�1$;�O���R�v1Η��Ǐ��x�t��P�@���N����@4=s�|���I�� ?���줢�g椑�%��l��`=u3��E�4=��ha�˩�ݪ���������Q6��0��T���j.�2�P\%]뽩a-˹�m�L���ʞ"��C(͉�1�t�/���3zƭ�>͙Gk�=X��h�*zZ�`�m��uzJ=�V x&�Y�W��3��]����Eo߁���:O-��w�����}����8ۼ�-���l�ЧR�^0�J�T�m�^�T��ԙ�'wz�x����3�� r�5Hu�b4�6N)X*0�8z�l�3���ax0��`8%��j�/I�_�l�����J��5�A�A�>����U�;�D�L��8���ߗ���7,$*��+�/5O�j�)k�'G��^V�}/s�������+� a�� c6tS�DYh�tT�ԗ�Y�L���ze*�9X_Bc�|�� CF�?�����a�-�Yn��p�2�uÏ��s�s㔎>�ߪ$>�}�!<�'U�u]���sjạgF����F#��@zF�8";���.0*�`�T`c���EA7������Tb�A��*o�术z�v�I�W�(^ LePO-sU�ˀ�r�,@���-5.���+r�H+��������g� E6�N��]���]k&i�Δ��Ⰺ����$L�\��Y�5?�gX�y,�*��p�G������Lf�Fr~���y��-[i��mj����G�����2Ku���|?/�Rk���ZA��Q���7pĿ�g��!�~,�M��@�zD��GƯ?�5��/�<��cg���x'
Static task
static1
Behavioral task
behavioral1
Sample
Satisfactory Promo.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Satisfactory Promo.exe
Resource
win10v2004-20240802-en
General
-
Target
fdedb403ec9dd9729af125374173a18f_JaffaCakes118
-
Size
5.5MB
-
MD5
fdedb403ec9dd9729af125374173a18f
-
SHA1
47ea0b2db06b7b976de7abc6470c42a1084b0cd1
-
SHA256
5ed7806cc2149cdb2b37080ea02a8fbd7973f85f8bebacf2f654e97eb8adfb03
-
SHA512
12a277d644dda82c95953df59f5ff257e86ba2239ec95251133664af21316fcb20d6d35c5773ce318ab88ec952e28f9ff1dd7f68a354438bd76ea2009568f9f7
-
SSDEEP
98304:JyIZG2KenA+iipEyLgXA11UCmyLkE+Ws67//0qTrIHPsJTSbbBKY:ISvKKibVwgCZQE5kqTrWgTSbF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Satisfactory Promo.exe
Files
-
fdedb403ec9dd9729af125374173a18f_JaffaCakes118.rar
-
Satisfactory Trainer +11 CL#118201 EARLY ACCESS (Cheat Happens)/Satisfactory Trainer +11 CL#118201 EARLY ACCESS (Cheat Happens).rar.rar
-
Promo Trainer Notes.txt
-
Satisfactory Promo.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 45KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.5MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE