Build[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Build.rar
Size

27.4MB
MD5

8b6adb0136d81e7b2b6f1fc6252fc230
SHA1

1752f1cb80715e4b04293c05eb611b95d6901799
SHA256

61ae129c0435ad0b625ba98b1dd7dcb2ecd61dd1629704d39282774a89d73e38
SHA512

3a4844f8e2213ca8a670bc191ea079dc0bb12760d1fb3854391688cedffb9079b4f5718f136dd208db50a698b1543762b179f4fe15c5f5d0743c1b08ab8d9e09
SSDEEP

786432:edKNXB31nTLnBNriGfrS2/yx5Xxw9uTSJ+nAz/emH+YwnG:rdJd/viGfru3BoHIAz/dT

Score

1^/10

Malware Config

Signatures

Files

Build.rar
.rar
Build/Fortnite.exe
.exe windows x64

e82d17a6115ef473e8cea381ed99b6a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

xinput1_3

ord2

opencv_world452

??1Net@dnn4_v20210301@dnn@cv@@QEAA@XZ
?getLayerNames@Net@dnn4_v20210301@dnn@cv@@QEBA?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@XZ
?forward@Net@dnn4_v20210301@dnn@cv@@QEAAXAEBV_OutputArray@4@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?setPreferableBackend@Net@dnn4_v20210301@dnn@cv@@QEAAXH@Z
?setPreferableTarget@Net@dnn4_v20210301@dnn@cv@@QEAAXH@Z
?setInput@Net@dnn4_v20210301@dnn@cv@@QEAAXAEBV_InputArray@4@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NAEBV?$Scalar_@N@4@@Z
?getUnconnectedOutLayers@Net@dnn4_v20210301@dnn@cv@@QEBA?AV?$vector@HV?$allocator@H@std@@@std@@XZ
?noArray@cv@@YAAEBV_InputOutputArray@1@XZ
??0Net@dnn4_v20210301@dnn@cv@@QEAA@XZ
??0Mat@cv@@QEAA@HHHPEAX_K@Z
??0Mat@cv@@QEAA@AEBV01@@Z
??0Mat@cv@@QEAA@XZ
??1Mat@cv@@QEAA@XZ
??4Mat@cv@@QEAAAEAV01@$$QEAV01@@Z
?useOpenCL@ocl@cv@@YA_NXZ
?getCudaEnabledDeviceCount@cuda@cv@@YAHXZ
?minMaxLoc@cv@@YAXAEBV_InputArray@1@PEAN1PEAV?$Point_@H@1@20@Z
?NMSBoxes@dnn4_v20210301@dnn@cv@@YAXAEBV?$vector@V?$Rect_@H@cv@@V?$allocator@V?$Rect_@H@cv@@@std@@@std@@AEBV?$vector@MV?$allocator@M@std@@@5@MMAEAV?$vector@HV?$allocator@H@std@@@5@MH@Z
?readNetFromDarknet@dnn4_v20210301@dnn@cv@@YA?AVNet@123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?blobFromImage@dnn4_v20210301@dnn@cv@@YAXAEBV_InputArray@3@AEBV_OutputArray@3@NAEBV?$Size_@H@3@AEBV?$Scalar_@N@3@_N4H@Z
?setUseOpenCL@ocl@cv@@YAX_N@Z
??0Mat@cv@@QEAA@AEBV01@AEBVRange@1@1@Z
?haveOpenCL@ocl@cv@@YA_NXZ

kernel32

HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
QueryFullProcessImageNameW
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
HeapReAlloc
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
HeapAlloc
HeapDestroy
GetConsoleWindow
GetCurrentProcessId
CreateThread
CloseHandle
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
GetLastError
K32GetModuleFileNameExA
CreateMutexA
GetStdHandle
GetCurrentProcess
SetConsoleTitleA
SetConsoleTextAttribute
GetModuleFileNameA
Sleep
QueryPerformanceCounter
GetTickCount
FreeLibrary
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LoadLibraryA
CreateFileW

user32

CreateWindowExA
DefWindowProcA
SetFocus
TranslateMessage
GetWindowDC
SetWindowTextA
GetWindowTextA
SetWindowLongA
ShowWindow
GetClassNameA
SetWindowPos
DestroyWindow
LoadIconA
PeekMessageA
UnregisterClassA
MessageBoxA
GetWindowRect
GetWindow
DispatchMessageA
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
IsChild
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
GetAsyncKeyState
SendInput
GetSystemMetrics
SetForegroundWindow
UpdateWindow
RegisterClassExA
FindWindowA
GetDesktopWindow
PostQuitMessage

gdi32

DeleteObject
DeleteDC
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetDIBits

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bid@locale@std@@QEAA_KXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

d3d9

Direct3DCreate9Ex

normaliz

IdnToAscii

wldap32

ord27
ord41
ord50
ord22
ord60
ord211
ord46
ord143
ord45
ord26
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord217

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain

ws2_32

ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
getsockopt
socket
setsockopt
ntohs
htons
WSASetLastError
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
closesocket

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
__current_exception
memset
memmove
memcpy
strrchr
__C_specific_handler
memcmp
memchr
__std_terminate
strstr
strchr
__std_exception_destroy
__std_exception_copy
_CxxThrowException

api-ms-win-crt-stdio-l1-1-0

_pclose
fgets
feof
fputs
fopen
fputc
__p__commode
_popen
_set_fmode
_open
__stdio_common_vsprintf_s
ftell
__acrt_iob_func
_lseeki64
_close
_write
fflush
fclose
fseek
fwrite
_wfopen
__stdio_common_vsprintf
_read
__stdio_common_vsscanf
fread

api-ms-win-crt-string-l1-1-0

strncmp
strcpy_s
strcmp
strncpy
tolower
isupper
strspn
strcspn
_strdup
strpbrk

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
_callnewh
realloc
malloc
free

api-ms-win-crt-convert-l1-1-0

atoi
atof
strtol
strtoul
strtoull
strtoll
strtod

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64
strftime
_gmtime64

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_exit
__sys_nerr
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_invalid_parameter_noinfo
_resetstkoflw
_beginthreadex
exit
_cexit
abort
system
_getpid
_invalid_parameter_noinfo_noreturn
_errno
_crt_atexit
terminate
_register_onexit_function
_initialize_onexit_table
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
strerror

api-ms-win-crt-filesystem-l1-1-0

_stat64
_access
_unlink
_fstat64
_stat64i32

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-math-l1-1-0

fmodf
sin
acosf
_dclass
__setusermatherr

advapi32

GetLengthSid
AddAccessAllowedAce
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
IsValidSid
InitializeAcl
GetTokenInformation
OpenProcessToken

Sections

.text
Size: 748KB - Virtual size: 747KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Build/Intermediate/FortniteBase/BezierCurve.obj
Build/Intermediate/FortniteBase/Fortnite.exe.recipe
Build/Intermediate/FortniteBase/Fortnite.iobj
Build/Intermediate/FortniteBase/Fortnite.ipdb
Build/Intermediate/FortniteBase/Fortnite.log
Build/Intermediate/FortniteBase/Fortnite.tlog/CL.command.1.tlog
Build/Intermediate/FortniteBase/Fortnite.tlog/CL.read.1.tlog
Build/Intermediate/FortniteBase/Fortnite.tlog/CL.write.1.tlog
Build/Intermediate/FortniteBase/Fortnite.tlog/Fortnite.lastbuildstate
Build/Intermediate/FortniteBase/Fortnite.tlog/link.command.1.tlog
Build/Intermediate/FortniteBase/Fortnite.tlog/link.read.1.tlog
Build/Intermediate/FortniteBase/Fortnite.tlog/link.write.1.tlog
Build/Intermediate/FortniteBase/Fortnite.tlog/rc.command.1.tlog
Build/Intermediate/FortniteBase/Fortnite.tlog/rc.read.1.tlog
Build/Intermediate/FortniteBase/Fortnite.tlog/rc.write.1.tlog
Build/Intermediate/FortniteBase/Fortnite.vcxproj.FileListAbsolute.txt
Build/Intermediate/FortniteBase/Normal.obj
Build/Intermediate/FortniteBase/Resource.res
Build/Intermediate/FortniteBase/RunMouse.obj
Build/Intermediate/FortniteBase/Source.obj
Build/Intermediate/FortniteBase/_IsIncrementalBuild
Build/Intermediate/FortniteBase/imgui.obj
Build/Intermediate/FortniteBase/imgui_demo.obj
Build/Intermediate/FortniteBase/imgui_draw.obj
Build/Intermediate/FortniteBase/imgui_impl_dx9.obj
Build/Intermediate/FortniteBase/imgui_impl_win32.obj
Build/Intermediate/FortniteBase/imgui_tables.obj
Build/Intermediate/FortniteBase/imgui_widgets.obj
Build/Intermediate/FortniteBase/vc143.pdb
Build/Network.cfg
Build/Network.weights

Sharing

General

Malware Config

Signatures

Files

e82d17a6115ef473e8cea381ed99b6a9

Headers

DLL Characteristics

File Characteristics

Imports

xinput1_3

opencv_world452

kernel32

user32

gdi32

imm32

dwmapi

msvcp140

d3d9

normaliz

wldap32

crypt32

ws2_32

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

advapi32

Sections

.text Size: 748KB - Virtual size: 747KB

.rdata Size: 216KB - Virtual size: 215KB

.data Size: 2KB - Virtual size: 6KB

.pdata Size: 28KB - Virtual size: 28KB

_RDATA Size: 9KB - Virtual size: 8KB

.rsrc Size: 1024B - Virtual size: 632B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 748KB - Virtual size: 747KB

.rdata
Size: 216KB - Virtual size: 215KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 28KB - Virtual size: 28KB

_RDATA
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 1024B - Virtual size: 632B

.reloc
Size: 2KB - Virtual size: 2KB