�|��&OL�y�0�OO�����&w��o ��7W hX-��[Υ E9{r�X'�!��B�A0 ���b9��R�z�qg��e̞�lGZ�\8wᣮ���%K� \���LV\��9���l%���윦5P�}����[�KDm*�%�&��W<B��7���{��mf9�'y���ON[�e����N�pO����gѡz�� �^�#�wX?ZL�_�����b�}g���F|;���,d����I�1dف~���:�S믨[ch��7�]`D����j���o�".�IĊ�3����,��3X�&�Ŋ~���)U=��6Z��������Wc�Ws8�}�Ċ��U��Y���yk�����ҏlg�R�//3�\�a\9N\!�l�=��a����ŶJ0 �-̏�/� @��eX�����(���D$jO�Y��o2��]�ѳ�\K0J�\� �EURm��u�P�� �Y�Ay��4�Ea�Ym}���0���Iz^�t��Eb��_���8�49�E���.�)�zV��⿎�`n$l�9ђ���G�̶�Oiu0�N�B�زzȿ�/2^�0q����7 ��p�$��`D��Tfw���;Zq�X� �K��j*����B�2���9K{S* ���k���Q���+{����L5s�A�2;)J�?f7@!�t�)%Գ�"5)��ׅq0��>P>l�V&�@o_8ʢ38����g;:���-�C���]��*Ȍ���CTؼ4��U�XT����an�,V(=Mh��> 9�<��D5��X`���}ӜWV� )���5�&�+�-��,8P�:T8����i^4F��粼���.�:V�P��bAz�A�Ж'mW��� <l���J��`&���hyaJ>?���X��~ ��{�YGع./���7~�:��i&(|@ꐨ#~��Y������.�����U�ɱU*��. '�<�F]2������h��mz�d=��=�e [lMktD������sTE�GV��F�a>�o2�6�J�,�%�eK�����)'�����oz�Y<:���n"��+;k�'.o>4���I��X�6�jϾsxʕ`$m p����8�Qk$B��F��-��tP%�� 0��ݠ����.6 ����"� t�'?� ��n�z�a�����J��&'����܃ϙ�]!a���p/\ʭ��/�[L&���&x�5�ȃG�EN��pu�}�fT��*�~�}�qq&�X�'f`l���'b��/.�HG��(bc����}R�T�4X�LVi�P�y��)v@PVɦ(j�����~�.n�P6��a1A� n{Ԉ���S�=Q��~�D�qEXUz��f8v�腻 %��m�=� �|v����D��9���>r-�G\�p'a�����*�xc_�78+�ȰBr&�pOͳ;w�k#.�JS��Kmo�;+ V��;��Sp��N����ޟ!hU!���"�� �}�Ɲt����aV6*�^n9�����[����Ɓ�-�@��st�B�����n�G��T�cB�H����em�?0����.����5.����KT��d>(=;��vI��E��Z�]�@��1��٪v������B�;�(��fw�%M�U�EK������9����53RD��N xGi�m�WkÃ�O�Hh%����s�]��tL��O� ;Ɲ�:n֮��4�{�W'������H�~$BC���M��$�'��e9:�Y���#�t�a-�ѹe|.�CΗV#�YK�*�"��g��l����c�l���s"p%�O�+[P�0eeYԾ˲�N���X�k��a���@�17m����ajƆ���� 3���"�d�k��c������8k�~u:�j���QhٷA(D.�Soa�3�hC4pu����1R7�T��h9���d���>�*�u6A�%�ȳ���07�G-W?���)G�ÿNԞˊ����-��+M����÷���I~qH��]泷L!h� F�:��/�U0�oc�C�6��Youh(U�N��Ѐv%���.&)A5���KN�Ճ�����s�bo��ɭ�+9UY!)Ќ!�e�OM����3G��jpʑ�Òb��E]��/�f~9h.�,=#Bj��� A_d�|I~G�wGsX�** �ɲ����gx��&,��x*�z�������E��LF��E̥~־�c4+P9��ę����+,t� :�l��7<�y��_Zya�|��4�)�L��ME8�x��Eg�95�)�N0)�K���1��8����dj`����n4��8p%7�>Fm�F`H���kV�*ك2H!A;��pXT���+9�*�1�3�. �q����F�"=��k��̖Q�`UX���̳`8��*W�%���L��v��[M ��H:=?eN��Jp���ˍS_������"� `A{`>��t�ؤ�p�!l��A���W�$�q��ͺl?�Q>]|�I7�.]mW����O���ߌL�Ur�{�I�9���ρ��w�9������X�)L���k[��f�*�<��N �,�����Db�����6�`����e�6S�Ӽ�T8�K��M�T��D ��M��e�BO��oo*���)�����6Ӓ��K��k'K����(�D1�H��:^�M������K�����D�8����?��Gq�7��$9Iŷ�ýa�/��g���꒒1��ˇ1).� ��E��Mڛ?��Of/���i����܄*�E�eNᖸ8�4���X����5lڽz���{+V�I��]d2%��.�0��5��1�e������Y�]�8���.����5R��%�����~����A��Nmm���$ŹZ߲�14/#r���8���ϵ������SC��53�K�����ݸT�+j�FTB*/�B��F��ϝ�p�#b�nN. � �mXJ��f�������� +~��>g���0�$�R����sN�}2!1�O��d�c���c����R���#L>$�kֶ��ӥ�yk�#��F�\�2�������I �JS���Կ�[��� ��`��f��>�o_�JO��).dG|��`�Wm��7�G�IZe��7R\��b�*22�ނ�@( ?v�r�ԗ��R�.��4
General
-
Target
Fortnite.exe
-
Size
5.7MB
-
MD5
774bd8576d13e8f74c7796be226603ea
-
SHA1
6ab02651b7a2c9e6cbba88603dda5ff016c789c9
-
SHA256
28264ae6985256021b64b87e0dfdaa59bf24a1797bea54074f7a87435d9c2e93
-
SHA512
882e5317419b60eb60ad3178a1a3279b3abda7c942618d99c0279f3572274f0a5d64b54e6f659ba08b5b31af569d8bab02e0d72d8c07f3fd99d7650caf017145
-
SSDEEP
98304:42k/0o6/LSwmP0RptuAxQfvk7iUiX3U7xcJz09gpqbW8SjmdlebT:42syRvIAxQXkWR3Uq109gpqWmdlen
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Fortnite.exe
Files
-
Fortnite.exe.exe windows x64
8cfa7946484cb87ebe9b0adb55870450
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
opengl32
wglGetProcAddress
user32
CharUpperBuffW
gdi32
GetDeviceCaps
shell32
DragFinish
msvcp140
?_Throw_Cpp_error@std@@YAXH@Z
winmm
PlaySoundA
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertOpenStore
ws2_32
getaddrinfo
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
ntdll
RtlLookupFunctionEntry
dbghelp
ImageNtHeader
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__vcrt_GetModuleFileNameW
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-math-l1-1-0
powf
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-environment-l1-1-0
getenv
advapi32
GetTokenInformation
Exports
Exports
Sections
Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 625KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 748KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 32B
IMAGE_SCN_MEM_READ
.rsrc Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ