��/n|=�PKG�����#zAI�1>����X�XO]������4��ȇ�kk/����k��+8�� :'���m�>Q�B=�Q�ѱ�\����a{T<5]o�������P){�ְ%�YNש@�&Wֺ»T���3�0�l�+#��1��O>ex�O(���M뺬��H%�{�P��Ȳ�A����$th�<��.��S��`�/=������q��~��� �=$ǮC�����S}y�>�1��rQ���K�+[X��i�`k�boJ·թ-��T��9hE���~ύ�Wb~xYW,�Q���[�1� ��Rvi�X��oj���8��=�:����θ�/{�ѫ�9����nV<��Oc����gJ����N��:� ��f��#�摥��m8�p!?�6Dx\ _�=.���V����r�!���Ψ5����<}�F��祧�G�O �������<��85��$����h�����i���c�67�w������H� 1��T�s�w�ZI����T�����3N4k�o�x�I�(��r&{��n�L���5��8���� ��@h/ƒ��_�{��E�c#^�fC��[�蛣��e�+�+ϸg� ;4L �'�.����sK!9Ն|l1D��r,C���A⾧R����X4)��>w���������ˤ��A����f��B�����*�d���e+�?��9���N{a�~Gn4a3�ߍ������=���'>J@��3n��ϟ��d�1���E�����ؒoGM�:$���n!��8]�优���>�e[��L;�A��=�����e5F�$��h�U���jR�$mt��q��U �|�|���C��j�hP!�&�+�'���D�`�J����W�죭�ӈi�Л˽����+�(��47+w|M��d09��\�R^��Ƴu-��4:�xD�ږϾ�M�)D���T���ϧ\��ÀT <ՠ]s$ptΏv���>����m�{�����o|A�luKż����[��8��N��α�)���"+�G_:���{W9����l����]�[6�\s�Ce��'�݃��� �Y��8��a�eZ�)�ϔ��x�Vc�;�E~'� 0��� ���!�{�Cۥ�rRUh�,9�����#���a{�$Y�3�a�����9���e�B��@��{�m�g����VQkY���˦�8�R1XOCOWC������ЭB*�s?���hJ��![Б��eF!��cP-y�qh�!�Vf ���e�X�l��`{b�(n���d��D~A���6�5M���z=ܭ7x�#���3�!��?���j�Jn*y����A�\&��˔;�:Y�Z���8���bnI�����p��O���F�SH��.ûo�ng_W���������x$�=�4fL���v����'qx��Sl?�'��q�ן�{*�y��[�uk�G�s{H[z�3� ���)y:�X��:a�\[Y/��c"�b�A�3j-�6A��ՋM�2"��������c���G9� ,UH�^q�,˷�=���Erť��� T�ӈz���Qʫ��$h3��R혠*9"�����ir���>@�" 3� ��2i ����*�C8��"ICF���Zg�u�C2ރ �v?��[��gt&���{��R�g?�w�S�,k�4�l�lQ� x��'�:~b����T�`��U"�v��iz��3�;h)]A�t"���y���� ��B[4!�E�b(������B�; '���bWϛ8�SĪlr�3KVTl��~4ů�ܔ#i��yLL�@�^��_�����p۟�5o���hc��p��"&9^���>�Po�c˶���\M��~���S�����*���r�������G�QʹNiP� ������o�v _ci���=��;��^���u�����fڰ([$I�C����X$�kK��^��"���� �s���fl�{��w�ة�hׄ�H7��r�k���jp�f4�㒚�!�r'q�`����F��Hn�!�O�꿘� +RVV�)<��4T��,7_������ �b�̶IMB ��)gôR�c�����}a3��y��zC¦R � H�|v^��Z=�/�R�����si�D�۬"��K��/����5/�aƷ�ht/Y�qz�6��d4#�����~���F�<��%C��U�Y�ݍ���u�)1?|d�r ~�ѷ�Px��(|o�9l��o���%���[�#T�G�*���[I?��4�'n�Y7t��I�u�l�!d'��X�S�.+0��/�Di����-#�q���v}\��6&t�N!p�g3�Z����|&ϋj�ڕ��.����b�4�jl��Jj��9��s���A k����[,ݻ��u��rߙ0�Q����OH����Z�J����h�D��;+��q�C����7f�5��IJ$�YĚ�w�Z �������i������̖o�Q�`�D{-�i�L!�&n�(��K��1G��BC�Uc��(�Yja@J�w�@g�ٽ�-��/��SI��0B�)��m��;n���ث����ޠ̦"�4''���ČU�Z�{R��Ȗ�P���ִ��4� v��������XL���CR�����]�-�����ɡ��P��4`֛�O~�h-�m�� 9����p�7<�:�j���4��cXh6�MЂ/���`݃Ts�aB���SD�Ʃ�th� ��O�^��C�c8�cl�=�cI���⥠�9%v)��U?��z�ms����+Ƙl�4ln웽���FS�/d&_�z�C�M{|1$�����9*1��[$��.�˥�4&'����a�|¸\9T�@�)w�I�#�k*�tGտ�0�y�Rd�x��8߀+v�?����c-6W�M�T}��7�y͎�~H�����Vo��sݒ����s�3��Y���]-;���k��\�|���z�~�� ����FC��+tɜ��!J{G�q�N��xm�*��2�T��?me�9���G��m�O������l��w��ZF������ڐ�(�d��w���Y��[��dx�6Ϛ���$�=�@1-�៱�M;�\������[t�Ɲ%�.k��~�����5{&�� ��Fb�=��)�
Static task
static1
Behavioral task
behavioral1
Sample
warehub_fortnite_internal.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
warehub_fortnite_internal.exe
Resource
win10v2004-20230915-en
General
-
Target
warehub_fortnite_internal.exe
-
Size
5.3MB
-
MD5
6bb5f743510db40c2238e8866f4f5463
-
SHA1
62b6e76337da6e428630af284b69183bf5a97b0d
-
SHA256
ddc851fabf3112b65fa295d89afd271bd481f5c00e4d46cf8d945b22823f584c
-
SHA512
abb564c2fc48f8a7840924fc643bc2439371900a44c99c2c4758a87f8adbbd4170d2b70c498aca458902f5128eeef3abc26010b8a17c66ca395bcc47f8e23b13
-
SSDEEP
98304:c9rQ+D9MGAMPKNcBfXFPdhXL6jSdgWbwjcEA/RNb7rXI+lM4j6:c9V7A4KNc5P2sgAwITPXPlM4j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource warehub_fortnite_internal.exe
Files
-
warehub_fortnite_internal.exe.exe windows:6 windows x64
434752268a731e7c60fba8f3a8c99e30
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTextAttribute
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Throw_C_error@std@@YAXH@Z
ws2_32
gethostbyname
ntdll
RtlCaptureContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.interna Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.interna Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ