ΐ$+���E(��b�ש(16z���x���=u��=��k�1�©�O����dcH���#�����B�ݞ�= ��<������CZvKn��?S��&<��H g],�_�GS�.h�\a���6fe���'�;�m�g��� ܳ����y�}���$�����G*�]��QcZ��n�[���خ��ҁ�͵9 Eo��{�+�cg�Z��p����4�U����@t�ZO$��7<;<��[�Zs_���5�e3�;�S�����eL�:���);��S��(�@Sc�g��z+!�;}�V��W01�2?@��� y6�� �+Z]�q��4�A���N�*$�S�0b����F�f-� t&/u�6��<���#�U�Q�7H����) ��%�>Y���R&����[���a���k�{dQ"����$� �._G�}���9h�1\ގ��`������WdDD_��e� �;�t�������nO�KX����i"�D�o��K��u���T,Ո`�V*�EB�{�Y��|�M9�e�ڵiǸ�=�����Ge�w�b�N�� ���b�p��8p�m�tܨ��ȭJ�A�=z��0aЃ'���|!��c C(;��1��1�������|W�3T@ ��a��!�Y��ZH������Fӝ���N�!��գ��Gk���w<ark������O���H��K6���a[Ax=�%��g1���v�~Z�HbP�5]][X����腣e0�V��FI���j�ǼjW7��@�o+�,� �i���Ar��́��u~�o������:��v�^Ϯ_�1c�G�np��Tơ"�j|���!�v!�tX�L1���XO[��~>�oRp�O��>b'-��3dWy���Ϛo"W�)��Vl�߭�v��*�G�/̂ϗe��M&~2w��.�fW��ns�����@�g"6��U�˫!RUieEk�?�Q��s���r��5����=��M�� g5q�g{����:b�-��v��R��>��|�`��"�o���EkM��� a�B��n��da��1�赭�p�daA��W+6��1�AF�r����*��� ���(�pT;P��{��HwM 2,��)/k9<B=J�8�Q��@�� ��c^8��q���t떸�� ���l��b�|_��I���H�7� y���������oq\�vO����u����2�ˀ�6';��ln!��E�����A������\���]o\���g^�fJ��i�~�#��r�~ȡ�PG$I꽘�t� ( �H9PP����.�P(}��iفs�g%������:��(��N�{t��@wy�)&�<q�ء�2!�B���r'$Ɛ��F.�V-�cMHqR����Ä:R��2�P2�;�]�����x�ĝ8��Qm�n��"�^����?�$"L(���oF��Qw��N(I_���2�ʎ"�q����yҗ9�ڪ���^�A���3�8Ԋ/m�u��69��w{�N��t]�s*8EH���O��]��k�������~���B)���n,�����%j��#]��'�2�N���R��v��5qyz�f�L��"i\6�� �N�w�GL�Kj�̶͝x8F4�]R"W��oG��}4�S�q8a>���V��� �-s�$\?IMcۭ����aB�rx���YBS��.�f�FXU��� @.9�C��Y�����3�(�I&���|�Q��et��������g��(P�iue �b����8U�m�纗�t���T�]D�ޑ�u���(�ݬ�Z�T���j-]�'468Q�M]�]��߀m��ߜ�l��h���cx5)�}��,�ۥ@�؟T�p�sm_�mfct(�*F\%��PI�F����C� ��?f5��X���QLA&��Q[���G� �Ӣ����~�����>�*AG�u�*Q#t���65�W�&��,0c�~���G;�؞#�Eެ�®S�Ĥ��%))�-�U�#<�3�ܻ��."㮐x���%cP�OKG����B��(�����7���^��Gy���i�����,�>�Lo����<Ջ�"snb���s�)��9�U��0�`XE~gj�0A� �)v�0����j���؆��E\�xg����rY����D�`;�`U���9�ú2na����%�h����� `��N˃����c��J��lOS�3�h�I�/}�h�Պj���N�am)��Ȕ�/��}��<~��O[8iFR�$e3aY�'PO�N0"�:H�2���H��> ��R:՝�"e�PAC�S��]R<ם�(a���e_���#GRk��D��Q��ha����rfo4Zo-���a���q['�ַ���T{�[%0I']0VI�z����R�n5�<���0o�b����(ڳ����ű9�V�iX�TR�eP�Je���|H�Z���PC9� Fmr��z!�G��lX�k!|�f��q�2M±a]�ܬ&e�E�s�F�?�d�}���]N�ڟ5��� �:�<m��]�?0���sM :c�v*����L:9�1���=y�]��m��q$��+�y)����Ҹ�H�ۃə�$6Nŏ��,[��̙�3�h._���3��+�/\K����7�tmoa`,�FC.�ټ�e�I�I�o�Z���q� ����o��5��O��͈Ӯ������Z/��c:U�E���XXeW��m�"p�� 9c���~�=Jz��G����V�d5�SY�;!�����oEB\{������lF��'��_ q\+M�jY��Wd'>W�F��E� �m��f���v����m�h�F��Z�Yh���Q��2�D��0��94[ɓz62�Lbt$@n����&�0ۇ���������^X�.�H�����O����u�q's�J�>V��a���c@��v.< �C�����}��M�9�e,�/���a+&W��YC�ӷ�K�x��nʐ%��}3��� ��Eoh���TW]�k�m�{����|�y�;�`R~�p0-C��^l��;����j��緒v�i���;b��;�.�����q��i7V
Behavioral task
behavioral1
Sample
FortniteClient-Win64-Shipping_EAC_2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
FortniteClient-Win64-Shipping_EAC_2.exe
Resource
win10v2004-20231215-en
General
-
Target
FortniteClient-Win64-Shipping_EAC_2.exe
-
Size
6.7MB
-
MD5
590f61f42693ed9334bfdf5c76dd5a48
-
SHA1
a58f56d69ad70e6c0566a5e29ccfcb77a2d9ef0a
-
SHA256
f979a7c80e639c1425286fbc2c51053399bc413d950a2326a77a3164fc21bcd8
-
SHA512
74d9c3091aaf04bed991da9ab96f5b156ed9c6820132f0c92fbe5afc0880ecc23515b6bb60e85d46a26549fd22b2d8800e58d12e6f1cdd68a00591238048dd53
-
SSDEEP
196608:l43dU5hleadjZ0l6zCyU7qX0j1CLIk5M3fBV/a:l6Cbl/Z0UCy4qQCGf/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FortniteClient-Win64-Shipping_EAC_2.exe
Files
-
FortniteClient-Win64-Shipping_EAC_2.exe.exe windows:6 windows x64 arch:x64
Password: FortniteClient-Win64-Shipping_EAC_2.exe
82c7e2e093c7e1a3143880b4842f673d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSAStartup
wldap32
ord60
crypt32
CertGetCertificateContextProperty
advapi32
CryptReleaseContext
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
d3d11
D3D11CreateDeviceAndSwapChain
urlmon
URLDownloadToFileA
kernel32
FlsFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostQuitMessage
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDIBits
comdlg32
GetSaveFileNameA
shell32
ShellExecuteA
wininet
InternetOpenUrlA
winmm
PlaySoundA
bcrypt
BCryptGenRandom
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
imm32
ImmAssociateContextEx
d3dcompiler_43
D3DCompile
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 833KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 645KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ