DUCK_FORTNITE_LOADER[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

DUCK_FORTNITE_LOADER.rar
Size

1.9MB
MD5

298744b69bdacb34f01b5624f085df4e
SHA1

0d2972c68e7d9ae4afd8ba8db072aecd62504ef0
SHA256

05c5940b9ae2cb6356332d6d390eacb272fe8b7902f8b0d4cb07b0d103200786
SHA512

341f37bc5c226bbef408bbe85bf0584151061a7fa3c17eeca3876ec1dc2c18f726f6d5a5fa8efb4fa1ddddbcb11f25cdb88edb1e657de6ee225c9a7179c9af62
SSDEEP

49152:F3+6mJ8KhBaRQqE9tOuCEkRY3zoofjm0CMhUREEDXfcwHsg:Fdm9hBa7cHbOU8TMhUaE7ffsg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DUCK_FORTNITE_LOADER.exe

Files

DUCK_FORTNITE_LOADER.rar
.rar
DUCK_FORTNITE_LOADER.exe
.exe windows:4 windows x64 arch:x64

7dbd2319b33ed25eb7ad7d0162c2bb3a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

malloc
memset
_get_pgmptr
sprintf
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit

kernel32

Sleep
GetWindowsDirectoryA
CreateProcessA
SetUnhandledExceptionFilter

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 423KB - Virtual size: 423KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ