fortnite-external-evo[.]gj-master[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

fortnite-external-evo.gj-master.zip
Size

2.5MB
MD5

806e5c13c5cc65c836456f45b1d44dd6
SHA1

f77439731177aef4a92ed3f077a0888bab155abb
SHA256

1a151aebec02f3a5dcf44e0301567088a1789ea1d6e81a69fc4242d7a0fd9265
SHA512

bf2419e228998f5372fefad3e7af8aabf0a04b537039262e63676285a01d55679b8cd1c21f6b58b2188b5d005acee9d1cd42603feda6c31012851284f8734586
SSDEEP

49152:sEE2bx+zCs1SzvlmxGO9ivhiP0UPd9EwF6fduYki9cdjOwwhkzwF01wWAs70D2sC:sEEQx+7MzeGnpcPd9WVuYkiSdKE74Wyk

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fortnite-external-evo.gj-master/x64/Debug/evo.gj.exe
unpack001/fortnite-external-evo.gj-master/x64/Release/evo.gj.exe
unpack001/fortnite-external-evo.gj-master/x64/Release/kdmapper.exe

Files

fortnite-external-evo.gj-master.zip
.zip
fortnite-external-evo.gj-master/.gitattributes
fortnite-external-evo.gj-master/.gitignore
fortnite-external-evo.gj-master/README.md
fortnite-external-evo.gj-master/evo.gj.sln
fortnite-external-evo.gj-master/evo.gj/cheat/aimbot/aimbot.cpp
fortnite-external-evo.gj-master/evo.gj/cheat/aimbot/aimbot.h
fortnite-external-evo.gj-master/evo.gj/cheat/driver/driver.cpp
fortnite-external-evo.gj-master/evo.gj/cheat/driver/driver.h
fortnite-external-evo.gj-master/evo.gj/cheat/driver/driverdefs.h
fortnite-external-evo.gj-master/evo.gj/cheat/esp/esp.cpp
fortnite-external-evo.gj-master/evo.gj/cheat/esp/esp.h
fortnite-external-evo.gj-master/evo.gj/cheat/sdk/sdk.cpp
fortnite-external-evo.gj-master/evo.gj/cheat/sdk/sdk.h
fortnite-external-evo.gj-master/evo.gj/evo.gj.vcxproj
.xml
fortnite-external-evo.gj-master/evo.gj/evo.gj.vcxproj.filters
fortnite-external-evo.gj-master/evo.gj/evo.gj.vcxproj.user
fortnite-external-evo.gj-master/evo.gj/main.cpp
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imconfig.h
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imgui.cpp
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imgui.h
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imgui_demo.cpp
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imgui_draw.cpp
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imgui_impl_dx9.cpp
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imgui_impl_dx9.h
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imgui_impl_win32.cpp
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imgui_impl_win32.h
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imgui_internal.h
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imgui_widgets.cpp
.vbs
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imstb_rectpack.h
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imstb_textedit.h
fortnite-external-evo.gj-master/evo.gj/render/ImGui/imstb_truetype.h
fortnite-external-evo.gj-master/evo.gj/render/render.cpp
fortnite-external-evo.gj-master/evo.gj/render/render.h
fortnite-external-evo.gj-master/evo.gj/util/util.cpp
fortnite-external-evo.gj-master/evo.gj/util/util.h
fortnite-external-evo.gj-master/x64/Debug/evo.gj.exe
.exe windows:6 windows x64 arch:x64

6f77d38701a8bba43fb053109f456506

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\mab82\OneDrive\Desktop\ud\evo.gj\x64\Debug\evo.gj.pdb

Imports

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
CreateThread
CloseHandle
GetLastError
SetLastError
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
WideCharToMultiByte
MultiByteToWideChar
RaiseException
GetStartupInfoW
GlobalLock
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FreeLibrary
GlobalFree
GlobalUnlock
IsDebuggerPresent
GlobalAlloc

user32

CloseClipboard
LoadIconW
GetWindow
GetWindowThreadProcessId
EnumWindows
SetClipboardData
GetClipboardData
EmptyClipboard
GetActiveWindow
SetWindowLongW
GetWindowLongW
GetWindowRect
GetForegroundWindow
GetKeyState
GetCapture
SetCapture
ReleaseCapture
GetClientRect
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
LoadCursorW
TranslateMessage
DispatchMessageW
PeekMessageW
DefWindowProcA
RegisterClassExA
CreateWindowExA
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
MoveWindow
SetWindowPos
GetAsyncKeyState
GetSystemMetrics
GetDesktopWindow
OpenClipboard
UpdateWindow

msvcp140d

_Query_perf_counter
_Query_perf_frequency

d3d9

Direct3DCreate9Ex

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

vcruntime140d

memchr
memcpy
memmove
memset
strstr
__vcrt_LoadLibraryExW
memcmp
strchr
wcsstr
__C_specific_handler
__current_exception
__current_exception_context
__C_specific_handler_noexcept
__std_type_info_destroy_list
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

fclose
powf
isprint
exit
_CrtDbgReport
_CrtDbgReportW
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_exe
_set_app_type
__setusermatherr
_get_initial_narrow_environment
_initterm
ceilf
_exit
_set_fmode
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
atof
strcpy_s
strcat_s
__stdio_common_vsprintf_s
_wmakepath_s
_wsplitpath_s
wcscpy_s
_wfopen
__acrt_iob_func
_wassert
strncpy
strlen
strcmp
acosf
rand
sqrtf
sinf
cosf
strncmp
strcpy
toupper
fmodf
fabs
qsort
malloc
free
__stdio_common_vsscanf
__stdio_common_vsprintf
__stdio_common_vfprintf
fwrite
ftell
fflush
pow
_free_dbg
floorf
_initterm_e
fread
atan2f
fseek

Sections

.textbss
Size: - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 850KB - Virtual size: 850KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
fortnite-external-evo.gj-master/x64/Debug/evo.gj.pdb
fortnite-external-evo.gj-master/x64/Release/driver.sys
.sys windows:10 windows x64 arch:x64

ccea250b1319c1952e5d98024ffbc5c3

Code Sign

0b:52:66:11:34:d0:1e:61:3c:34:04:03:3a:87:b7:7d
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2021, 00:00

Not After

07/03/2024, 23:59

Subject

SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:52:66:11:34:d0:1e:61:3c:34:04:03:3a:87:b7:7d
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2021, 00:00

Not After

07/03/2024, 23:59

Subject

SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:5a:a2:2e:3c:53:0e:f2:a2:14:5d:8e:f2:7f:18:2c:2b:e3:99:1d:75:f3:04:17:9b:a9:34:22:13:86:f7:c8
Signer

Actual PE Digest

39:5a:a2:2e:3c:53:0e:f2:a2:14:5d:8e:f2:7f:18:2c:2b:e3:99:1d:75:f3:04:17:9b:a9:34:22:13:86:f7:c8

Digest Algorithm

sha256

PE Digest Matches

false

57:97:ea:68:25:b5:a6:0c:42:a7:b0:22:f1:d4:d6:ce:5f:dd:c5:bc
Signer

Actual PE Digest

57:97:ea:68:25:b5:a6:0c:42:a7:b0:22:f1:d4:d6:ce:5f:dd:c5:bc

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\asin\Desktop\project\driver\x64\Release\driver.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlGetVersion
MmUnmapIoSpace
MmMapIoSpaceEx
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
ObfDereferenceObject
MmCopyMemory
PsLookupProcessByProcessId
MmCopyVirtualMemory
IoCreateDriver
PsGetProcessSectionBaseAddress

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 538B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
fortnite-external-evo.gj-master/x64/Release/evo.gj.exe
.exe windows:6 windows x64 arch:x64

c95a47b9fb0b6a17f5a97e168f8da9e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\mab82\OneDrive\Desktop\ud\evo.gj\x64\Release\evo.gj.pdb

Imports

kernel32

Process32FirstW
CloseHandle
lstrcmpiW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
CreateToolhelp32Snapshot
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
Process32NextW
CreateFileW
WaitForSingleObjectEx
DeviceIoControl
EnterCriticalSection

user32

GetSystemMetrics
GetWindow
GetWindowRect
DestroyWindow
SetWindowPos
ShowWindow
GetAsyncKeyState
DispatchMessageW
PeekMessageW
DefWindowProcA
mouse_event
SetClipboardData
GetClipboardData
GetForegroundWindow
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
LoadIconW
SetWindowLongW
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
GetClientRect
SetCursor
LoadCursorW
ClientToScreen
GetDesktopWindow
RegisterClassExA
UpdateWindow
GetKeyState
ScreenToClient
GetActiveWindow

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
_Query_perf_frequency
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Query_perf_counter
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

d3d9

Direct3DCreate9Ex

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
memset
__current_exception_context
__current_exception
__C_specific_handler
strstr
__std_exception_copy
__std_exception_destroy
__std_terminate
memcmp
memcpy
memmove
memchr

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
__p___argv
__p___argc
_crt_atexit
_cexit
exit
system
terminate
_exit
_c_exit
_initterm_e
_configure_narrow_argv
_initterm
_initialize_narrow_environment
_get_initial_narrow_environment
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_set_app_type
_register_onexit_function
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__stdio_common_vsprintf_s
fseek
fclose
fflush
_wfopen
__stdio_common_vsprintf
ftell
fread
__stdio_common_vsscanf
_set_fmode
__acrt_iob_func
__p__commode
fwrite

api-ms-win-crt-string-l1-1-0

strcmp
strncpy
isprint

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
free
malloc

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

floorf
fmodf
pow
asin
__setusermatherr
sinf
tanf
cosf
sqrt
powf
sqrtf
ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
fortnite-external-evo.gj-master/x64/Release/evo.gj.pdb
fortnite-external-evo.gj-master/x64/Release/imgui.ini
fortnite-external-evo.gj-master/x64/Release/kdmapper.exe
.exe windows:6 windows x64 arch:x64

d82bf8ddd2e00bd8d00474103b0c2224

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\mab82\Downloads\kdmapper-master ds\kdmapper-master\x64\Release\kdmapper.pdb

Imports

kernel32

GetCurrentThreadId
GetModuleHandleA
GetLastError
CloseHandle
CreateFileW
GetProcAddress
DeleteCriticalSection
GetCurrentProcessId
SetUnhandledExceptionFilter
GetTempPathW
FormatMessageA
GetLocaleInfoEx
InitializeCriticalSectionEx
VirtualAlloc
DeviceIoControl
VirtualFree
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree

advapi32

RegCloseKey
RegDeleteKeyW
RegCreateKeyW
RegOpenKeyW
RegSetKeyValueW

msvcp140

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z

ntdll

NtQuerySystemInformation
RtlInitUnicodeString

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception
__C_specific_handler
memmove
_CxxThrowException
__std_exception_copy
__std_exception_destroy
memcmp
__current_exception_context
__std_terminate
memset
memcpy

api-ms-win-crt-stdio-l1-1-0

fsetpos
ungetc
__p__commode
fflush
fread
_fseeki64
setvbuf
fgetpos
fwrite
fclose
_set_fmode
fgetc
fputc
_get_stream_buffer_pointers

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh
_set_new_mode

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_wremove
_unlock_file

api-ms-win-crt-string-l1-1-0

_wcsicmp
_stricmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_initterm
_initterm_e
_set_app_type
_seh_filter_exe
_c_exit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_exit
_cexit
terminate
exit
__p___argc
_invalid_parameter_noinfo_noreturn
__p___wargv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f77d38701a8bba43fb053109f456506

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140d

d3d9

dwmapi

imm32

vcruntime140d

vcruntime140_1d

ucrtbased

Sections

.textbss Size: - Virtual size: 403KB

.text Size: 850KB - Virtual size: 850KB

.rdata Size: 224KB - Virtual size: 223KB

.data Size: 22KB - Virtual size: 51KB

.pdata Size: 31KB - Virtual size: 30KB

.idata Size: 9KB - Virtual size: 8KB

.msvcjmc Size: 2KB - Virtual size: 1KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 373B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

ccea250b1319c1952e5d98024ffbc5c3

Code Sign

0b:52:66:11:34:d0:1e:61:3c:34:04:03:3a:87:b7:7dCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0b:52:66:11:34:d0:1e:61:3c:34:04:03:3a:87:b7:7dCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

39:5a:a2:2e:3c:53:0e:f2:a2:14:5d:8e:f2:7f:18:2c:2b:e3:99:1d:75:f3:04:17:9b:a9:34:22:13:86:f7:c8Signer

57:97:ea:68:25:b5:a6:0c:42:a7:b0:22:f1:d4:d6:ce:5f:dd:c5:bcSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 112B

.pdata Size: 512B - Virtual size: 264B

INIT Size: 1024B - Virtual size: 538B

.reloc Size: 512B - Virtual size: 36B

c95a47b9fb0b6a17f5a97e168f8da9e8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

.textbss
Size: - Virtual size: 403KB

.text
Size: 850KB - Virtual size: 850KB

.rdata
Size: 224KB - Virtual size: 223KB

.data
Size: 22KB - Virtual size: 51KB

.pdata
Size: 31KB - Virtual size: 30KB

.idata
Size: 9KB - Virtual size: 8KB

.msvcjmc
Size: 2KB - Virtual size: 1KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 373B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB

0b:52:66:11:34:d0:1e:61:3c:34:04:03:3a:87:b7:7d
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0b:52:66:11:34:d0:1e:61:3c:34:04:03:3a:87:b7:7d
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

39:5a:a2:2e:3c:53:0e:f2:a2:14:5d:8e:f2:7f:18:2c:2b:e3:99:1d:75:f3:04:17:9b:a9:34:22:13:86:f7:c8
Signer

57:97:ea:68:25:b5:a6:0c:42:a7:b0:22:f1:d4:d6:ce:5f:dd:c5:bc
Signer

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 112B

.pdata
Size: 512B - Virtual size: 264B

INIT
Size: 1024B - Virtual size: 538B

.reloc
Size: 512B - Virtual size: 36B

.text
Size: 207KB - Virtual size: 207KB

.rdata
Size: 43KB - Virtual size: 42KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 148B

.text
Size: 61KB - Virtual size: 60KB

.rdata
Size: 65KB - Virtual size: 65KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 260B