(ض7�ѩ�6����C�[4Ä���9�5~r���ǚ����L�������S{�Ģ�%uT�w��ĕs�%�@łY����cU���V����dպ�W�]x�B'�|�u�J��܃���`���eBs�������a��Z)��PQ{�V���� p�oc/r�Ε�Q�Z���x���,�E|b�"�N{�V��R��\�6�����=�}^lI�A�u<�W3U�.����&����4Ț��d�݂�Y�7���K�Lȉ�{Ĝ����h���]"��H�� �3�r�-�3�AC{�d}m3���䮢�nQ��=��n�!��/72)Ln��=��>aZFS�ͩ���"P�� F��הB�ܲ\KM`�@V�R���6h��{:���%�C��}��/����9d&���=iV۹�K�A�0&�A����w�@Ho ��5�p��2�>��y���u��:r�k�7G9�4�I"�6Q��V��o{�����n�%��nu/G�WR��\5�}�N��W�-5�������<�%�"�%H&����/�K�(���w-�HG����W����Պ����� ����~#���}����fuZ��9��<������]g��h� ������%&�2 ~�]��B��Łu�2�aN� ������8�&V[�L���Y2���x�&q�V��e��l�5�Xm.1�D�v �Jg�2�)�iC�o��6/<r�ܘW�#h�����������i�w{t�=��=�]�ϯy|?��6B���ޚ�-PQ�Q�\��C�(:��p'�ee�]-�;�"��R,�=�B�kC��ЃݙӪ�Y�\�%W�Z�p(4���� �?1�v�%@�C��9�G+v�p�Q�����:���i��LX�b��[ �� �B/N��r��a �ÃxJ��᐀�*|��DP� �����Բ),����͐����8oQSy��.ёk�"�~k'ŧ�h&��-� �8q�e�s��N�Kvk>B��<Q?�@]�?)Yo������! �� 9�Ƈ�-��m�'��ci;��je!a��P� R�dp�<k���Tnj:�Ě=u\|wu�{Q\�G9��M��5�3NBH�n�Om]���ɩ�8vi��C�2����]������V���p�� ��S1.ؖ���F0(RC�0O�x,�S7��4�қ�Ə�F��j�$eȄ=���!o7����\�.2)�Բ�ۨ���Lj~�j�1��^LC�F�������m�4l�x�!�mr_�s����H>pKNjƶ'_�&� ���1��=+�g���#x�kg�]���|-�q!��݊(�G#�W/Dq$#I�@�e5> �~ p������>zJ�ܭX��!��w4��b$٢B������Js�!?������6(M�U)��~I�h'_���d��P������9s�b�������l�'.b� �l�=T��m���в�$�a?AB䑇��r���9v׀�!�b�?_�����3}���>�#�e��_���?W,sX��)�T��: �+<i�*ئN�%�&�� ��� ��i>�X�1�M!����!�[��jq��̊7ɫj�#�=��y�(��������{fm/�/r[к�ק��o�D�����9Xދ�j�T%R�\͎�^- p�N-�f�h�T:q��O2��WW�����;Hyb�O���g�j~dn��\n��'A�ɠ^�:�5��n�$�$ޒ�/�ʼn�Oљ��|vZ���'¹ȝ<�ELJ� *�`��U3*�V��PTi�Z�h�DC�L˺n�ԫ�G���&t iZLh���z����ˮd?5�M�pȢ�M�<ߨN>s�s���МU� (��G���z뭿� �����Opx Pi ������04�r��������zٔ�H8���?��wj[���Ӄ���ѓ������s�O����!��ݶ8�$&��+�;P��aX��de��@�������.�w"���f������a�Uʩ�2z�M�$��NI��X�N2h)c� �;�4��yєۿrY��C"X����� O��>Bn�1���+3�/2���t�� ���X��>�u�µ�����Ũ��/oE���gv��;���?'g��D*�U%����2��4��>v�sꨟS8�>�����Oi��Ƽ�KzVU�-1���н��h���f��%��e�S}�"��V�� �I� =��h#H�Zfa}�EM�V�fs�?s��C�U��A�~�[�� cى<�B0G�p< �/P�E�?H��/��(7�B(e�N0tg�f��"�V�snʒ �J����'AY ���R֣�06ﻆ��أ���"�h����ш#��4�8�W���Fp��b�7��p� q�`<�]���3��tF{&4dib�<�*�I�c������`m*T�X�]L,�Z���-�ls@��=���`�1W/l�r袗)벃�$S콗}()ަ�N��9��Z��Gb�2S��������̨_�@_R>�"�c0�k;eٶ���s����s_� 7�����"��L�׀���穛֕��mZ�6�k�j��b�x� ]E��_{D�ށ?�NB�O�w�����������Wз�薃�U� ��G^��؟��0����~f$�*��_S���SLe�U �DN�LSz�vV��W]�q�G���Ad~�LmK���V �7#� /=�^ FRqiai&T�~�8e;Lv���s���ӣb��y���z]UJM��ab' �g��1z���J?D`�|g�U���ҩұ1#�#ٸTA��*YG���d��z�U���3�㊿61��8V݁q,aPS������>ѵ�hi�h���S�B���y�����]sGʾH'������G%i�U��x�o.��ʦ����9�}���z��.lk��%J+�,�P�J;���-A��; ��W���@'������� ��/��C*�>,��* �݆���^&���%�/O���R���<e9����?�0&_�D�� �����U��v�� 2�M���i���K1��*��)�z;����K���#i���mn��"��Q\z߰�YOA_�����=
Static task
static1
Behavioral task
behavioral1
Sample
macos_fortnite_private_3.1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
macos_fortnite_private_3.1.exe
Resource
win10v2004-20240426-en
General
-
Target
macos_fortnite_private_3.1.exe
-
Size
5.9MB
-
MD5
aa9c8d68786eb2fcb5ad8ef6d5c96be3
-
SHA1
c6f6be9793ccdb3a3a0c78838376447962693979
-
SHA256
336a186c6f24229e14e1816ce0cb2552bfb421f39cd2575982ff2859ce8152e8
-
SHA512
06e5aa94128ca1008121c14f5cea87b8ef9a7e7ee8d8d38c8cbbd1518eaa564f874c94c2f8cc583428cb44a8b2fa7d87826907d63b95bac052a80aaf40792141
-
SSDEEP
98304:FPFidoXJt/Ma+i1ILfh6FXbHwQMVI/j+svnFSG3zoORP1SSRz9zP:LidoXv/+ioZ4LwrVIqSE4P7z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource macos_fortnite_private_3.1.exe
Files
-
macos_fortnite_private_3.1.exe.exe windows:6 windows x64 arch:x64
310d5429d6021740360406309adbbee9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
LocalFree
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptHashData
imm32
ImmReleaseContext
msvcp140
?good@ios_base@std@@QEBA_NXZ
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertGetCertificateChain
ws2_32
closesocket
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
ceilf
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 726KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 973KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.120 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.121 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ