C:\Users\NotRatted\Downloads\Memenite-External-Fortnite-Updated-Source-Leak-main\Memenite-External-Fortnite-Updated-Source-Leak-main\x64\Release\Fortnite.pdb
Behavioral task
behavioral1
Sample
Fortnite.exe
Resource
win7-20231129-en
General
-
Target
Fortnite.exe
-
Size
3.8MB
-
MD5
f19ebdbf52c63a6a26cde5d21c923c32
-
SHA1
c5db469697a3fdee465f253b91a369e3af396387
-
SHA256
1dc08cd07a32da62aba3f31a61c0f906a2bb96f488178db94dd644e14da2189a
-
SHA512
84b354d95bac0d33b31b61911cb3727e825a1ac770e1d2431eb9f77f5af6901dcb252aae8d193b40d48475d026c87cc048cd681374d5dc704aea14a3d63f81d5
-
SSDEEP
49152:etVo+axKEpde1nlj0qxOidcA4LQnmA+cfjm+OIJC541yygYWW+sUfuNtyza32ehx:hdA08OidcA4LWZ+cfjm+OIJC541yy1T
Malware Config
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Fortnite.exe
Files
-
Fortnite.exe.exe windows:6 windows x64 arch:x64
dd4ed4a4c33a170e2962b320206c9aa2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
opengl32
wglGetProcAddress
wglGetCurrentDC
glClear
glGetIntegerv
glGetString
glPixelStorei
glDisable
glDrawElements
glIsEnabled
glTexImage2D
glDeleteTextures
glTexParameteri
glScissor
glEnable
glGenTextures
glBindTexture
glPolygonMode
glViewport
kernel32
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
VirtualAlloc
CreateToolhelp32Snapshot
Sleep
Process32NextW
CreateFileA
Process32FirstW
CloseHandle
CreateThread
GetProcAddress
GetCurrentProcessId
FlushFileBuffers
GetModuleHandleW
SetThreadExecutionState
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLastError
FreeLibrary
LoadLibraryA
VerSetConditionMask
FormatMessageW
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
AreFileApisANSI
GetFileAttributesExW
FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
AcquireSRWLockExclusive
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
GetCurrentProcess
user32
EnumDisplayMonitors
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
ToUnicode
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetRawInputDeviceList
GetRawInputDeviceInfoA
RegisterRawInputDevices
GetRawInputData
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetPropW
LoadImageW
DestroyIcon
LoadCursorW
GetClassLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
SetRect
ClipCursor
WindowFromPoint
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
AdjustWindowRectEx
GetClientRect
SetWindowTextW
SetPropW
ReleaseDC
GetDC
CreateIconIndirect
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetForegroundWindow
FindWindowA
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
MapVirtualKeyW
GetActiveWindow
SetFocus
IsZoomed
RemovePropW
BringWindowToTop
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
FlashWindow
SetLayeredWindowAttributes
GetLayeredWindowAttributes
ShowWindow
DestroyWindow
CreateWindowExW
EnumWindows
GetForegroundWindow
GetAsyncKeyState
GetSystemMetrics
GetWindowRect
GetKeyState
GetWindowThreadProcessId
TrackMouseEvent
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessageTime
SendMessageW
PostMessageW
WaitMessage
DefWindowProcW
RegisterClassExW
UnregisterClassW
gdi32
CreateDCW
CreateRectRgn
DeleteObject
CreateDIBSection
ChoosePixelFormat
SetDeviceGammaRamp
GetDeviceGammaRamp
GetDeviceCaps
DeleteDC
CreateBitmap
SwapBuffers
SetPixelFormat
DescribePixelFormat
shell32
DragFinish
DragQueryPoint
DragQueryFileW
DragAcceptFiles
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
msvcp140
_Mtx_destroy_in_situ
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Syserror_map@std@@YAPEBDH@Z
_Mtx_lock
_Mtx_init_in_situ
_Query_perf_counter
_Mtx_unlock
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
ntdll
ZwClose
ZwQueryValueKey
ZwSetValueKey
ZwOpenKey
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ZwCreateKey
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
memchr
__vcrt_LoadLibraryExW
__vcrt_GetModuleFileNameW
__C_specific_handler_noexcept
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
memcmp
memmove
memcpy
wcsstr
__std_exception_copy
__std_exception_destroy
strstr
__std_terminate
api-ms-win-crt-stdio-l1-1-0
setvbuf
fgetpos
fsetpos
_get_stream_buffer_pointers
__stdio_common_vsnprintf_s
_set_fmode
fgetc
__stdio_common_vsprintf_s
__p__commode
ungetc
fputc
__stdio_common_vfprintf
ftell
__acrt_iob_func
__stdio_common_vsscanf
fread
fflush
__stdio_common_vsprintf
_wfopen
fwrite
fclose
fseek
_fseeki64
api-ms-win-crt-string-l1-1-0
strspn
strlen
strncpy
strcmp
wcscpy_s
strcpy_s
strcat_s
strncmp
strcpy
strcspn
wcscpy
wcscmp
api-ms-win-crt-utility-l1-1-0
abs
qsort
api-ms-win-crt-heap-l1-1-0
realloc
free
malloc
calloc
_set_new_mode
_callnewh
api-ms-win-crt-convert-l1-1-0
atof
strtoul
api-ms-win-crt-runtime-l1-1-0
abort
__p___argv
__p___argc
_c_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_exit
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_wassert
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
system
_invalid_parameter_noinfo_noreturn
terminate
_register_thread_local_exe_atexit_callback
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-math-l1-1-0
cosf
acosf
asin
powf
fmodf
sqrtf
ceilf
atan
__setusermatherr
sqrt
sinf
tanf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
Sections
.text Size: 509KB - Virtual size: 508KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 238KB - Virtual size: 237KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ