Medal[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Medal.exe
Size

4.7MB
MD5

902cdde9c59b04984e3a1fbe7abdb3f6
SHA1

6574393f8b04daee7d5ca75d962d5933fd035449
SHA256

1d010686b8a2403bf54c87aafd44ff930d8a7920874725614363c0ffcfc8ef08
SHA512

fe30dff933b55a3a72592d63fa66891ffee6a67f515099d66811a141d76afe52e6524ea8a384eb823b0a5ea71b4a8a0a5b196fb6f1b3e359fbf07d7b5d323d63
SSDEEP

49152:Iz7KyRRvyXDpnJYHqWXGh3rV3wXU8JThz43dfWFeMDUona3DQvxmRfPnyeniZynn:ceCvymRXup3wXU+hz4JAUE6nuZAQY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Medal.exe

Files

Medal.exe
.exe windows:6 windows x64 arch:x64

76325a60ea830e6aa469b1ec1e37b412

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Desktop\fortnite project\cheat src\marcelfn\fortnite\marcelFN.pdb

Imports

ntdll

RtlCaptureContext

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11d_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetProcessHeap

user32

GetForegroundWindow

advapi32

SetSecurityInfo

shell32

ShellExecuteA

msvcp140

??Bid@locale@std@@QEAA_KXZ

imm32

ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

psapi

GetModuleInformation

shlwapi

PathFindFileNameW

normaliz

IdnToAscii

wldap32

ord200

crypt32

CertGetNameStringA

ws2_32

sendto

rpcrt4

RpcStringFreeA

userenv

UnloadUserProfile

vcruntime140

__current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-stdio-l1-1-0

fclose

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-math-l1-1-0

cos

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

76325a60ea830e6aa469b1ec1e37b412

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

d3d11

d3dcompiler_43

d3dx11d_43

kernel32

user32

advapi32

shell32

msvcp140

imm32

dwmapi

psapi

shlwapi

normaliz

wldap32

crypt32

ws2_32

rpcrt4

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

iphlpapi

msvcrt

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.data1 Size: 1.2MB - Virtual size: 1.2MB

.idata Size: 3KB - Virtual size: 4KB

.data1 Size: 4KB - Virtual size: 4KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.data1
Size: 1.2MB - Virtual size: 1.2MB

.idata
Size: 3KB - Virtual size: 4KB

.data1
Size: 4KB - Virtual size: 4KB