�q*"��7e��f�u��� P�� .���[��.pMnO�*��&�Y��O[���FJ��G_�bƵA��;}j�V�ec���l�I�O��'e&~KCc�Su��e*��mU�lj*P�e��OЦ�(��A�?�vD�9?K���lP�Nj�W��R˩:'�5�/d�3*��2:�i��_��� �~̚5��p��I�JĦ�_���VPU�Fv�Ga<k�� &^���� ���6����3��~���e���l�qc�>T�*p�g֤���ȥ�'�[1sl_��2d c9�ڱH䙕o��:VFD�C=�-f�Hƞ�L�R�J�u���S?|��S �!��<�^sߵI���N�R@ԛK�mY�+3[5�8�I�&���T����hcì�d>�!|�łq���I��9`�Ո���x�b��t�����������<� �|��f�_�we�M��V����Ƶ��M��V�*�g�����0����7�a�}��ˎ��>���A�닠��u��P4�� wwտ�����K�D����¯�)s@�c\�CQ+�ڎ���O���}�Ѹ�ǯ�y�v�P�Cj���#��u*Wh�&��eM���l*�єI\ׯ���r��x��ޙ�3k���sCp�߬�n�6��q�#���4[Nhy>�U�Ra��|"-c�79���YA��O��ɭ���Cw�_���7 VXA�S�hR����L��B�N�.��,��%�N��9�����Ɔ~�x/�U�o�p���$�����x#� 430�$�� ���۷R��oX�g�y���M�Y\~>z���~qiȅ�R/�J�Re�e�5�,M��IA$����}Ͻ�� �u��د;N{�|����W,tf `[w}\G:| 1��+E)�a.�,Ss���.��uN0���<�p�ğ��q��'����Qo��vm���j�%�ܻ���-�Y>����"�2�C�O�ˣ46�_�Z��&�o���3�ۆ���?dH��\'h��NR���%O�n��tlC�X9P�XN�o���5�J���֩�i����וa|����>�)cپĻ��a�6J�MX�kg��wN;p���o��m��p�D��ԣ-}���S�q��)6�����r8fuj#�?�l��J��M���.����G����:�L�T��we����� � G�zQ����-����BG"�m�!r���R�jy���/$Ӻ~���m� �/f0�Q=�lv��[� I!\ ��Ce��ͪ�_7⁷�F5��p�{g�V�/�n�Y�,0;4��?�{I�^�#�'��8wZJ����qϟ���ZP��9j젙X3��!s/� ����-�nH K*�cp���I���L��>M+�����(�=�1D�=�u��w�ϻ����������@1n\(�U+��$���T��t ș�@�umRw���E�����^�XwE/4��c�� �!��fr�i U�m�w �I�������+�mr�H��ډ ���S(�zO��Vs9�]�v\ܻ�D�P�v ��?�+�2ë~�E�c���ܫ�,#��RW��,G{M�+�~ٖޅ��~L������7���&���D������nN �$��O7?}���b�:��%pj���4`��E(-�W��b����|gc���d���1��Gu)�Ӄ���Cs��yY�ԙ^�w�1g*�H^t�v�?Q ��������N���m�-��g�%pN|=q-P��p����@!I45p>rUX�W��0f��E-���ϵ:���ccJ��'���~r �t���" _3�2r�oAx��i��]�Y���/�u��X��sv�������H�\� @�n��*n��y���c��@!�FX\�7Q�����^���h3�f�&MqX�Q�i<P�/��/$i ����d�)P�Ql�5`xY2��zH�x��.`>�ː�H���<���,���\���aqǁ���9��yp�g�����<�E�N�(}���$V.�%�lu^�>`��䣿dG1�5��M5�)��x_5!��R|�aP���\"o���;ّ$�LJ܉}�F�`Nj��7�'�Rf��y��kN]��F��\�� <��oz U,���F%M*�Eǐ��0Ȋ��goR������Z��AF���;������sY��r1ˏ}���?����:�+&0�F���Uwb� �.* �@4��[��i��.��'P�0g���u����@{���%O���!=�s�K��{n�<� ����E���fL�� �<���g�liM�p�� ��O�K�O%zw��<X��z�1KX��ęD߯ń�sdq�Fmԃ��z�$���/�2������<d�L�B�/Q�Aq3�Sq��/�fx.�ы�)���Z6y�`�?��?=3�y�PxZ���%��r��?��̠�5!���U�5�?X:Mfa�����9�)X]�j�5@� ��V�. *T���09 &��R���_�b�$"����Y8�h�� %vfEN�������s���-奶�˭@&��뾽ɉeq���c��>��� �u�)�i�"I�gu�+�[g'�e�!��mj��䐉� �1�,�i!w�U�k\O�*P-�rƵ�&���������n��Z�B� 38r��Y�}:m�|ܖ��$ m�C�/[L��3�;��iN�ؗ�7�=���Yh�ẵ��"���x�X?�5��0�� ���9��~+����J�b��U�c��z7n<��_D�*��J3(��t:�^����������l�dN�S��x�4>Fh��s3�$˳�ٮi��@M-�wU�����"�Y����·������o�y��d̃N�5��v.��;����fn�n�Vp�4���t)���Dm�Zld��b�+�˸)�����_���!@����@`O�f���Zڕҽ��x��6, ں�Y��)64�oX"x[DN�,�{o*c�y�����a[�����`��L�����YCИ1D��g�O�����{�3vhk����${pV�4d�V��N�Z��B��@w����N�-���\�Xt�$k�[��S����BFÌ$%�>�z��ْ�
Static task
static1
Behavioral task
behavioral1
Sample
Fortnite.exe
Resource
win10v2004-20240704-en
General
-
Target
Fortnite.exe
-
Size
6.9MB
-
MD5
71da92d1c349e9953f5a6513b36ac0b0
-
SHA1
2f2ae298610a7d131683e8279ce691a43a540c1f
-
SHA256
504c76f9f995c30d5f2c699580788a0f493f8a71aa17e6f2b0075917ad86caab
-
SHA512
6c8b964f6fa7a7a2f3b70985db4c3413491c6a4a89450d403c5178216ecaaf9e986dd2525fcfca40a596b557953a0301494b96061e37a55d584a3c0d6bb5e498
-
SSDEEP
196608:M29NlSf+xGeNo2R+95fQ3q48PpBb09MLrqFW:b9Nla+kMR+95RBB8Mk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Fortnite.exe
Files
-
Fortnite.exe.exe windows:6 windows x64 arch:x64
4dcb5f45af24051318500b638f070d45
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AcquireSRWLockExclusive
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
normaliz
IdnToAscii
ws2_32
getsockopt
wldap32
ord200
crypt32
CertCloseStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-stdio-l1-1-0
_open
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 504KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fuckoff Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fuckoff Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ