C:\Users\segamfle\Downloads\foof\foof\StreckFortnite\Release\streckfortnite.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3dff3f32ae84616ce0d604873fbc3590N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3dff3f32ae84616ce0d604873fbc3590N.exe
Resource
win10v2004-20240709-en
General
-
Target
3dff3f32ae84616ce0d604873fbc3590N.exe
-
Size
2.2MB
-
MD5
3dff3f32ae84616ce0d604873fbc3590
-
SHA1
987083d21e46b839f6626aeee786c9711682481b
-
SHA256
a814bae14e4bf5d70d41e082d5aa440bbfeda72e1ae3e1c02bd50ced01451eec
-
SHA512
9c487e0ff20291cbd27ad9974deeb644e497fff77c4be4da62dd252e39c176699a16ff9502ea2a391197ddfd1ecddc07cfe2741808be92b4b5c0dcd423b27d10
-
SSDEEP
49152:90wFaXgdMUQvI5PNVPsrOT3X0vnICfUbNkDVPutGKD4rhI7LpgHxmXkjLSNR4Vy:XkvUN6r/b4m/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3dff3f32ae84616ce0d604873fbc3590N.exe
Files
-
3dff3f32ae84616ce0d604873fbc3590N.exe.exe windows:6 windows x64 arch:x64
5601a8d70ead6fc38ffb0ca226a4d07d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
CloseHandle
SetCommTimeouts
SetCommState
HeapFree
GetCurrentProcess
GetStdHandle
InitializeCriticalSectionEx
GetEnvironmentVariableA
FindClose
Sleep
GetTickCount64
GetLastError
K32GetProcessMemoryInfo
HeapAlloc
DeleteCriticalSection
ExitProcess
AllocConsole
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
CreateFileA
ReadFile
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WriteFile
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
QueryPerformanceCounter
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetCommState
GetFileSizeEx
user32
GetCapture
ScreenToClient
MonitorFromWindow
GetMessageExtraInfo
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetAsyncKeyState
UpdateWindow
GetClientRect
GetDesktopWindow
ClientToScreen
SetWindowLongW
TranslateMessage
SetLayeredWindowAttributes
TrackMouseEvent
MessageBoxA
PeekMessageW
GetMonitorInfoW
DispatchMessageW
ShowWindow
GetCursorPos
RegisterClassExW
SetWindowTextW
GetSystemMetrics
SetWindowPos
GetForegroundWindow
LoadCursorW
SetCapture
PostQuitMessage
SetCursor
GetWindowRect
DefWindowProcW
ReleaseCapture
IsWindowUnicode
SetCursorPos
gdi32
GetStockObject
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
leechcore
LcCommand
LcCreate
LcClose
vmm
VMMDLL_MemWrite
VMMDLL_VfsReadW
VMMDLL_PidGetFromName
VMMDLL_Initialize
VMMDLL_Scatter_ExecuteRead
VMMDLL_VfsListU
VMMDLL_Scatter_CloseHandle
VMMDLL_MemReadEx
VMMDLL_ConfigGet
VMMDLL_InitializePlugins
VMMDLL_Scatter_Clear
VMMDLL_Map_GetModuleFromNameU
VMMDLL_Scatter_PrepareEx
VMMDLL_Scatter_Initialize
VMMDLL_ProcessGetInformationAll
VMMDLL_Map_GetModuleFromNameW
VMMDLL_ConfigSet
VMMDLL_PdbSymbolAddress
VMMDLL_Map_GetEATU
VMMDLL_MemFree
VMMDLL_ProcessGetModuleBaseU
VMMDLL_WinReg_QueryValueExU
VMMDLL_Close
VMMDLL_PdbLoad
msvcp140
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Query_perf_counter
_Thrd_join
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
_Thrd_detach
_Xtime_get_ticks
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
setupapi
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
ws2_32
recvfrom
closesocket
connect
htons
send
sendto
socket
setsockopt
WSAStartup
recv
inet_addr
WSAGetLastError
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
winmm
PlaySoundW
PlaySoundA
winhttp
WinHttpSendRequest
WinHttpConnect
WinHttpOpen
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpReadData
WinHttpOpenRequest
WinHttpQueryDataAvailable
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__intrinsic_setjmp
__C_specific_handler
__current_exception
memcmp
__RTDynamicCast
memchr
memset
memmove
memcpy
longjmp
strrchr
strstr
__std_exception_copy
__std_exception_destroy
__std_terminate
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_c_exit
terminate
_errno
exit
_beginthreadex
_wassert
_invalid_parameter_noinfo_noreturn
_exit
_initterm_e
_initterm
abort
_register_thread_local_exe_atexit_callback
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__acrt_iob_func
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fwrite
fgetpos
__stdio_common_vsscanf
fclose
fgetc
__stdio_common_vsprintf_s
__stdio_common_vfprintf
fflush
fputc
freopen
fread
_set_fmode
__p__commode
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-string-l1-1-0
strcpy_s
tolower
iscntrl
isalnum
strncmp
strcmp
strncpy
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
api-ms-win-crt-convert-l1-1-0
atof
atoi
strtoll
strtod
wcstombs
strtoull
strtol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
___lc_codepage_func
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-math-l1-1-0
sinf
powf
_dclass
acosf
sqrt
atan2
__setusermatherr
atan2f
_dsign
ceilf
cosf
fmodf
sqrtf
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 345KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 627KB - Virtual size: 634KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ