Behavioral task
behavioral1
Sample
Fortnite-cheats.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Fortnite-cheats.exe
Resource
win10v2004-20240709-en
General
-
Target
Fortnite-cheats.exe
-
Size
183KB
-
MD5
ae929709a4552c9ebc90969c3214bcaf
-
SHA1
092a3c081b35e6499db9c98e64263a44c2bb3c0c
-
SHA256
d5f553d38a02c5e90bf3714336de27cbf27294b96f826d47e24466a345c0a161
-
SHA512
9d2bbdcabdfc8202963b5c0efc055093bb5df8b3915d8afb2da2fc87e30bd18046a89c03234852726196fb39146b7642f57b1b91903cd84e7cc01882543f73e9
-
SSDEEP
3072:3bRE9xTBPG7dabP6XOd32jyOMg3ZxLBz65/M6If+3Js+3JFkKeTnP:ri9xdO7dabPgOdPcxLxBt25
Malware Config
Extracted
xworm
edition-ages.gl.at.ply.gg :14076
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Fortnite-cheats.exe
Files
-
Fortnite-cheats.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ