�3�J< � I?�㛄��I�?JF�==���yE�p����E��&���� �[[j ����r�����'����}r��#�5 A�F���1nYN�1�����|R���jќj(��)>I��̯S8��/䰜E�M�94��-Y��TѸ�^���#aXh�iX�F��a9�ޜ��� [��P�rS�XDXz���� ��2ό$5��G�<X��F��'��\{pG�Xvr7a\b��$dx�A�K!��h7�9f\�����$���d�K�"�)�w�yc(���s����E��\�+���X��B�e�Ǣ��@28��c���1�>��k�7�NB�6��=����"ۭ.8e�F���GĨ�{�7`_��WY�|w��і�{)5���8ى4�fj��߂:l���7�v�uL�L;�����4�I�T�H��]C���ơ�]l��$G����P��߯Cds'e���>x˪''��O�����95K�=|D���.�C�@�r�[��5A�=��wZ���f��=!�r�g���D�F/��cΕ+�G�m�4QA�4�=$�S��Y���;z�"G��oP�<J�� N>�?az��vA��ߣe���"����H����bs09 v0�E��h�m�4[L�m���z��q��iD�������_7��͝x�� m�7�Y}QxA��'��4:\�fA�Ί�� Sh�n�7*�9���U(��+6ʯ4 {.-����D� �y��0M Ee��2�t�7�5��ߕ,���)1ʸ]��C����P ~��\r��'�-B-� 3wd��9� @~b�7t�0v6{����R��+�a0�!ޚ��D$V�0�*�P�U��A�V�+M]s����0�!1d�kR�V,�3)i�����o�p��U�2+VW.��4^?Y�L�³�uj�lש{X�~�W��6�XN���Yë[F�a���u��9z!)0XjZ���#���k�b��c�mJE�j�j��KS8*�#V�����W?�1�+��"�qp�o���� g���i�]�s����8�v�`����1�O�h@b��zI�Rs�M��L [pY%�T��FUqa3��9JskI�a��?gѤqv�g3aͨ-��{���LOUH����S�-�v�3� �Sƙ]M�`F�|��痀�bg�de��S�C����k+�� ��;,;�G�I9�{Ւ�H Z�j���1�T��'�.xb���W N�7#����@�Y�_X+�]�i�nk�O�7��3����fo�����``نg0�JL����G�wQ��$&-������f"U���#d�3F�fK'O��}�o�Rԡ�����E��;=�e��.����)��KmL ��\A�0̹@H����JW�y�c�61=j�6[eؗ[��_��g<F�>I���GyDM��Խ0��a�n����C>��PK��o0~8^l��i��kADp�"�xx/:،�� �����-9���ߧ��Jc����a�Hv���(kM�S��m?0܇�/�j�#.3%�1s���L�#��7N��@�Ś�-AR:�)�ns- �ȕW�P�T@]Q�8�#����� ��SJNWڡ�>�=X����dj����8C�E ��C��%�`76g�����M�����.$��n������$��W���=$� v�0T�� |V�������h���{ּ90n̈́B ��&�$pac�擋�hds�Ŭ�~Uڷ����ٚˢ3����X!�s��]��^p9��}є���������+���#�R�&~�G�(�W�T��X��}�k�1��K��1���2o+c�o�eI,6rN3�rl���~X������W�~��S[zO�����ti�X�+��v@���~�� ����E� tQƦ[��Wi��WR��H���;ٶj!��h�N�F]��E�p�+����`�@#D�}�5u��C�0\��RF�3{>���؊�� �Y��K:�6�^|�� d�T��nVkp�T�<���-s�-%j��1�B���n7�0�����C&�p����������\�oη0��U�2������e|�B��0��C Dݚ;ɠE}F� [��D_������L�����m4��:X�/^��]�Y�d��K��J4�J��,�:�;y�a�I��������C����R ��Zm���36�c�-2��@�T�s��0�?v,�օ�[#���a�n ��w ʛ�K��e��jgBy��ɫ�t�`�����D����ݱ��(<�|�xڛ1�o̱�����q�����>�jy b�b��$H��(��QdJ�X�4���Ν襒-��&,�O,q���}[���!PcLcF<���D���P��w"�f�ї"���䶘f���]�'�����!N������U���H���9^�f�a�r�*��V��XUGg��{��-��e�s�R�{� �����+�N�:>���qh֯y��&ZT���������س�\��B��d 뉞��A�C�7快DӀvG���o���iջ��!G�Ie����+\ڒ���F[���V^aѡ/�2���0�Eu͡�N����AjK� ^�M�w�!^�M������t9!����27�3l��]� Ő������l��|%Э�I�+L��;N���\�����W�'^7@Z+�����E阩�Nҕ�[_�(���u��}V�v�;�b��<4�0[�1�R�F�5M����/}G��IE;�tT(:�mjۙ�N���6���gGf���!"Tt7����,��\W���lҘ|��LU��2Mf�t���j���ǣ�:�T* k�����elB�}]m ���R��"p��nko$��U(����kjG;��Ѓ��M(̪��GO�����D!��|-���f����a�/�h�١P,�F�2"��Ԕ,(�^��#&�dA4)�E�}-7MF+4��&$XR��$�Ł�\cSΰ���)%�q�j�pl5�Nd��B�|TX�j C�Ɏ��.�vw���}��!J��^>�̰.����!��$���@ץ��T
Static task
static1
Behavioral task
behavioral1
Sample
orqur - fortnite.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
orqur - fortnite.exe
Resource
win10v2004-20240802-en
General
-
Target
orqur - fortnite.exe
-
Size
6.6MB
-
MD5
8f10ad3ec661c6f442e7fad625c1bbac
-
SHA1
506db2cb55ca0f04e4d535d8e0f8293511d147a6
-
SHA256
2dbf25db010361831baef17f92285d2efb32af12e064d80cc3037937fe228e69
-
SHA512
98c10f100e974e8ee32419b00d12f17eedf681ae686cb6f30fcf844202bf664f94732f81aa2bf0a0f2691a24840179f7b31b58131c4f83883f361cae303f51a5
-
SSDEEP
98304:Jen1Kvlahp1Z9hzBLzzbMXYlXYxnCg2j5scrNws9ZiH/MctRkCgL4b3Q6V:nvl81Z1zYXYUne5scrNwfVkvL4Q6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource orqur - fortnite.exe
Files
-
orqur - fortnite.exe.exe windows:6 windows x64 arch:x64
d8afa69b49a0fe7fb12223f0f89a173b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wininet
InternetOpenUrlA
kernel32
CreateFileMappingW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorW
CharUpperBuffW
advapi32
CryptEncrypt
msvcp140
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord200
crypt32
CertFreeCertificateChainEngine
ws2_32
accept
shlwapi
PathFindFileNameW
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 923KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.XZz Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.9x\ Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pm= Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ