D:\what the sigma\FortniteCheatRecode\FortniteCheatRecode\x64\Release\usermode.pdb
Static task
static1
Behavioral task
behavioral1
Sample
usermode (2).exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
usermode (2).exe
Resource
win10v2004-20241007-en
General
-
Target
usermode (2).exe
-
Size
1.0MB
-
MD5
6faa9b92da27dda5713fe4a82acd0567
-
SHA1
9d667a158697bea7668d3fefc6a4fa0764c01666
-
SHA256
a7422568e66adadf20d1ff08b67438a693520e6476b80ac9fa5556cb20d564f6
-
SHA512
5efa28149f74fc63772f007d9fad6c03857da839502d0ecfb4c6d960506b092a76c8782556a21faae6c6178316c1275df6e5a5d2a8a7face59fc1f11da727daa
-
SSDEEP
24576:URJOLUJZJcJ+LMvkO9se/Gs0C2TWpeQtYw5uEBu36Lk/1sUf1sUAGnxxiZ:p/m/TWEQttBUyUSUxnq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource usermode (2).exe
Files
-
usermode (2).exe.exe windows:6 windows x64 arch:x64
0ff3e88f94a855b12859ab3172a1adc9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WakeAllConditionVariable
OutputDebugStringW
IsDebuggerPresent
GetFileInformationByHandleEx
AreFileApisANSI
GetTempPathW
QueryPerformanceFrequency
SetFileInformationByHandle
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesW
FindFirstFileW
FindClose
MoveFileExA
GetCurrentThreadId
SleepConditionVariableSRW
AcquireSRWLockExclusive
GetTickCount
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
QueryPerformanceCounter
VerSetConditionMask
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcmpiA
LoadLibraryA
LoadLibraryExA
GetProcAddress
VirtualFree
VirtualAlloc
DeviceIoControl
CreateFileA
LocalFree
GetModuleHandleW
GetModuleHandleA
GetCurrentProcess
ReleaseSRWLockExclusive
GetLocaleInfoEx
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
FormatMessageA
SetLastError
GetLocaleInfoA
FreeLibrary
Sleep
DeleteCriticalSection
InitializeCriticalSectionEx
InitializeSListHead
GetLastError
CloseHandle
CreateFileW
GetSystemTimeAsFileTime
user32
GetClipboardData
EmptyClipboard
GetKeyboardLayout
GetKeyState
DispatchMessageA
GetAsyncKeyState
GetClientRect
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
LoadCursorA
SetProcessDPIAware
GetSystemMetrics
PeekMessageA
UpdateWindow
OpenClipboard
CloseClipboard
MessageBoxA
DestroyWindow
ShowWindow
GetForegroundWindow
SetClipboardData
TranslateMessage
advapi32
CryptGenRandom
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegCreateKeyA
RegDeleteKeyA
RegOpenKeyA
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
OpenProcessToken
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
shell32
ShellExecuteA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Query_perf_counter
_Query_perf_frequency
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?setf@ios_base@std@@QEAAHHH@Z
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
normaliz
IdnToAscii
wldap32
ord46
ord211
ord60
ord45
ord50
ord41
ord217
ord143
ord26
ord27
ord32
ord33
ord35
ord79
ord301
ord200
ord22
ord30
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CryptDecodeObjectEx
CertOpenStore
ws2_32
gethostname
ntohl
getaddrinfo
sendto
recvfrom
closesocket
recv
send
WSAGetLastError
select
__WSAFDIsSet
ioctlsocket
listen
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
htonl
freeaddrinfo
ntdll
NtLoadDriver
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlAnsiStringToUnicodeString
NtUnloadDriver
RtlInitAnsiString
RtlFreeUnicodeString
RtlCaptureContext
NtQuerySystemInformation
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140
memset
memmove
memcpy
memcmp
memchr
_CxxThrowException
strchr
__std_exception_copy
__std_terminate
strrchr
__C_specific_handler
__current_exception
__current_exception_context
strstr
__std_exception_destroy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_errno
system
abort
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_c_exit
__p___argv
__p___argc
_crt_atexit
_exit
exit
_getpid
_beginthreadex
terminate
__sys_nerr
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_initterm_e
_cexit
_seh_filter_exe
_set_app_type
strerror
_get_initial_narrow_environment
_initterm
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
free
_callnewh
realloc
api-ms-win-crt-convert-l1-1-0
strtol
strtoll
atoi
strtoul
atof
api-ms-win-crt-stdio-l1-1-0
_lseeki64
_set_fmode
_fseeki64
feof
fgets
fopen
__p__commode
fwrite
_read
_write
setvbuf
__stdio_common_vsscanf
_close
_open
ungetc
ftell
fseek
_wfopen
__stdio_common_vfprintf
__acrt_iob_func
_get_stream_buffer_pointers
fclose
fflush
__stdio_common_vsprintf
fsetpos
fread
fputc
fgetpos
fgetc
fputs
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
sqrt
sqrtf
asin
tanf
sinf
sin
fmodf
pow
powf
acosf
ceilf
atan2
atan2f
log
logf
cosf
__setusermatherr
api-ms-win-crt-time-l1-1-0
strftime
_time64
_localtime64
_gmtime64
api-ms-win-crt-string-l1-1-0
strncmp
_stricmp
strncpy
strcmp
_strdup
isupper
strspn
strcspn
tolower
strpbrk
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_unlink
_access
_lock_file
_stat64
_fstat64
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 809KB - Virtual size: 808KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ