FortniteMeta[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FortniteMeta.exe
Size 1.3MB
Sample260702-3hlbqsc15q
SHA256 c4ec848125c6fa9720e110744f057bff1c3bba68ac0872059701bc4fb4acce24
MD5 1ad10467548766903b28957198a00c72
SHA1 1e74ee382fc2cb56db3c033dc0dd765bd421fbeb
SHA512 f12423b111ebf72fb273ec59d8172ee82c111ef852069d4825633245b74445912b2870a3eeb6e68b53ee27f6697d218a47f83816d3a7e069eb821bb96809cb0b
SSDEEP 24576:9GsW/qegkR7XfYUKvAV/wZTTBbGkP3/o60OegX7AowjciwvD/yC7:e7/R7WvsmlVP3Z0ErvoZwvD/
TLSH
T1EC55AF0B72E449B4C337C574C586EDE7C670781987284CEB63A565991F222E36BFAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FortniteMeta.exe

File Explorer

FortniteMeta.exe

.exe 1.3MB

FortniteMeta.exe

IMPHASH 68f966952fc065dc9ffa4d75c1d9df56
SHA256 c4ec848125c6fa9720e110744f057bff1c3bba68ac0872059701bc4fb4acce24
MD5 1ad10467548766903b28957198a00c72
SHA1 1e74ee382fc2cb56db3c033dc0dd765bd421fbeb
SHA512 f12423b111ebf72fb273ec59d8172ee82c111ef852069d4825633245b74445912b2870a3eeb6e68b53ee27f6697d218a47f83816d3a7e069eb821bb96809cb0b
SSDEEP 24576:9GsW/qegkR7XfYUKvAV/wZTTBbGkP3/o60OegX7AowjciwvD/yC7:e7/R7WvsmlVP3Z0ErvoZwvD/
TLSH
T1EC55AF0B72E449B4C337C574C586EDE7C670781987284CEB63A565991F222E36BFAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

941080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

ntdll

NtQueryInformationProcess RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry

kernel32

SetConsoleTextAttribute SetConsoleTitleA FindNextFileW GetCurrentProcess GetStdHandle DeviceIoControl TerminateProcess FindClose WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot Sleep GetTickCount64 Process32NextW LoadLibraryA Process32Next Process32FirstW CloseHandle FillConsoleOutputAttribute GetProcAddress ExitProcess WideCharToMultiByte GetConsoleWindow lstrcmpiA CreateProcessA SetConsoleCursorPosition GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent GetExitCodeProcess MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GetLocaleInfoA Process32First FreeLibrary QueryPerformanceCounter GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetConsoleScreenBufferInfo FindFirstFileW FillConsoleOutputCharacterA GetModuleFileNameA QueryPerformanceFrequency GetLocaleInfoEx FormatMessageA LocalFree GlobalUnlock

user32

MessageBoxA GetMessageExtraInfo LoadCursorA GetKeyState SetWindowTextA GetWindowLongA PeekMessageW CallWindowProcA SetWindowLongA EnumWindows DispatchMessageW GetAsyncKeyState SetLayeredWindowAttributes ShowWindow GetSystemMetrics SetWindowPos GetWindowThreadProcessId SetClipboardData ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow GetClipboardData EmptyClipboard TranslateMessage CloseClipboard OpenClipboard SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture mouse_event SetWindowLongPtrA UpdateWindow GetCursorPos SetMenu

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteA

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

urlmon

URLDownloadToFileA

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpSendRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __std_exception_destroy __current_exception_context memmove __std_exception_copy __current_exception memset memcpy __std_terminate strstr memcmp memchr strchr

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback __p___argc _errno abort terminate exit _exit __p___argv _initterm_e _initterm _configure_narrow_argv _get_initial_narrow_environment _initialize_narrow_environment _invoke_watson _initialize_onexit_table _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function system

api-ms-win-crt-stdio-l1-1-0

ftell fputc __p__commode __stdio_common_vsscanf _wfopen fclose fseek __stdio_common_vfprintf __acrt_iob_func _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf _set_fmode fwrite __stdio_common_vsprintf_s fgetc fflush

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc _set_new_mode free

api-ms-win-crt-string-l1-1-0

strncmp strcmp tolower strcpy_s strncpy towlower toupper

api-ms-win-crt-math-l1-1-0

_dclass _fdclass acosf asin atan2 cosf fmodf ldexp logf pow powf sinf sqrt sqrtf __setusermatherr _dsign atan2f ceilf log tanf fmaxf

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtod strtoll atof

api-ms-win-crt-filesystem-l1-1-0

_lock_file remove _unlock_file

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func