Fortnite External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Fortnite External.exe
Size 2.4MB
Sample260830-1m7dnade37
SHA256 e5c3f0a4e8f8ca414457056fe98f1fed7f16b2baa7843c0be6dc619fc4436659
MD5 7c642e5147feaf467258b00ee3ca2aee
SHA1 14f7717ac2e7f9d90b5cffccc620bde3fd20a066
SHA512 c206f621497a651c4bd39238d65c2afa6eecba4fffa30787e0c4bd5d1e76f2e4466155987bbbf662c6ee27350287a9506adb8d570ff0167ecd60f12de6fdea6b
SSDEEP 24576:rDpdL9ct1j364899MZFuz56i+D4/MS0Wv2g95be7fWSeFUg+2fXwaTA6gJ5BCXDG:XwDj+IxG7iaBhXUvX7TAx0O8I9ZUXo
TLSH
T164B5BE4563AE4AACC056A038D5929A07D6F33C440737DFDB13D04D951BAF2D0BAFA6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Fortnite External.exe

File Explorer

Fortnite External.exe

.exe 2.4MB

Fortnite External.exe

IMPHASH b316c3a6a8b88e4a17f7b2cfa9ebd43c
SHA256 e5c3f0a4e8f8ca414457056fe98f1fed7f16b2baa7843c0be6dc619fc4436659
MD5 7c642e5147feaf467258b00ee3ca2aee
SHA1 14f7717ac2e7f9d90b5cffccc620bde3fd20a066
SHA512 c206f621497a651c4bd39238d65c2afa6eecba4fffa30787e0c4bd5d1e76f2e4466155987bbbf662c6ee27350287a9506adb8d570ff0167ecd60f12de6fdea6b
SSDEEP 24576:rDpdL9ct1j364899MZFuz56i+D4/MS0Wv2g95be7fWSeFUg+2fXwaTA6gJ5BCXDG:XwDj+IxG7iaBhXUvX7TAx0O8I9ZUXo
TLSH
T164B5BE4563AE4AACC056A038D5929A07D6F33C440737DFDB13D04D951BAF2D0BAFA6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1870208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\kccar\Desktop\hi\hi\thunderpublic\x64\Release\Fortnite External.pdb

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

NtLoadDriver RtlAdjustPrivilege NtDeviceIoControlFile RtlGetFullPathName_UEx RtlInitUnicodeString RtlCreateRegistryKey NtUnloadDriver NtQuerySystemInformation RtlWriteRegistryValue NtCreateFile NtClose

advapi32

GetCurrentHwProfileA GetUserNameA

msvcp140

_Xtime_get_ticks _Mtx_unlock ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ _Thrd_detach ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z _Query_perf_counter _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Random_device@std@@YAIXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ

user32

IsWindowVisible CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW FindWindowExA PeekMessageW MessageBoxA BlockInput EnumWindows SetLayeredWindowAttributes TranslateMessage GetParent UpdateWindow GetKeyState DestroyWindow ClientToScreen GetKeyboardLayout GetForegroundWindow LoadCursorW SetCursor GetClientRect SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetSystemMetrics GetWindowThreadProcessId DefWindowProcW ScreenToClient

kernel32

SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RaiseException AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetFileInformationByHandleEx MoveFileExW AreFileApisANSI CreateFile2 GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree CheckRemoteDebuggerPresent GetComputerNameA IsDebuggerPresent CreateDirectoryA SetConsoleOutputCP GetModuleHandleW SetConsoleCP ExitProcess RemoveDirectoryA CreateThread CloseHandle Process32FirstW CreateFileA Process32NextW GetLastError K32GetModuleFileNameExA GetTempPathA CreateToolhelp32Snapshot OpenProcess CreateFileW WaitForSingleObject TerminateProcess WriteFile GetStdHandle SetConsoleTextAttribute SetLastError GetConsoleScreenBufferInfo QueryPerformanceCounter FreeLibrary QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar LoadLibraryExW GetProcAddress K32GetModuleInformation GetTickCount64 Sleep VirtualAlloc GetCurrentProcess VirtualFree

shell32

ShellExecuteA

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

d3dcompiler_47

D3DCompile

gdi32

GetStockObject

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest

bcrypt

BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGenerateSymmetricKey BCryptDestroyKey BCryptFinishHash BCryptEncrypt

shlwapi

SHDeleteKeyW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr strchr __C_specific_handler memcmp __std_terminate __std_exception_copy __std_exception_destroy memchr memcpy memmove memset __current_exception __current_exception_context _CxxThrowException

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc realloc _callnewh free

api-ms-win-crt-math-l1-1-0

acos acosf asin _dsign atan2 atan2f ceilf cosf tanf __setusermatherr fmodf sqrtf sqrt sinf roundf ldexp powf pow

api-ms-win-crt-string-l1-1-0

_stricmp tolower strnlen wcscat_s _wcsicmp strncpy strncmp strlen strcmp wcslen wcscpy_s

api-ms-win-crt-stdio-l1-1-0

ungetc fsetpos _fseeki64 _get_stream_buffer_pointers setvbuf fgetpos fputc __stdio_common_vsscanf fread __p__commode __stdio_common_vsprintf __stdio_common_vsprintf_s _wfopen fwrite fseek fclose fflush ftell _set_fmode __acrt_iob_func __stdio_common_vfprintf fgetc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof strtoll strtoull strtol strtod

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file remove

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-runtime-l1-1-0

_cexit _crt_atexit _get_initial_narrow_environment exit terminate system _initterm _register_onexit_function _beginthreadex _initialize_onexit_table abort _initialize_narrow_environment _initterm_e _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _configure_narrow_argv _seh_filter_exe _exit _errno _set_app_type

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s