Z1RO FORTNITE.rar
- SHA256 bc8a3c6b80442788cc293df7503ea6a4963f8ec8d196a1ad2d3f73479a3364a5
Static task
static1
1 signatures
General
- Target Z1RO FORTNITE.rar
- Size 457KB
- Sample261023-s2mc2act9y
- SHA256 bc8a3c6b80442788cc293df7503ea6a4963f8ec8d196a1ad2d3f73479a3364a5
- MD5 6fccfe98359a94aa0c5c93864eedae83
- SHA1 402528abb57912ea632a029c55e18228300a8c9f
- SHA512 96113cccaaac4b3776de3e59aef133a5c5e2e5038acb65052ab2161be71574943ab6b5066122b101b6cf22fd883d41a023796d633db5cc4e08cfddcad808167d
- SSDEEP 12288:7ySzb+wcuMoEx9JvlF25IZr4Mui6znVRKTw7BCzAPLmF:+Szb+wP+SSiW6HKE7BPLmF
- TLSH T118A423AAA5D5345429BED9C8D06F3040AD9B4A07FFC93E02D63BAE8C059F11C85F5B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Z1RO FORTNITE/Z1RO FREE.exe unpack001/Z1RO FORTNITE/nigctl.sys unpack001/Z1RO FORTNITE/timeless-mapper (1).exe
File Explorer
-
Z1RO FORTNITE.rar.rar 457KB
-
Z1RO FORTNITE/Z1RO FREE.exe.exe 803KB
-
Z1RO FORTNITE/nigctl.sys.sys 29KB
-
Z1RO FORTNITE/timeless-mapper (1).exe.exe 58KB
Z1RO FORTNITE/Z1RO FREE.exe
- IMPHASH 7ae895aeb356b6f7bb3e3f8d433f6182
- SHA256 687998ce267b7952a6df3b0c8841976d381e883fc8522f04c356144d23584635
- MD5 382a579bb8f65e305fff970ef80f3043
- SHA1 684f7b8da73b01f65a123375a8f5d8072cbb15f7
- SHA512 0fbf48c981a38e4fd476a0f9f50962c417267fb061e2b6480f258091dc3b6fc23ac15026170b1d251242a819d19162f71db51e7e1697ca2863e660ff42b38d54
- SSDEEP 12288:YUES25oMINODUlar2oOnG63i9nIgvdhyC6YLK2eoo:pP25oMINODU0r2od63i9nIgvdh+YW2
- TLSH T17505BF11F7F445A8D17BA13899A2EB1BFB377848072086DF63E405552FA77E08B76322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
487684
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
kernel32
SetConsoleTitleA
GetStdHandle
DeviceIoControl
WaitForSingleObject
CreateFileW
CreateToolhelp32Snapshot
Sleep
Process32Next
CloseHandle
Beep
lstrcmpiA
CreateProcessA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
Process32First
GetFileInformationByHandleEx
GetModuleHandleW
FindFirstFileW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetLastError
SleepConditionVariableSRW
GetCurrentThreadId
AreFileApisANSI
WakeAllConditionVariable
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
GetFileAttributesExW
FindClose
SetConsoleTextAttribute
GetLocaleInfoEx
FormatMessageA
LocalFree
user32
GetCursorPos
GetKeyState
LoadCursorA
UpdateWindow
FindWindowA
PeekMessageA
GetClientRect
mouse_event
TranslateMessage
SetLayeredWindowAttributes
SetMenu
MessageBoxA
GetWindowLongA
SetWindowLongA
GetAsyncKeyState
ShowWindow
GetSystemMetrics
SetWindowPos
ScreenToClient
ClientToScreen
DispatchMessageA
GetKeyboardLayout
SetClipboardData
SetCursor
SetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
GetForegroundWindow
shell32
ShellExecuteA
ole32
CoInitialize
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Mtx_lock
_Query_perf_counter
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?good@ios_base@std@@QEBA_NXZ
_Query_perf_frequency
imm32
ImmGetContext
ImmSetCandidateWindow
ImmReleaseContext
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
memset
memcpy
memchr
memcmp
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fclose
fseek
__p__commode
__acrt_iob_func
ftell
__stdio_common_vsscanf
__stdio_common_vsprintf
_wfopen
fwrite
__stdio_common_vsprintf_s
fflush
fread
__stdio_common_vfprintf
_set_fmode
api-ms-win-crt-heap-l1-1-0
free
malloc
realloc
_set_new_mode
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-string-l1-1-0
strcmp
strncpy
strncmp
tolower
toupper
api-ms-win-crt-runtime-l1-1-0
abort
terminate
_configure_narrow_argv
_invoke_watson
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
system
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
atan2
asin
ceilf
cosf
fmodf
logf
__setusermatherr
acosf
powf
_fdclass
sinf
sqrt
sqrtf
ldexp
tanf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
Name
.text
Size
480KB
Virtual Size
480KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
212KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
656B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=35, id=261, version=35207,
count=6, id=257, version=35207,
count=21, id=257, version=33145,
count=291, id=1, productName=Unmarked objects,
count=9, id=265, version=35229,
count=1, id=255, version=35229,
count=1, id=258, version=35229,
Z1RO FORTNITE/nigctl.sys
- SHA256 927893280567a079a910cabb2035d65db67b7937674a354d147a322ee2c4b455
- MD5 e290273aeb3cdec4bb19acf46fcfc0b3
- SHA1 9c2905b6153ff00a26b355c3f03935d231a7140f
- SHA512 42a194c8c5a6ecc4e5cc0f9560979d33d6ccddc5df2c3129fe9e29fbfd8d15cf2db0d413db769cbb7cefe53cc5438a4b41444e9917eafc46f09ed6157de3d103
- SSDEEP 768:T2kSiPesXyTEKY16+jxRyO1JijUvfW4YiNSc6G7:CwWsCTbY1hRyojFSc6G7
- TLSH T1FDD25B3651C2B5EEEA6750398373E2CBF96134411326D8EF0AF4EC1E672AC951279C36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19324
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\PC\Desktop\Driver\x64\Release\nigctl.pdb
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33145,
count=1, id=1, productName=Unmarked objects,
count=2, id=259, version=33145,
count=1, id=260, version=33145,
count=1, id=261, version=35228,
count=1, id=258, version=35228,
Z1RO FORTNITE/timeless-mapper (1).exe
- IMPHASH aa9a6d4fc9d72b08d7d7959665627df1
- SHA256 6f73e0c1edb6966caf5be85ab3fc6c61fe2fba47b8118ea99349cbd72c2ae5ac
- MD5 be7a4c7e772c3634491dfe6397badb52
- SHA1 6e9c16044f019f8aa769bc8aac273c9d93495fa9
- SHA512 78c9387e85991b4d803ba68be65e772f74040c396c907e7bd0a6fc6a692a862ada845f6a0fffbb89114823fa5b7e9c5b31e63f223f29ca533372006fad2a2b70
- SSDEEP 1536:aYoFXmAZ8KTPLd12YI3H1MjHCPizDoC0VO:hoZzrTPLd12D3H1M7CPizUV
- TLSH T113438E43531004B8D19BD23DC9B38926E6B1B869473257DF86E585B60FB27E03A3EBD1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16584
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Rac0001\Desktop\timelss-everything\timeless-everything-build\timeless-mapper.pdb
ntdll
NtDeviceIoControlFile
RtlAdjustPrivilege
NtLoadDriver
RtlGetFullPathName_UEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlInitUnicodeString
RtlCreateRegistryKey
NtUnloadDriver
NtQuerySystemInformation
RtlWriteRegistryValue
NtCreateFile
NtClose
kernel32
LoadLibraryExW
GetConsoleWindow
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeleteFileA
CopyFileA
Sleep
CreateFileW
WriteFile
VirtualFree
GetCurrentProcess
VirtualAlloc
GetLastError
CloseHandle
K32GetModuleInformation
GetProcAddress
FreeLibrary
SetConsoleTitleA
user32
ShowWindow
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
?good@ios_base@std@@QEBA_NXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?uncaught_exceptions@std@@YAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception
__current_exception_context
memset
memcpy
__C_specific_handler
memmove
__std_exception_destroy
__std_exception_copy
__std_terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
api-ms-win-crt-string-l1-1-0
_stricmp
wcscat_s
wcscpy_s
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
terminate
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_crt_atexit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=25, id=261, version=35207,
count=6, id=257, version=35207,
count=7, id=257, version=33140,
count=119, id=1, productName=Unmarked objects,
count=4, id=265, version=35211,
count=1, id=255, version=35211,
count=1, id=258, version=35211,