island fn updated[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
island fn updated.exe
Size 2.2MB
Sample261102-qk85csat2v
SHA256 96fe00563e8915d0c3cb6b4a7aa95bd313c447c2946f6dc3ce522f25edd5f576
MD5 f05144f37b9896cefd824ce0a7fd7810
SHA1 f3f679f67e5869d5f515ba96a79dbca66d7c15b3
SHA512 e7f9e5b4d9ba7b743a62ca0d0957fa4e3ff8923fb05a522e0814fbc4e978540aecdbfa572a705e9a3e919411183d67da635d4c480f5695cc24b1339bb780d95c
SSDEEP 24576:CLdGX++AtXcvjAqhx25efMJhx9s3EaQCRtsVcXrOHxOcmWDgWqsGYqipPxKjjcka:mWqtU/WLOgqRaynSUtUp
TLSH
T154B59CEA526D106CF81091349A4A625BB7F07C0E6720CFFB27E84CB76A1F5D4BB71225
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
island fn updated.exe

File Explorer

island fn updated.exe

.exe 2.2MB

island fn updated.exe

IMPHASH 2f099fe288ec3101688c5b4e9ebf9009
SHA256 96fe00563e8915d0c3cb6b4a7aa95bd313c447c2946f6dc3ce522f25edd5f576
MD5 f05144f37b9896cefd824ce0a7fd7810
SHA1 f3f679f67e5869d5f515ba96a79dbca66d7c15b3
SHA512 e7f9e5b4d9ba7b743a62ca0d0957fa4e3ff8923fb05a522e0814fbc4e978540aecdbfa572a705e9a3e919411183d67da635d4c480f5695cc24b1339bb780d95c
SSDEEP 24576:CLdGX++AtXcvjAqhx25efMJhx9s3EaQCRtsVcXrOHxOcmWDgWqsGYqipPxKjjcka:mWqtU/WLOgqRaynSUtUp
TLSH
T154B59CEA526D106CF81091349A4A625BB7F07C0E6720CFFB27E84CB76A1F5D4BB71225
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2145552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\pc\Desktop\fortnite_external_base\x64\Release\quantum.dev.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

CreateFileW CloseHandle GetLastError DeviceIoControl lstrcmpiA CreateToolhelp32Snapshot Process32First Process32Next GetModuleHandleW AreFileApisANSI CreateFile2 GetFullPathNameW GetProcAddress GetFileAttributesExW SetConsoleTitleA QueryPerformanceCounter FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree GetFileInformationByHandleEx ReleaseSRWLockExclusive LoadLibraryA GetModuleHandleA FreeLibrary QueryPerformanceFrequency AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetCurrentProcessId GetCurrentThreadId GlobalUnlock Sleep MoveFileExW SetFileAttributesW WideCharToMultiByte MultiByteToWideChar GlobalLock GlobalFree DeleteFileW GlobalAlloc GetSystemTimeAsFileTime InitializeSListHead

user32

SetWindowLongA MessageBoxW UpdateWindow GetSystemMetrics LoadIconA GetAsyncKeyState ShowWindow DestroyWindow RegisterClassExA MessageBoxA OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard TrackMouseEvent GetMessageExtraInfo GetKeyState UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageA DispatchMessageA TranslateMessage LoadCursorA ScreenToClient GetCapture SetCapture ReleaseCapture IsWindowUnicode GetForegroundWindow GetClientRect SetCursorPos SetCursor GetCursorPos ClientToScreen

gdi32

CreateSolidBrush

advapi32

RegQueryValueExA RegSetValueExA RegCreateKeyA RegCloseKey LookupPrivilegeValueA CloseServiceHandle OpenSCManagerA OpenServiceA RegOpenKeyExA

msvcp140

??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?id@?$ctype@D@std@@2V0locale@2@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Random_device@std@@YAIXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

ntdll

RtlAdjustPrivilege NtLoadDriver RtlInitAnsiString RtlFreeUnicodeString RtlAnsiStringToUnicodeString

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140

__current_exception __current_exception_context __std_exception_copy __std_exception_destroy _CxxThrowException memcpy memmove memset __std_terminate memcmp strstr memchr __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

_fseeki64 setvbuf ungetc __p__commode __stdio_common_vfprintf _wfopen __stdio_common_vsprintf_s _set_fmode fseek ftell __stdio_common_vsprintf __stdio_common_vsscanf __acrt_iob_func _get_stream_buffer_pointers fclose fsetpos fread fputc fgetpos fgetc fflush fwrite

api-ms-win-crt-filesystem-l1-1-0

_unlock_file remove _lock_file

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback exit abort system _configure_narrow_argv _initialize_narrow_environment _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_initial_narrow_environment _initterm _initterm_e _exit _c_exit __p___argc __p___argv

api-ms-win-crt-string-l1-1-0

strcmp strncmp tolower strlen strncpy wcslen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr log logf pow powf cosf sinf sqrtf fmodf asin atan2 tanf acosf

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-time-l1-1-0

_time64 _localtime64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale