FortniteTokenFinder[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FortniteTokenFinder.exe
Size 694KB
Sample261107-3el4vsge45
SHA256 250b665311866d118c667e5890c539283bc38ec6e76eba8caaffe6ec88151bcf
MD5 094190c742a42a62458b8dbe6e4e237a
SHA1 6e85deeaab857e8ac614a3b04e121011f4473f66
SHA512 f9d974348e882992bf87006f9c019232f7d8c7ba3036b68fbfb212ed5d4bfc8f469555e5f19bd78425e83cd5195bfbcde12b575301fe6b28b5bb59aa78fb5e0c
SSDEEP 12288:mr92xmckLjx2e7KEf2CM6sPVInK4rXys2pqzJjJHiqwPAXU:u92xmxWEf2/6s9InTrXys2pq7iqwPAXU
TLSH
T1BFE4CF96F6F443ECD16B90789487A90BE9323C5807105ADB73E4895A2FE37E05E7B312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FortniteTokenFinder.exe

File Explorer

FortniteTokenFinder.exe

.exe 694KB

FortniteTokenFinder.exe

IMPHASH 0821450e4beac6dcba83391188214ca9
SHA256 250b665311866d118c667e5890c539283bc38ec6e76eba8caaffe6ec88151bcf
MD5 094190c742a42a62458b8dbe6e4e237a
SHA1 6e85deeaab857e8ac614a3b04e121011f4473f66
SHA512 f9d974348e882992bf87006f9c019232f7d8c7ba3036b68fbfb212ed5d4bfc8f469555e5f19bd78425e83cd5195bfbcde12b575301fe6b28b5bb59aa78fb5e0c
SSDEEP 12288:mr92xmckLjx2e7KEf2CM6sPVInK4rXys2pqzJjJHiqwPAXU:u92xmxWEf2/6s9InTrXys2pq7iqwPAXU
TLSH
T1BFE4CF96F6F443ECD16B90789487A90BE9323C5807105ADB73E4895A2FE37E05E7B312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

418284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileA

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpReadData WinHttpConnect

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

kernel32

GetModuleHandleW GetLastError CloseHandle AreFileApisANSI SetCurrentDirectoryW GetVolumeInformationA Sleep GetTickCount64 GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary WakeAllConditionVariable LoadLibraryA CopyFileW RtlCaptureContext GetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose CreateFileW GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLocaleInfoEx FormatMessageA LocalFree RtlLookupFunctionEntry RtlVirtualUnwind GetFileInformationByHandleEx GetLocaleInfoA IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress InitializeSListHead

user32

ScreenToClient ClientToScreen SetCursorPos GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo GetClientRect TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard UpdateWindow GetSystemMetrics SetCursor GetAsyncKeyState SetWindowPos GetCursorPos GetWindowLongPtrW SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SendMessageW PeekMessageW ReleaseDC DispatchMessageW TranslateMessage SetWindowLongPtrW LoadCursorA LoadImageW

gdi32

DeleteDC CreateCompatibleDC DeleteObject CreateDIBSection SelectObject BitBlt

shell32

ShellExecuteA

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Random_device@std@@YAIXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ _Query_perf_counter _Query_perf_frequency _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

vcruntime140

__std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException __C_specific_handler memchr memcmp memcpy memmove memset strstr strchr __current_exception __current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv _register_onexit_function terminate _invoke_watson abort _errno system

api-ms-win-crt-string-l1-1-0

strlen toupper strcmp _stricmp strncpy_s wcslen strncmp strncpy

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode realloc malloc free

api-ms-win-crt-convert-l1-1-0

strtoul strtoll strtoull strtol

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _get_stream_buffer_pointers fopen_s __stdio_common_vsscanf __stdio_common_vsprintf _wfopen fclose feof ferror fflush _set_fmode fgetc __p__commode __stdio_common_vsprintf_s __stdio_common_vfprintf ungetc setvbuf fwrite ftell _fseeki64 fseek fsetpos fread fputc fgetpos

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

cosf fmodf ceilf ldexp powf sqrtf acosf sinf __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale