tompearlfortnite[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
tompearlfortnite.exe
Size 343KB
Sample261107-wlmweadx71
SHA256 6e66acd1a14a2c5d149a0188ded4d3d715ea78bd740111c9bd21c4ded9a6218a
MD5 b154ae4bc24449371331095d1e37c19b
SHA1 27cffc37fab4177f51b82ac7f4bb8f69a6f45f90
SHA512 c9b5cf231efe8a9a42e441f5dde4cd1fc2dc2f0806cab2f84376d3565daffb2d3c4e13f2473a0a869ab301e55d550863507c5ec311256d4a5f056ad1c0c3433f
SSDEEP 6144:nLiZCnal2OqIwYhXb0eAOtEt5XeA6UwU3mplU5h:nuBVhztEneA6Uwef
TLSH
T10B747D55F7A800FAE5B7C27CC9924906EA737C560771E6CF13A04A962F236D09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tompearlfortnite.exe

File Explorer

tompearlfortnite.exe

.exe 343KB

tompearlfortnite.exe

IMPHASH 8a436a6dd66f184a3c58b5c5c7770298
SHA256 6e66acd1a14a2c5d149a0188ded4d3d715ea78bd740111c9bd21c4ded9a6218a
MD5 b154ae4bc24449371331095d1e37c19b
SHA1 27cffc37fab4177f51b82ac7f4bb8f69a6f45f90
SHA512 c9b5cf231efe8a9a42e441f5dde4cd1fc2dc2f0806cab2f84376d3565daffb2d3c4e13f2473a0a869ab301e55d550863507c5ec311256d4a5f056ad1c0c3433f
SSDEEP 6144:nLiZCnal2OqIwYhXb0eAOtEt5XeA6UwU3mplU5h:nuBVhztEneA6Uwef
TLSH
T10B747D55F7A800FAE5B7C27CC9924906EA737C560771E6CF13A04A962F236D09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

62816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Adam\Downloads\TomPearl\build\TomPearlInjector.pdb

advapi32

RegSetValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW

shell32

SHCreateDirectoryExW

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect

kernel32

SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW HeapReAlloc GetOEMCP GetACP IsValidCodePage GetStdHandle SetConsoleMode GetModuleFileNameW GetFileAttributesW SetFileAttributesW CreateToolhelp32Snapshot Sleep GetConsoleMode Process32NextW Process32FirstW CloseHandle MoveFileExW SetConsoleTitleW ReadFile ReadConsoleW PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP IsProcessorFeaturePresent WriteFile GetCurrentProcess ExitProcess TerminateProcess GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP CreateFileW RtlUnwind

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

Name

.text

Size

212KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tompearlfortnite.exe

advapi32

shell32

winhttp

kernel32

api-ms-win-core-synch-l1-2-0

generic