25ebf798c4922614b236c5628d3ff889
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2018-Jul-05 14:10:46 |
| Detected languages |
English - United States
|
| CompanyName | anon |
| FileDescription | fortnite |
| FileVersion | 1.4 |
| InternalName | fortnite.exe |
| LegalCopyright | (C) 2018 |
| OriginalFilename | fortnite.exe |
| ProductName | fortnite |
| ProductVersion | 1.4 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Looks for Sandboxie presence:
|
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 13/68 (Scanned on 2018-07-09 16:50:39) |
McAfee:
Artemis!25EBF798C492
Symantec: ML.Attribute.HighConfidence TrendMicro-HouseCall: TROJ_GEN.R002H05G818 Paloalto: generic.ml AegisLab: Ml.Attribute.Gen!c Rising: Trojan.Zpevdo!8.F912 (CLOUD) Invincea: heuristic McAfee-GW-Edition: BehavesLike.Win32.Dropper.bh Sophos: Mal/Generic-S Microsoft: Trojan:Win32/Zpevdo.A VBA32: BScope.Trojan.Gasti AVG: FileRepMalware CrowdStrike: malicious_confidence_60% (W) |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x118 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 7 |
| TimeDateStamp | 2018-Jul-05 14:10:46 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x64c00 |
| SizeOfInitializedData | 0x4e800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00041434 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x66000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xb7000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.gfids
.tls
.rsrc
.reloc
Imports
| WS2_32.dll |
#8
#14 #57 #10 #20 #17 #13 #1 freeaddrinfo getaddrinfo WSAIoctl #21 #15 #9 #7 #6 #5 #4 #3 #2 #19 #16 #112 #18 #151 #23 #111 #116 #115 |
|---|---|
| ADVAPI32.dll |
CryptDestroyHash
CryptEncrypt CryptImportKey CryptDestroyKey CryptReleaseContext CryptHashData CryptCreateHash CryptGetHashParam CryptGenRandom CryptAcquireContextA |
| CRYPT32.dll |
CertFreeCertificateContext
|
| WLDAP32.dll |
#46
#211 #60 #50 #301 #200 #30 #79 #35 #33 #32 #27 #26 #22 #41 #143 |
| Normaliz.dll |
IdnToAscii
|
| KERNEL32.dll |
FindFirstFileExA
FindClose GetTimeZoneInformation GetProcessHeap GetFullPathNameW GetCurrentDirectoryW FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle FlushFileBuffers GetFileAttributesExW GetExitCodeProcess WaitForSingleObject EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleCP ReadConsoleW GetConsoleMode GetACP GetCommandLineW GetCommandLineA WriteFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime WriteConsoleW GetModuleFileNameA SetEndOfFile HeapSize ExitProcess HeapFree HeapReAlloc GetDriveTypeW Sleep CreateProcessA GetProcAddress LoadLibraryA GetModuleHandleA CreateDirectoryA FreeLibrary GetTickCount64 GetLastError SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx VerSetConditionMask GetSystemDirectoryA VerifyVersionInfoA FormatMessageA CloseHandle WaitForSingleObjectEx GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA MultiByteToWideChar WideCharToMultiByte CreateFileW SetFilePointerEx EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RaiseException RtlUnwind LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW HeapAlloc |
| SHELL32.dll |
ShellExecuteA
|
Delayed Imports
1
101
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.4.0.0 |
| ProductVersion | 1.4.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | anon |
| FileDescription | fortnite |
| FileVersion (#2) | 1.4 |
| InternalName | fortnite.exe |
| LegalCopyright | (C) 2018 |
| OriginalFilename | fortnite.exe |
| ProductName | fortnite |
| ProductVersion (#2) | 1.4 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2018-Jul-05 14:10:46 |
| Version | 0.0 |
| SizeofData | 960 |
| AddressOfRawData | 0x7e028 |
| PointerToRawData | 0x7d028 |
IMAGE_DEBUG_TYPE_ILTCG
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2018-Jul-05 14:10:46 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
TLS Callbacks
| StartAddressOfRawData | 0x484000 |
|---|---|
| EndAddressOfRawData | 0x484008 |
| AddressOfIndex | 0x4827d0 |
| AddressOfCallbacks | 0x466308 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
Load Configuration
| Size | 0x5c |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x4810c8 |
| SEHandlerTable | 0x47df80 |
| SEHandlerCount | 42 |
RICH Header
| XOR Key | 0xcf3bd545 |
|---|---|
| Unmarked objects | 0 |
| 241 (40116) | 14 |
| 243 (40116) | 178 |
| 242 (40116) | 29 |
| 199 (41118) | 5 |
| ASM objects (VS2015 UPD3 build 24123) | 25 |
| C++ objects (VS2015 UPD3 build 24123) | 59 |
| C objects (VS2015 UPD3 build 24123) | 35 |
| Imports (VS2008 SP1 build 30729) | 4 |
| Total imports | 181 |
| Imports (24610) | 11 |
| C objects (VS2017 v15.2 compiler 25019) | 93 |
| 265 (24234) | 2 |
| Resource objects (24234) | 1 |
| 151 | 1 |
| Linker (24234) | 1 |