E:\1 Projects\rust\megazord_xi-1 - Copy\Windows\x86_64-pc-windows-msvc\release\deps\megazord.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83.exe
Resource
win10v2004-20240226-en
General
-
Target
2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83
-
Size
544KB
-
MD5
64f8e1b825887afe3130af4bf4611c21
-
SHA1
09f85d9c0de66c8f807bd1e12f55617e3fed3bf8
-
SHA256
2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83
-
SHA512
72b5e83ab80cd08d537f8a1f4b68c7fd080991bb53baaaba04a4ed7640e868e4b4d2729c70a99470d271d2af13a4dab27fec8769faa1f3faaf611c04ab27764c
-
SSDEEP
6144:LDpYW09Y6VTU5GKmHhfSvqDxXKwBm7Y4yaXR/MDWtVKdHVNwYO9mrmcFhb6E0y:LD89YsTi9iNKwBm7Ph/5Kdy9mCcz6E0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83
Files
-
2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83.exe windows:6 windows x64 arch:x64
bc5a584cac4f34dae8014259006fd0d3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
OpenSCManagerA
EnumServicesStatusA
CloseServiceHandle
kernel32
CreateEventW
FindClose
QueryPerformanceCounter
GetLastError
GetSystemInfo
GetLogicalDriveStringsA
Sleep
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
SwitchToThread
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
MoveFileExW
SetFilePointerEx
CloseHandle
WaitForSingleObject
SetLastError
GetFinalPathNameByHandleW
FindFirstFileW
GetModuleHandleA
GetProcAddress
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetCommandLineW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
FindNextFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CancelIo
ReadFile
ExitProcess
QueryPerformanceFrequency
GetSystemTimeAsFileTime
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetConsoleMode
WakeAllConditionVariable
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetConsoleOutputCP
FlushFileBuffers
HeapSize
GetCurrentThreadId
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlPcToFileHeader
WriteFile
TerminateProcess
GetModuleHandleExW
GetCommandLineA
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
ntdll
NtWriteFile
RtlNtStatusToDosError
NtReadFile
Sections
.text Size: 374KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ