E:\1 Projects\rust\megazord_xi-1 - Copy\Windows\x86_64-pc-windows-msvc\release\deps\megazord.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be.bin.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be.bin.exe
Resource
win10v2004-20231215-en
General
-
Target
7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be.bin.sample
-
Size
544KB
-
MD5
a18d79e94229fdf02ef091cf974ed546
-
SHA1
73ee462cb96f4857f9f5bbdc4cada5800f2b8932
-
SHA256
7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be
-
SHA512
5591899f1e0e4624c387a401172b3dc6f2eb543771dda62e0b68f973f5c52708686f9216480010d8b309f5f4144b974466d1909bbeb6ea1bb80f3c4ec66cf478
-
SSDEEP
6144:LDpYW09Y6VTU5GKmHhfSvqDxXKwBm7Y4yaXR/MDWtVKdIVNw4O9mrmcFhb6E0y:LD89YsTi9iNKwBm7Ph/5Kdj9mCcz6E0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be.bin.sample
Files
-
7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be.bin.sample.exe windows:6 windows x64 arch:x64
bc5a584cac4f34dae8014259006fd0d3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
OpenSCManagerA
EnumServicesStatusA
CloseServiceHandle
kernel32
CreateEventW
FindClose
QueryPerformanceCounter
GetLastError
GetSystemInfo
GetLogicalDriveStringsA
Sleep
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
SwitchToThread
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
MoveFileExW
SetFilePointerEx
CloseHandle
WaitForSingleObject
SetLastError
GetFinalPathNameByHandleW
FindFirstFileW
GetModuleHandleA
GetProcAddress
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetCommandLineW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
FindNextFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CancelIo
ReadFile
ExitProcess
QueryPerformanceFrequency
GetSystemTimeAsFileTime
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetConsoleMode
WakeAllConditionVariable
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetConsoleOutputCP
FlushFileBuffers
HeapSize
GetCurrentThreadId
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlPcToFileHeader
WriteFile
TerminateProcess
GetModuleHandleExW
GetCommandLineA
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
ntdll
NtWriteFile
RtlNtStatusToDosError
NtReadFile
Sections
.text Size: 374KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ