E:\1 Projects\rust\megazord_xi-1 - Copy\Windows\x86_64-pc-windows-msvc\release\deps\megazord.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c.bin.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c.bin.exe
Resource
win10v2004-20240226-en
General
-
Target
9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c.bin.sample
-
Size
544KB
-
MD5
3f63951399f8cd578e2a6faed2c9c0f0
-
SHA1
b8c1772dd0ad018cf3ed4c67eabd16c5c4e751cd
-
SHA256
9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c
-
SHA512
76ffe37daee417e43b8f02eafe9d1c2fe320e339ab62af920d7694bcc6ce281a524d5c9c2f639406a0d1bd8e9223c01ff57c264fe06c81a40feb884a3b05cdbc
-
SSDEEP
6144:LDpYW09Y6VTU5GKmHhfSvqDxXKwBm7Y4yaXR/MDWtVKdBVNw8O9mrmcFhb6E0y:LD89YsTi9iNKwBm7Ph/5Kdg9mCcz6E0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c.bin.sample
Files
-
9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c.bin.sample.exe windows:6 windows x64 arch:x64
bc5a584cac4f34dae8014259006fd0d3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
OpenSCManagerA
EnumServicesStatusA
CloseServiceHandle
kernel32
CreateEventW
FindClose
QueryPerformanceCounter
GetLastError
GetSystemInfo
GetLogicalDriveStringsA
Sleep
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
SwitchToThread
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
MoveFileExW
SetFilePointerEx
CloseHandle
WaitForSingleObject
SetLastError
GetFinalPathNameByHandleW
FindFirstFileW
GetModuleHandleA
GetProcAddress
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetCommandLineW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
FindNextFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CancelIo
ReadFile
ExitProcess
QueryPerformanceFrequency
GetSystemTimeAsFileTime
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetConsoleMode
WakeAllConditionVariable
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetConsoleOutputCP
FlushFileBuffers
HeapSize
GetCurrentThreadId
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlPcToFileHeader
WriteFile
TerminateProcess
GetModuleHandleExW
GetCommandLineA
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
ntdll
NtWriteFile
RtlNtStatusToDosError
NtReadFile
Sections
.text Size: 374KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ