E:\1 Projects\rust\megazord_xi-1 - Copy\Windows\x86_64-pc-windows-msvc\release\deps\megazord.pdb
Static task
static1
Behavioral task
behavioral1
Sample
131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07.bin.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07.bin.exe
Resource
win10v2004-20240226-en
General
-
Target
131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07.bin.sample
-
Size
544KB
-
MD5
4edc0efe1fd24f4f9ea234b83fcaeb6a
-
SHA1
02bb630faf77a91c7de6b031b54de4467ab9da6f
-
SHA256
131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07
-
SHA512
74a1ebe042ab9370ed2b3e6bd465b729c449181aa5d9ff973aad27e782b806dcbf356f0d3a8adfda5cbc486154d89c6220fda6d334abdc1a3f5853963a609132
-
SSDEEP
6144:LDpYW09Y6VTU5GKmHhfSvqDxXKwBm7Y4yaXR/MDWtVKdzVNwtO9mrmcFhb6E0y:LD89YsTi9iNKwBm7Ph/5KdH9mCcz6E0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07.bin.sample
Files
-
131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07.bin.sample.exe windows:6 windows x64 arch:x64
bc5a584cac4f34dae8014259006fd0d3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
OpenSCManagerA
EnumServicesStatusA
CloseServiceHandle
kernel32
CreateEventW
FindClose
QueryPerformanceCounter
GetLastError
GetSystemInfo
GetLogicalDriveStringsA
Sleep
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
SwitchToThread
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
MoveFileExW
SetFilePointerEx
CloseHandle
WaitForSingleObject
SetLastError
GetFinalPathNameByHandleW
FindFirstFileW
GetModuleHandleA
GetProcAddress
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetCommandLineW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
FindNextFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CancelIo
ReadFile
ExitProcess
QueryPerformanceFrequency
GetSystemTimeAsFileTime
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetConsoleMode
WakeAllConditionVariable
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetConsoleOutputCP
FlushFileBuffers
HeapSize
GetCurrentThreadId
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlPcToFileHeader
WriteFile
TerminateProcess
GetModuleHandleExW
GetCommandLineA
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
ntdll
NtWriteFile
RtlNtStatusToDosError
NtReadFile
Sections
.text Size: 374KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ