2024-05-12_7d19dc70b3f7510015a6b5473f98283d_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-12_7d19dc70b3f7510015a6b5473f98283d_megazord
Size

15.9MB
MD5

7d19dc70b3f7510015a6b5473f98283d
SHA1

8776e17033e22cbc85bdf84cbf1068435f6bcae9
SHA256

5acfc96b6c87fb3f3d6785c6244c2394186eac8d41ca592cfd71cb6967c7def9
SHA512

414c003d2552726c641f2f49ac68edbb5d432cbb5a2032135a4b74b0adbbaa7e834c36dc0aa0b32b783b393201d3bd258b85406440fbd3bd4c7d56dab6554cfa
SSDEEP

98304:2NjSf1qmOt9UxzN4SbGoLPS5/V4U8s8gKIZC2PM+Z2bLynjsFv5bJDoslQkzf+Lr:2N21ZzN4SbGxC2PtZ2buAFRbJE3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-12_7d19dc70b3f7510015a6b5473f98283d_megazord

Files

2024-05-12_7d19dc70b3f7510015a6b5473f98283d_megazord
.exe windows:6 windows x64 arch:x64

7e09ed637156983f5d65ee4bb5b80798

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

hyperspace_node.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

kernel32

TryEnterCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
SetEvent
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetUserDefaultUILanguage
LCIDToLocaleName
UnhandledExceptionFilter
LeaveCriticalSection
CloseHandle
GetModuleHandleW
EnterCriticalSection
GetCurrentThreadId
InitializeCriticalSection
AreFileApisANSI
GetUserDefaultLocaleName
GetNativeSystemInfo
WaitForSingleObjectEx
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
LoadLibraryA
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
GetModuleHandleA
FreeLibrary
SetFileTime
SystemTimeToFileTime
TlsAlloc
lstrlenW
ReadFile
CreateMutexA
HeapCreate
GetCurrentThread
CreateThread
WriteConsoleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
WaitForMultipleObjects
ReadFileEx
CreateNamedPipeW
ExitProcess
CancelIo
CreateEventW
CopyFileExW
TlsGetValue
GetFinalPathNameByHandleW
CreateHardLinkW
CreateSymbolicLinkW
RemoveDirectoryW
FindFirstFileW
CreateDirectoryW
GetFileInformationByHandleEx
TlsSetValue
CreateFileMappingW
DeleteCriticalSection
FindClose
FindNextFileW
ReleaseMutex
QueryPerformanceFrequency
GetProcessId
TerminateProcess
GetExitCodeProcess
SleepEx
WriteFileEx
GetStdHandle
SetFilePointerEx
GetModuleFileNameW
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryExW
LoadLibraryW
HeapAlloc
GetEnvironmentVariableW
SetFileInformationByHandle
HeapCompact
HeapDestroy
GetCurrentProcess
DuplicateHandle
CreatePipe
GetCommandLineW
SetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
HeapFree
GetFullPathNameW
RtlLookupFunctionEntry
UnlockFile
GetProcAddress
LocalFree
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LockFileEx
RtlVirtualUnwind
RtlCaptureContext
SetWaitableTimer
CreateWaitableTimerExW
SwitchToThread
GetFileSize
GetCurrentProcessId
CreateFileA
GetProcessHeap
SetThreadStackGuarantee
AddVectoredExceptionHandler
CompareStringOrdinal
DeleteProcThreadAttributeList
TlsFree
FreeEnvironmentStringsW
MoveFileExW
SetFileAttributesW
SetHandleInformation
GetConsoleMode
GetFileInformationByHandle
SetFileCompletionNotificationModes
GetOverlappedResult
GetQueuedCompletionStatusEx
CreateIoCompletionPort
PostQueuedCompletionStatus

user32

GetAsyncKeyState
GetKeyboardState
ToUnicodeEx
GetKeyState
MapVirtualKeyExW
RegisterRawInputDevices
CreateIcon
GetRawInputData
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
SetWindowDisplayAffinity
SetWindowLongW
GetSystemMenu
DestroyIcon
IsProcessDPIAware
GetDC
PostQuitMessage
RegisterClassW
CreateWindowExW
SendInput
IsWindow
ShowWindow
CreateAcceleratorTableW
AppendMenuW
CreatePopupMenu
CreateMenu
SetMenuItemInfoW
RegisterClassExW
MsgWaitForMultipleObjectsEx
SystemParametersInfoA
RedrawWindow
PeekMessageW
TranslateMessage
VkKeyScanW
GetMessageA
GetWindowLongPtrW
DispatchMessageW
PostMessageW
IsWindowVisible
SetMenu
ClipCursor
RegisterWindowMessageA
GetClipCursor
IsIconic
MapVirtualKeyW
ShowCursor
AdjustWindowRectEx
GetMenu
GetWindowRect
CheckMenuItem
SetWindowLongPtrW
MonitorFromPoint
EnumDisplayMonitors
TrackPopupMenu
SetForegroundWindow
GetMessageW
DispatchMessageA
GetMonitorInfoW
MonitorFromWindow
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
TrackMouseEvent
MonitorFromRect
GetWindowLongW
GetAncestor
GetUpdateRect
ValidateRect
DestroyWindow
TranslateAcceleratorW
PostThreadMessageW
EnumChildWindows
SendMessageW
DestroyAcceleratorTable
RegisterTouchWindow
GetSystemMetrics
GetForegroundWindow
FlashWindowEx
GetActiveWindow
SetCursorPos
GetClientRect
SetCursor
LoadCursorW
InvalidateRgn
SetWindowPos
GetWindowPlacement
SetWindowPlacement
ChangeDisplaySettingsExW
ClientToScreen
ReleaseCapture
GetCursorPos
GetKeyboardLayout
SetCapture
DefWindowProcW
EnableMenuItem

comctl32

SetWindowSubclass
DefSubclassProc
RemoveWindowSubclass
TaskDialogIndirect

gdi32

DeleteObject
GetDeviceCaps
CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow

ole32

CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
OleInitialize
RegisterDragDrop
RevokeDragDrop
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance

shell32

Shell_NotifyIconGetRect
DragQueryFileW
SHAppBarMessage
ShellExecuteW
DragFinish
SHGetKnownFolderPath
Shell_NotifyIconW

ws2_32

getsockopt
closesocket
ioctlsocket
connect
recv
bind
WSAStartup
WSACleanup
getaddrinfo
WSASocketW
freeaddrinfo
send
shutdown
getsockname
WSASend
setsockopt
getpeername
WSAGetLastError
WSAIoctl

advapi32

RegQueryValueExW
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegCloseKey
RegGetValueW
SystemFunction036
RegOpenKeyExW

oleaut32

SysStringLen
SysFreeString
SetErrorInfo
GetErrorInfo

uxtheme

SetWindowTheme

ntdll

NtDeviceIoControlFile
NtWriteFile
NtReadFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile

bcrypt

BCryptGenRandom

secur32

FreeContextBuffer
EncryptMessage
QueryContextAttributesW
DeleteSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleA
ApplyControlToken
DecryptMessage
InitializeSecurityContextW
AcceptSecurityContext

crypt32

CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateChain

api-ms-win-crt-math-l1-1-0

log
pow
__setusermatherr

api-ms-win-crt-string-l1-1-0

strlen
wcsncmp
strcpy_s
strcmp
strcspn
_wcsicmp
wcslen
strncmp

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
realloc
_set_new_mode
free
malloc
_msize

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_get_initial_narrow_environment
_set_app_type
_initterm
_initterm_e
exit
_exit
abort
__p___argc
__p___argv
_cexit
terminate
_crt_atexit
_seh_filter_exe
_c_exit
_register_thread_local_exe_atexit_callback
_endthreadex
_beginthreadex
_initialize_onexit_table
_initialize_narrow_environment
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-convert-l1-1-0

_ultow_s
wcstol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 549KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e09ed637156983f5d65ee4bb5b80798

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

user32

comctl32

gdi32

dwmapi

ole32

shell32

ws2_32

advapi32

oleaut32

uxtheme

ntdll

bcrypt

secur32

crypt32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 10.4MB - Virtual size: 10.4MB

.rdata Size: 4.9MB - Virtual size: 4.9MB

.data Size: 38KB - Virtual size: 51KB

.pdata Size: 549KB - Virtual size: 549KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 51KB - Virtual size: 51KB

.reloc Size: 67KB - Virtual size: 67KB

.text
Size: 10.4MB - Virtual size: 10.4MB

.rdata
Size: 4.9MB - Virtual size: 4.9MB

.data
Size: 38KB - Virtual size: 51KB

.pdata
Size: 549KB - Virtual size: 549KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 51KB - Virtual size: 51KB

.reloc
Size: 67KB - Virtual size: 67KB