Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_c2ed673953ece5ae69165ea39e3e17b4_megazord.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-14_c2ed673953ece5ae69165ea39e3e17b4_megazord.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-14_c2ed673953ece5ae69165ea39e3e17b4_megazord
-
Size
4.9MB
-
MD5
c2ed673953ece5ae69165ea39e3e17b4
-
SHA1
6bc16f87c2f762ca7d7fe76a1c161cb7d53559b5
-
SHA256
b58075e55502865c4d66bf779a0471b5687276de05b54ebc770122beff231f63
-
SHA512
62484d40f819413e11a9ab91dd76c707713583d43fbba677c69a45b1dbc0027d262623a277368004e4acf606281f0294a6c4a848012d1670c100dcb1f0685f63
-
SSDEEP
98304:+6DaM9JPT1J0zomx9QsF5P6tj37+xZMhUQdG:YORzKlE7+jktM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-14_c2ed673953ece5ae69165ea39e3e17b4_megazord
Files
-
2024-05-14_c2ed673953ece5ae69165ea39e3e17b4_megazord.exe windows:6 windows x64 arch:x64
dc5dc921f1e2dcaec9fae4e83c8b03bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlVirtualUnwind
RtlUnwindEx
NtCancelIoFileEx
NtWriteFile
NtReadFile
RtlLookupFunctionEntry
RtlCaptureContext
NtDeviceIoControlFile
RtlNtStatusToDosError
RtlPcToFileHeader
kernel32
GetOEMCP
GetACP
IsValidCodePage
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
GetConsoleMode
SetConsoleMode
GetLastError
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle
QueryPerformanceCounter
SwitchToThread
GetConsoleOutputCP
FlushFileBuffers
CreateEventA
SetEvent
WaitForMultipleObjectsEx
AcquireSRWLockShared
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
SetFilePointerEx
HeapSize
LCMapStringW
lstrlenW
GetFileType
GetFileInformationByHandleEx
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatusEx
GetSystemInfo
Sleep
GetModuleHandleA
GetProcAddress
CompareStringW
GetCPInfo
FlsFree
FlsSetValue
FlsGetValue
GetCurrentThreadId
FlsAlloc
WideCharToMultiByte
ReleaseMutex
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
GetModuleFileNameW
QueryPerformanceFrequency
GetCurrentProcess
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
CreateFileW
GetFileInformationByHandle
FindFirstFileW
FindClose
GetFinalPathNameByHandleW
WaitForSingleObject
GetModuleHandleW
FindNextFileW
ExitProcess
GetFullPathNameW
GetEnvironmentStringsW
MultiByteToWideChar
WriteConsoleW
CreateThread
GetSystemTimeAsFileTime
FreeLibrary
FindFirstFileExW
GetStringTypeW
SetStdHandle
FormatMessageW
SetEnvironmentVariableW
GetCommandLineA
GetModuleHandleExW
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
WriteFile
TerminateProcess
FreeEnvironmentStringsW
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemFree
user32
GetForegroundWindow
GetWindowThreadProcessId
CallNextHookEx
GetMessageA
SetWindowsHookExA
GetKeyState
AttachThreadInput
GetKeyboardState
ToUnicodeEx
GetKeyboardLayout
shell32
SHGetKnownFolderPath
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
oleaut32
SysStringLen
GetErrorInfo
SysFreeString
Sections
.text Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ