2024-05-25_dc6645d0ff84defa0500bbcdc3a8ff10_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-25_dc6645d0ff84defa0500bbcdc3a8ff10_megazord
Size

4.3MB
MD5

dc6645d0ff84defa0500bbcdc3a8ff10
SHA1

e209b09186ab6c79e1445e3c71f5180accf0ca6c
SHA256

d7e58ad8217436ba5eeea7ecb9738b44cccc59700ef4d764b956b9190d20c86b
SHA512

4ecc7b1c1145fbde2746588cb1be9ef1a920db1409fc5f3dde22aa92c5eb170b263301a83c46ebde0fc5a387161aaa3095446161bc92f3c03fc1e0c21ebc6beb
SSDEEP

49152:2n48NG8AmlUh29GbM2Z6SGm6BsdyiVLJWFCL/2CFGYLzu8m887gK4ElIlE1xjUVn:jF6m6WJFvvubbICZ5aJAtmH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_dc6645d0ff84defa0500bbcdc3a8ff10_megazord

Files

2024-05-25_dc6645d0ff84defa0500bbcdc3a8ff10_megazord
.exe windows:6 windows x64 arch:x64

ac8b5a8c92bd9226b8fa7dbd60571cd6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

bcryptprimitives

ProcessPrng

ntdll

NtDeviceIoControlFile
NtCreateFile
NtWriteFile
RtlNtStatusToDosError
NtCancelIoFileEx
RtlPcToFileHeader
RtlVirtualUnwind
RtlUnwindEx
RtlLookupFunctionEntry
NtReadFile
RtlCaptureContext

kernel32

WriteConsoleW
GetModuleHandleA
CreateWaitableTimerExW
SetWaitableTimer
Sleep
QueryPerformanceFrequency
FormatMessageW
lstrlenW
GetEnvironmentVariableW
GetTempPathW
GetFileInformationByHandleEx
GetFullPathNameW
FlushFileBuffers
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileW
GetExitCodeProcess
SetLastError
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
GetProcAddress
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentProcess
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
CreateEventW
CancelIo
MultiByteToWideChar
ExitProcess
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
GetConsoleMode
LoadLibraryA
CreateFileW
ReleaseMutex
DeleteFileW
CopyFileExW
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
PostQueuedCompletionStatus
IsProcessorFeaturePresent
HeapReAlloc
GetLastError
GetCurrentThread
InitializeSListHead
CloseHandle
IsDebuggerPresent
FindClose
HeapFree
GetSystemTimePreciseAsFileTime
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
AddVectoredExceptionHandler
SetThreadStackGuarantee
CreateIoCompletionPort
WaitForSingleObject
GetFileInformationByHandle
GetSystemInfo
GetModuleFileNameW
GetModuleHandleW
EncodePointer
WaitForSingleObjectEx
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToThread
CreateMutexA
SetFileCompletionNotificationModes
SetFileInformationByHandle
ReadFile
LoadLibraryExW

ws2_32

getpeername
WSAIoctl
socket
WSAGetLastError
accept
WSASend
shutdown
listen
bind
ioctlsocket
send
WSASocketW
closesocket
connect
getsockopt
setsockopt
getaddrinfo
freeaddrinfo
WSAStartup
WSACleanup
select
getsockname
recv

oleaut32

SysFreeString
SafeArrayDestroy
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear

crypt32

CertOpenStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateChain
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertGetCertificateChain
CertFreeCertificateChain
CryptUnprotectData
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertDuplicateCertificateContext

advapi32

AllocateAndInitializeSid
SystemFunction036
CheckTokenMembership
FreeSid
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

rstrtmgr

RmStartSession
RmGetList
RmRegisterResources

user32

GetMonitorInfoW
EnumDisplaySettingsExW
EnumDisplayMonitors

bcrypt

BCryptGenRandom

secur32

DecryptMessage
EncryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext
QueryContextAttributesW
InitializeSecurityContextW
AcceptSecurityContext
FreeContextBuffer
ApplyControlToken

gdi32

CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetDIBits
GetObjectW
DeleteObject
CreateCompatibleDC
CreateDCW
GetDeviceCaps
DeleteDC

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx

api-ms-win-crt-string-l1-1-0

strncmp
strlen
strcpy_s
strcmp
strcspn
wcsncmp

api-ms-win-crt-math-l1-1-0

roundf
exp2f
truncf
_dclass
ceil
pow
__setusermatherr
log

api-ms-win-crt-heap-l1-1-0

free
calloc
_set_new_mode
malloc
_msize
realloc

api-ms-win-crt-utility-l1-1-0

_rotl64
qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
exit
_initterm_e
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
_beginthreadex
_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_endthreadex
_set_app_type
_crt_atexit
terminate
abort
_exit
_get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac8b5a8c92bd9226b8fa7dbd60571cd6

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

kernel32

ws2_32

oleaut32

crypt32

advapi32

rstrtmgr

user32

bcrypt

secur32

gdi32

ole32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 24KB - Virtual size: 28KB

.pdata Size: 71KB - Virtual size: 71KB

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 20KB - Virtual size: 19KB

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 24KB - Virtual size: 28KB

.pdata
Size: 71KB - Virtual size: 71KB

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 20KB - Virtual size: 19KB

.rsrc
Size: 17KB - Virtual size: 16KB