2024-05-26_c24821bdcafd99af31d94d0a6b6c3945_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-26_c24821bdcafd99af31d94d0a6b6c3945_megazord
Size

5.0MB
MD5

c24821bdcafd99af31d94d0a6b6c3945
SHA1

95bde8c75e488c9693962ec27bfa02137de1ab29
SHA256

c88d3a6abfca3451a84e06f790c2784b21310de5996fe27c1c3786febadee3e1
SHA512

096c2e3a22cfc55b1d0567a3680150560d21b6e61b67c9fbdd463253edf1cc792bea11002f8875a46464bd184c480f6a86c765fadcb52f677e8d660971829704
SSDEEP

49152:AzlOuj7VQe4A5nxxpugHqj35S+8Pg3DCgpv++ezVK9Ve1BZ2YB/5hP0QSQHfMjmF:AE7Eye11P0QRDF+E8RhH1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-26_c24821bdcafd99af31d94d0a6b6c3945_megazord

Files

2024-05-26_c24821bdcafd99af31d94d0a6b6c3945_megazord
.exe windows:6 windows x64 arch:x64

bafb775cc18648f362b5c19e37c12647

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Piton\Piton\target\x86_64-pc-windows-msvc\release\deps\piton.pdb

Imports

kernel32

SetFileCompletionNotificationModes
GetCurrentProcess
GetModuleFileNameW
SetErrorMode
SetThreadErrorMode
GetProcessHeap
FreeLibrary
ReleaseMutex
FindClose
AddVectoredExceptionHandler
LoadLibraryExA
SwitchToThread
QueryPerformanceCounter
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentDirectoryW
GetEnvironmentVariableW
SetFileTime
EncodePointer
GetCommandLineW
SetFileInformationByHandle
DuplicateHandle
SetFilePointerEx
GetStdHandle
GetCurrentProcessId
TerminateProcess
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
HeapReAlloc
WaitForSingleObjectEx
CreateMutexA
FindNextFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
DeleteFileW
DeviceIoControl
CreateSymbolicLinkW
CreateHardLinkW
SetFileAttributesW
GetFinalPathNameByHandleW
GetModuleHandleA
TlsAlloc
GetConsoleMode
TlsGetValue
GetModuleHandleW
ExitProcess
GetFullPathNameW
MultiByteToWideChar
WriteConsoleW
CreateThread
GetSystemTimeAsFileTime
TlsSetValue
HeapAlloc
TlsFree
InitializeCriticalSectionEx
PostQueuedCompletionStatus
GetLastError
SetLastError
GetQueuedCompletionStatusEx
GetProcAddress
LoadLibraryA
LoadLibraryW
AttachConsole
AllocConsole
HeapFree
CreateIoCompletionPort
RaiseException
WaitForSingleObject
RtlPcToFileHeader
RtlUnwindEx
SetHandleInformation
FormatMessageW
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetSystemInfo
ReleaseSRWLockExclusive
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
CreateFileW
SetThreadStackGuarantee
CloseHandle
FindFirstFileExW
IsWow64Process
LoadLibraryExW
DeleteCriticalSection
GetFileAttributesExW
OutputDebugStringW

user32

AdjustWindowRectEx
GetMenu
GetWindowLongA
GetWindowRect
GetDesktopWindow
PeekMessageW
MoveWindow
GetDialogBaseUnits
SendMessageTimeoutA
GetSystemMetrics
SystemParametersInfoW
DrawTextW
GetWindowLongPtrW
SetWindowLongPtrW
GetDlgItem
SetTimer
SetWindowTextW
SendMessageA
RedrawWindow
EndDialog
InvalidateRect
DialogBoxIndirectParamA
GetDC
MessageBoxW
MonitorFromWindow
ReleaseDC
SetWindowPos

gdi32

DeleteObject
SelectObject
GetDeviceCaps
CreateFontIndirectW

ws2_32

getpeername
getsockname
WSASocketW
bind
connect
ioctlsocket
getsockopt
shutdown
recv
send
WSASend
setsockopt
WSAIoctl
WSAGetLastError
WSAStartup
WSACleanup
freeaddrinfo
closesocket
getaddrinfo

comctl32

InitCommonControlsEx

oleaut32

SysStringLen
GetErrorInfo
SysFreeString

advapi32

RegOpenKeyExW
RegQueryValueExW
SystemFunction036
RegCloseKey
RegGetValueW

bcrypt

BCryptGenRandom

ntdll

NtCancelIoFileEx
NtReadFile
NtWriteFile
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile

api-ms-win-crt-string-l1-1-0

wcsncmp
strcpy_s
toupper
wcslen
strlen

api-ms-win-crt-heap-l1-1-0

free
_callnewh
_set_new_mode
calloc
malloc

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
_set_fmode
fputws
fputwc
__stdio_common_vfwprintf
setvbuf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
_wfsopen

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64_s
wcsftime

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initialize_narrow_environment
_errno
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
__p___argv
_crt_atexit
terminate
abort
__p___argc
_initterm
_cexit
_exit
_seh_filter_exe
_set_app_type
_configure_narrow_argv
exit
_register_onexit_function
_get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

pow
log
__setusermatherr

api-ms-win-crt-convert-l1-1-0

_wtoi
wcstoul

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

get_hostfxr_path

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bafb775cc18648f362b5c19e37c12647

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

ws2_32

comctl32

oleaut32

advapi32

bcrypt

ntdll

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 16KB - Virtual size: 20KB

.pdata Size: 157KB - Virtual size: 157KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 16KB - Virtual size: 20KB

.pdata
Size: 157KB - Virtual size: 157KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 25KB - Virtual size: 24KB