2024-05-27_8edd0cc51900a65d8fabd781cfca64ef_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-27_8edd0cc51900a65d8fabd781cfca64ef_megazord
Size

81.5MB
MD5

8edd0cc51900a65d8fabd781cfca64ef
SHA1

cfd8ebf8f065f7dae0089eba22171b8d4ab4a0ca
SHA256

bc028e7bcc7feb944e12fe63a6342667c95746da23b5dc3ea1cb821893b98a85
SHA512

a1852b800de10c90a35ab9f3f75b8af1096f7e3cdf139ac6cf1c84a3961dc6af0113d3df5c4092888a23eaa84f34d6aa104b6053cefc9aaab998cfa678e33adf
SSDEEP

393216:Fh/3kJ7vxpHhX6FNFDhCK5W6M3u4K7qWvPYH39cb1oM62:FinuDcwWtu4O5INcbmMd

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-27_8edd0cc51900a65d8fabd781cfca64ef_megazord

Files

2024-05-27_8edd0cc51900a65d8fabd781cfca64ef_megazord
.exe windows:6 windows x64 arch:x64

023331599a8dcc67f82c39ec487a3b24

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Kenya\Desktop\Andet\Coding\Warframe\quantframe-react\src-tauri\target\debug\deps\quantframe_react.pdb

Imports

ntdll

RtlUnwindEx
RtlPcToFileHeader
NtWriteFile
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
NtCreateFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
RtlGetNtVersionNumbers
NtReadFile

kernel32

WaitForSingleObject
FreeEnvironmentStringsW
CreateFileW
HeapFree
DeleteProcThreadAttributeList
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
HeapCreate
FormatMessageW
GetExitCodeProcess
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
TlsFree
LoadLibraryA
SetFileTime
WaitForSingleObjectEx
ReadFile
AreFileApisANSI
DeleteFileA
DeleteFileW
InitializeCriticalSection
EnterCriticalSection
LCIDToLocaleName
GetUserDefaultUILanguage
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
LeaveCriticalSection
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
CreateMutexW
GetTickCount
FlushFileBuffers
SleepConditionVariableSRW
ReleaseSRWLockShared
AcquireSRWLockShared
UnhandledExceptionFilter
lstrlenW
SetUnhandledExceptionFilter
TryEnterCriticalSection
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
AcquireSRWLockExclusive
GetCurrentThreadId
DeleteCriticalSection
CompareStringOrdinal
TryAcquireSRWLockExclusive
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
AddVectoredExceptionHandler
ReleaseSRWLockExclusive
SetFileCompletionNotificationModes
GetDiskFreeSpaceW
SetThreadStackGuarantee
CreateMutexA
GetCurrentThread
WriteFile
CreateThread
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
ReadFileEx
SwitchToThread
GetModuleHandleW
CreateNamedPipeW
ExitProcess
CancelIo
CreateEventW
CopyFileExW
GetFinalPathNameByHandleW
CreateHardLinkW
CreateSymbolicLinkW
FindFirstFileW
GetModuleFileNameW
TlsSetValue
GetOverlappedResult
CreateIoCompletionPort
LoadLibraryExW
GetQueuedCompletionStatusEx
GetEnvironmentVariableW
QueryPerformanceCounter
PostQueuedCompletionStatus
CreateDirectoryW
QueryPerformanceFrequency
SystemTimeToTzSpecificLocalTime
GetModuleHandleA
GetFullPathNameW
GetStdHandle
GetFileInformationByHandle
SetFileAttributesW
MoveFileExW
WriteConsoleW
GetFileInformationByHandleEx
FindClose
GetCurrentProcess
WaitForMultipleObjects
GetConsoleMode
VirtualProtect
LocalFree
DuplicateHandle
CreateWaitableTimerExW
FindNextFileW
ReleaseMutex
UnregisterWaitEx
SetHandleInformation
WakeConditionVariable
WakeAllConditionVariable
TerminateProcess
SleepEx
WriteFileEx
SetFilePointerEx
SetFileInformationByHandle
GetCommandLineW
SetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
SetWaitableTimer
TzSpecificLocalTimeToSystemTime

user32

MapVirtualKeyExW
GetKeyboardState
MonitorFromWindow
EnumDisplayMonitors
ChangeDisplaySettingsExW
GetAsyncKeyState
GetKeyState
VkKeyScanW
GetForegroundWindow
SetCapture
GetKeyboardLayout
ToUnicodeEx
SendInput
RedrawWindow
ValidateRect
GetUpdateRect
InvalidateRgn
GetMenu
MsgWaitForMultipleObjectsEx
SetWindowDisplayAffinity
DestroyAcceleratorTable
CreateAcceleratorTableW
RegisterWindowMessageA
SystemParametersInfoA
GetWindowTextLengthW
SetForegroundWindow
PostThreadMessageW
GetWindowPlacement
AdjustWindowRectEx
SetWindowLongPtrW
IsProcessDPIAware
GetWindowLongPtrW
ClientToScreen
RegisterClassExW
GetDC
PostQuitMessage
IsWindowVisible
CreateWindowExW
CreatePopupMenu
TrackPopupMenu
SetWindowTextW
SetWindowLongW
GetWindowTextW
GetWindowLongW
EnableMenuItem
DefWindowProcW
GetWindowRect
GetSystemMenu
GetClipCursor
GetClientRect
DestroyWindow
CheckMenuItem
SetWindowPos
SendMessageW
PostMessageW
PeekMessageW
GetMessageW
DestroyIcon
AppendMenuW
ShowWindow
ShowCursor
CreateMenu
CreateIcon
ClipCursor
SetCursor
EnumChildWindows
LoadCursorW
GetRawInputData
RegisterRawInputDevices
TranslateMessage
DispatchMessageW
MapVirtualKeyW
TranslateAcceleratorW
GetMonitorInfoW
TrackMouseEvent
GetActiveWindow
ReleaseCapture
MonitorFromRect
ScreenToClient
SetMenuItemInfoW
CloseTouchInputHandle
RegisterTouchWindow
GetTouchInputInfo
GetAncestor
IsWindow
IsIconic
GetSystemMetrics
RegisterClassW
FlashWindowEx
SetCursorPos
GetCursorPos
MonitorFromPoint
GetMessageA
DispatchMessageA
SetWindowPlacement
SetMenu

ws2_32

getaddrinfo
WSASocketW
bind
WSAGetLastError
freeaddrinfo
getsockname
getpeername
connect
shutdown
recv
send
WSASend
WSAIoctl
closesocket
getsockopt
setsockopt
WSACleanup
WSAStartup
ioctlsocket
socket

secur32

AcceptSecurityContext
AcquireCredentialsHandleA
DecryptMessage
EncryptMessage
InitializeSecurityContextW
FreeCredentialsHandle
DeleteSecurityContext
ApplyControlToken
FreeContextBuffer
QueryContextAttributesW

crypt32

CertDuplicateCertificateChain
CertFreeCertificateChain
CertCloseStore
CertDuplicateStore
CertOpenStore
CertAddCertificateContextToStore
CertGetCertificateChain
CertEnumCertificatesInStore
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertDuplicateCertificateContext

shell32

SHAppBarMessage
SHGetKnownFolderPath
DragFinish
DragQueryFileW
SHGetFolderPathW
Shell_NotifyIconW
Shell_NotifyIconGetRect
ShellExecuteW

ole32

CoUninitialize
OleInitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree
RevokeDragDrop
RegisterDragDrop
CreateStreamOnHGlobal
CoTaskMemAlloc

advapi32

SystemFunction036
RegGetValueW
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

oleaut32

SetErrorInfo
GetErrorInfo
SysStringLen
SysFreeString

dwmapi

DwmEnableBlurBehindWindow

gdi32

CreateRectRgn
DeleteObject
GetDeviceCaps

comctl32

DefSubclassProc
TaskDialogIndirect
RemoveWindowSubclass
SetWindowSubclass

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

_wcsicmp
strcmp
strcspn
strlen
strcpy_s
strncmp
wcsncmp
wcslen

api-ms-win-crt-heap-l1-1-0

calloc
realloc
malloc
free
_msize
_callnewh
_set_new_mode

api-ms-win-crt-utility-l1-1-0

_byteswap_uint64
_rotl64
_byteswap_ulong
qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s
clock

api-ms-win-crt-math-l1-1-0

_hypotf
cos
exp
sin
tan
acos
asin
atan
cosh
sinh
tanh
_hypot
log1p
trunc
floor
ceilf
floorf
roundf
ceil
round
tanhf
sinhf
powf
coshf
atanf
__setusermatherr
asinf
acosf
tanf
sinf
logf
expf
cosf
fmod
fmodf
pow
log
_dclass
log1pf

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_c_exit
_cexit
__p___argv
__p___argc
_exit
exit
_register_onexit_function
_crt_atexit
terminate
_initterm_e
abort
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_wassert
_endthreadex
_beginthreadex
_set_app_type

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__acrt_iob_func
fflush
__stdio_common_vfprintf
__p__commode

api-ms-win-crt-convert-l1-1-0

_ultow_s
wcstol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 60.1MB - Virtual size: 60.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16.1MB - Virtual size: 16.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 110KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

023331599a8dcc67f82c39ec487a3b24

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

user32

ws2_32

secur32

crypt32

shell32

ole32

advapi32

oleaut32

dwmapi

gdi32

comctl32

uxtheme

bcrypt

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 60.1MB - Virtual size: 60.1MB

.rdata Size: 16.1MB - Virtual size: 16.1MB

.data Size: 110KB - Virtual size: 115KB

.pdata Size: 5.1MB - Virtual size: 5.1MB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 59KB - Virtual size: 58KB

.reloc Size: 133KB - Virtual size: 132KB

.text
Size: 60.1MB - Virtual size: 60.1MB

.rdata
Size: 16.1MB - Virtual size: 16.1MB

.data
Size: 110KB - Virtual size: 115KB

.pdata
Size: 5.1MB - Virtual size: 5.1MB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 59KB - Virtual size: 58KB

.reloc
Size: 133KB - Virtual size: 132KB