D:\a\slumber\slumber\target\x86_64-pc-windows-msvc\dist\deps\slumber.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-29_fd7fdebe9371e9eb385c788ba1fd2870_megazord.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-29_fd7fdebe9371e9eb385c788ba1fd2870_megazord.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-29_fd7fdebe9371e9eb385c788ba1fd2870_megazord
-
Size
11.7MB
-
MD5
fd7fdebe9371e9eb385c788ba1fd2870
-
SHA1
7cfce2e14eae8d7f43d589af0a3b31a0b7463abc
-
SHA256
e0a6d16dc5ca7472d240debde22c79e3db36feae607d9075695e7304abaf370f
-
SHA512
ab9c3d6838a320ce3d0482ab62ffadf01c510711301c01bb9e6bc9608fd42ad050ac306224f12fa953cb640cb94254c6d69507088911c4b5709fac7a4855b527
-
SSDEEP
98304:ZFMzU7T6WLOQjlcQpw2INzY1fr7b6htwNa9++arVS+bw:z7TP8cw2I+r3kCNS+j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-29_fd7fdebe9371e9eb385c788ba1fd2870_megazord
Files
-
2024-05-29_fd7fdebe9371e9eb385c788ba1fd2870_megazord.exe windows:6 windows x64 arch:x64
26b0dee3269fb7070607c042f244b288
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetLastError
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleMode
GetTimeZoneInformationForYear
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FormatMessageW
Sleep
MultiByteToWideChar
GlobalAlloc
GlobalLock
GetConsoleOutputCP
GetStringTypeW
GlobalFree
GlobalUnlock
SetConsoleCursorPosition
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
GetNumberOfConsoleInputEvents
ReadConsoleInputW
GetFileInformationByHandleEx
ReleaseSRWLockShared
AcquireSRWLockShared
CloseHandle
SwitchToThread
QueryPerformanceCounter
ReleaseSemaphore
SetConsoleActiveScreenBuffer
SetConsoleCursorInfo
SetStdHandle
SetEnvironmentVariableW
GetCPInfo
GetOEMCP
WaitForMultipleObjects
CreateFileW
CreateSemaphoreW
CreateConsoleScreenBuffer
GetACP
IsValidCodePage
lstrlenW
GetConsoleMode
FindNextFileW
FindFirstFileExW
LCMapStringW
CreateIoCompletionPort
CompareStringW
GetQueuedCompletionStatusEx
FlsFree
FlsSetValue
FlsGetValue
PostQueuedCompletionStatus
TryAcquireSRWLockExclusive
FlsAlloc
GetTimeZoneInformation
GetCommandLineA
SetFileCompletionNotificationModes
WaitForSingleObjectEx
CancelIo
ReadDirectoryChangesW
GetSystemInfo
GetModuleHandleA
GetProcAddress
GetModuleHandleExW
GetStdHandle
HeapReAlloc
HeapFree
FreeLibraryAndExitThread
ExitThread
FreeEnvironmentStringsW
ReleaseMutex
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetProcessHeap
GetCommandLineW
SetFilePointerEx
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
WakeConditionVariable
WakeAllConditionVariable
QueryPerformanceFrequency
LoadLibraryExW
ReadFileEx
SleepEx
WriteFileEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetFileInformationByHandle
CreateDirectoryW
FindFirstFileW
FindClose
GetFinalPathNameByHandleW
TlsFree
TlsSetValue
GetFileType
SleepConditionVariableSRW
SetHandleInformation
GetModuleHandleW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
GetEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
WriteConsoleW
CreateThread
GetSystemTimeAsFileTime
TlsGetValue
TlsAlloc
RegisterWaitForSingleObject
UnregisterWaitEx
SetConsoleCtrlHandler
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
ReadFile
AreFileApisANSI
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
RtlVirtualUnwind
InitializeCriticalSectionAndSpinCount
GetEnvironmentVariableW
EncodePointer
HeapAlloc
RtlPcToFileHeader
RtlUnwindEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
bcrypt
BCryptGenRandom
user32
GetForegroundWindow
ToUnicodeEx
SetClipboardData
EmptyClipboard
CloseClipboard
GetKeyboardLayout
GetWindowThreadProcessId
OpenClipboard
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
advapi32
SystemFunction036
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
ws2_32
WSAIoctl
send
recv
WSAGetLastError
setsockopt
bind
ioctlsocket
WSASocketW
closesocket
shutdown
getsockopt
getsockname
connect
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
WSASend
getpeername
ntdll
NtDeviceIoControlFile
NtWriteFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
NtReadFile
Sections
.text Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 373KB - Virtual size: 373KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ