2024-05-31_a1ccd8d3cb06b939fabb90aaf306bd34_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-31_a1ccd8d3cb06b939fabb90aaf306bd34_megazord
Size

20.9MB
MD5

a1ccd8d3cb06b939fabb90aaf306bd34
SHA1

0cc6e73053af06f9c2824679a3432328faafb730
SHA256

3dc4abdd03a19fed68f454ee352cc2e0d6f6dc8d413a904623af02548d07522f
SHA512

5526346cb09a738623a0ccb144deedcd8007ec000e09341028bd04dec726d03b149566122cd08a725f71171008389b58840fe74a493d6502586c1bafb422bac9
SSDEEP

196608:mtgpize96bIEfsuCUs6+voFif2pL1qKin9A:mtgpize965+6L1qKi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-31_a1ccd8d3cb06b939fabb90aaf306bd34_megazord

Files

2024-05-31_a1ccd8d3cb06b939fabb90aaf306bd34_megazord
.exe windows:6 windows x64 arch:x64

e22239e584ae951dc3a7af09e0c973e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vrc_get_gui.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

kernel32

TlsFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
TlsSetValue
SleepConditionVariableSRW
CloseHandle
GetCurrentThreadId
GetModuleHandleW
ReleaseMutex
CreateMutexW
GetLastError
LockFileEx
UnlockFileEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetCurrentProcess
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
lstrlenW
GetUserPreferredUILanguages
LoadLibraryExA
FreeLibrary
CreateEventW
SetEvent
WaitForSingleObject
GetProcessHeap
HeapFree
HeapAlloc
FormatMessageW
CloseThreadpoolIo
GetStdHandle
RaiseFailFastException
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetTickCount64
GetCurrentThread
Sleep
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
QueryPerformanceCounter
InitializeCriticalSection
InitializeConditionVariable
WaitForMultipleObjectsEx
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
QueryPerformanceFrequency
SetLastError
GetFullPathNameW
GetLongPathNameW
LocalAlloc
GetConsoleOutputCP
WideCharToMultiByte
CreateIoCompletionPort
CreateFileW
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
DeleteFileW
DeviceIoControl
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetModuleFileNameW
GetOverlappedResult
LoadLibraryExW
ReadFile
SetFileAttributesW
SetFileInformationByHandle
SetThreadErrorMode
CreateThread
ResumeThread
DuplicateHandle
GetThreadPriority
SetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
GetCurrentProcessorNumberEx
ResetEvent
CreateEventExW
GetEnvironmentVariableW
GetCPInfoExW
GetConsoleMode
ReadConsoleW
WriteConsoleW
MultiByteToWideChar
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
TerminateProcess
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
FlushProcessWriteBuffers
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
VirtualQuery
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
GetTimeZoneInformationForYear
GetModuleHandleA
GetNativeSystemInfo
GetUserDefaultLocaleName
SetFileTime
GetUserDefaultUILanguage
LCIDToLocaleName
LoadLibraryW
GetFileAttributesW
OutputDebugStringA
OutputDebugStringW
RegisterWaitForSingleObject
UnregisterWaitEx
SetHandleInformation
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
SetFileCompletionNotificationModes
GetFileInformationByHandle
MoveFileExW
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
SetThreadStackGuarantee
CreateWaitableTimerExW
SetWaitableTimer
GetCurrentDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetCommandLineW
SetFilePointerEx
WriteFileEx
GetExitCodeProcess
GetSystemTimePreciseAsFileTime
HeapReAlloc
FindNextFileW
CreateDirectoryW
FindFirstFileW
RemoveDirectoryW
CreateSymbolicLinkW
CreateHardLinkW
GetFinalPathNameByHandleW
CopyFileExW
CancelIo
ExitProcess
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetTempPathW
InitializeSListHead
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent

user32

SetMenu
IsIconic
MapVirtualKeyW
EnumChildWindows
GetMessageW
GetAncestor
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
PeekMessageW
PostThreadMessageW
GetAsyncKeyState
DefWindowProcW
PostMessageW
RegisterWindowMessageA
GetCursorPos
ReleaseCapture
ClientToScreen
ChangeDisplaySettingsExW
GetKeyboardState
ToUnicodeEx
GetKeyState
SetWindowPlacement
GetWindowPlacement
MapVirtualKeyExW
SetWindowPos
InvalidateRgn
LoadCursorW
SetCursor
SetCursorPos
GetKeyboardLayout
CreateIcon
GetActiveWindow
FlashWindowEx
GetRawInputData
GetForegroundWindow
SystemParametersInfoA
RedrawWindow
GetClientRect
CreateAcceleratorTableW
AppendMenuW
CreateMenu
CreateWindowExW
DestroyWindow
SetMenuItemInfoW
IsWindow
SendInput
SetForegroundWindow
GetSystemMetrics
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
DestroyIcon
DestroyAcceleratorTable
IsProcessDPIAware
GetDC
IsWindowVisible
AdjustWindowRectEx
GetWindowRect
MonitorFromPoint
EnumDisplayMonitors
SetWindowDisplayAffinity
GetMenu
ShowCursor
ClipCursor
GetClipCursor
SetWindowLongW
VkKeyScanW
GetSystemMenu
ShowWindow
GetMessageA
GetWindowLongPtrW
SetWindowLongPtrW
DispatchMessageA
GetMonitorInfoW
MonitorFromWindow
PostQuitMessage
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
GetWindowLongW
TrackMouseEvent
MonitorFromRect
GetUpdateRect
ValidateRect
SendMessageW
RegisterClassExW
FindWindowW
CheckMenuItem
EnableMenuItem
SetCapture
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
RegisterTouchWindow

comctl32

DefSubclassProc
SetWindowSubclass
RemoveWindowSubclass
TaskDialogIndirect

gdi32

CreateRectRgn
DeleteObject
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

ole32

CoGetApartmentType
CreateStreamOnHGlobal
CoWaitForMultipleHandles
RegisterDragDrop
RevokeDragDrop
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
CoCreateGuid
OleInitialize

shell32

ShellExecuteW
SHCreateItemFromParsingName
DragFinish
SHGetKnownFolderPath
SHAppBarMessage
DragQueryFileW

advapi32

EventSetInformation
EventWriteTransfer
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
EventUnregister
EventRegister
RegGetValueW
RegEnumKeyExW
SystemFunction036
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW

oleaut32

GetErrorInfo
SysFreeString
SetErrorInfo
SysStringLen

bcrypt

BCryptGenRandom

ws2_32

getaddrinfo
freeaddrinfo
closesocket
WSACleanup
WSAStartup
WSAGetLastError
WSAIoctl
setsockopt
send
recv
shutdown
getsockopt
ioctlsocket
connect
bind
WSASocketW
getpeername
getsockname
WSASend

secur32

InitializeSecurityContextW
EncryptMessage
AcceptSecurityContext
DecryptMessage
FreeContextBuffer
QueryContextAttributesW
ApplyControlToken
AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext

crypt32

CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFreeCertificateChain
CertFreeCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore
CertGetEnhancedKeyUsage
CertVerifyTimeValidity
CertDuplicateCertificateContext

uxtheme

SetWindowTheme

ntdll

NtDeviceIoControlFile
RtlNtStatusToDosError
NtCreateFile
NtReadFile
NtWriteFile
NtCancelIoFileEx

api-ms-win-crt-math-l1-1-0

floor
log
ceil
modf
pow
round
__setusermatherr
trunc

api-ms-win-crt-string-l1-1-0

_wcsicmp
strlen
wcslen
_stricmp
wcsncmp
strcpy_s
strcmp

api-ms-win-crt-heap-l1-1-0

free
calloc
_callnewh
_set_new_mode
malloc

api-ms-win-crt-convert-l1-1-0

strtoull
wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
terminate
_seh_filter_exe
_set_app_type
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_narrow_environment
_crt_atexit
_c_exit
_cexit
_get_initial_narrow_environment
_initterm
abort
_initterm_e
exit
_exit
__p___argv
__p___argc

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: 12.5MB - Virtual size: 12.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

hydrated
Size: - Virtual size: 611KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 758KB - Virtual size: 757KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e22239e584ae951dc3a7af09e0c973e6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

user32

comctl32

gdi32

dwmapi

ole32

shell32

advapi32

oleaut32

bcrypt

ws2_32

secur32

crypt32

uxtheme

ntdll

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 12.5MB - Virtual size: 12.5MB

.managed Size: 1.2MB - Virtual size: 1.2MB

hydrated Size: - Virtual size: 611KB

.rdata Size: 6.3MB - Virtual size: 6.3MB

.data Size: 30KB - Virtual size: 126KB

.pdata Size: 758KB - Virtual size: 757KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 81KB - Virtual size: 80KB

.text
Size: 12.5MB - Virtual size: 12.5MB

.managed
Size: 1.2MB - Virtual size: 1.2MB

hydrated
Size: - Virtual size: 611KB

.rdata
Size: 6.3MB - Virtual size: 6.3MB

.data
Size: 30KB - Virtual size: 126KB

.pdata
Size: 758KB - Virtual size: 757KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 81KB - Virtual size: 80KB