2024-06-03_5d27b42f2a51c7d387005896b31cc281_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-03_5d27b42f2a51c7d387005896b31cc281_megazord
Size

8.5MB
MD5

5d27b42f2a51c7d387005896b31cc281
SHA1

ec2eee1f7e9ba32d354ac06f3953bd0e9877bb25
SHA256

67380722b0e59b61afc64120f355d3634f0f32ac828d75fde6873910b43cdb00
SHA512

39830128c91d62a6e886bb0864eae3c6f6f0b7676b8bbd6ff329cead9ac7b96a52fecd25e7047ec4b31969052654011d55c480494acc2140f1b0af975c15cac9
SSDEEP

98304:y9e6oXCdcr/Ov/U03TqWISNvcniJyYoFi0qjrBsZnLnBv5a08Ld0uSIAD1++9:bUCeD9ISVcniJyYok0EBMLBc0NQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-03_5d27b42f2a51c7d387005896b31cc281_megazord

Files

2024-06-03_5d27b42f2a51c7d387005896b31cc281_megazord
.exe windows:6 windows x64 arch:x64

e86b00e180152343da870ec936854d4e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\work\other\tauri\verge_dev\src-tauri\target\release\deps\clash_verge.pdb

Imports

kernel32

QueryPerformanceFrequency
FormatMessageW
GetCurrentDirectoryW
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
RtlCaptureContext
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
GetFileInformationByHandle
GetFileInformationByHandleEx
WakeAllConditionVariable
GetFullPathNameW
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
FindFirstFileW
GetProcAddress
GetModuleHandleA
WakeConditionVariable
SleepConditionVariableSRW
SetHandleInformation
CreatePipe
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
CreateEventW
CancelIo
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
DeleteFileW
MoveFileExW
SetFileCompletionNotificationModes
GetProcessTimes
SetConsoleTextAttribute
lstrlenW
ReadProcessMemory
VirtualQueryEx
SetLastError
GetProcessIoCounters
OpenProcess
GetCurrentProcess
GetConsoleMode
LocalFree
GlobalMemoryStatusEx
CreateNamedPipeW
GetCurrentProcessId
MultiByteToWideChar
GetDiskFreeSpaceExW
GetExitCodeProcess
WaitForSingleObject
CreateFileW
WriteConsoleW
ReadFile
Sleep
GetTimeZoneInformationForYear
PostQueuedCompletionStatus
ReleaseSRWLockShared
AcquireSRWLockShared
GetQueuedCompletionStatusEx
TryAcquireSRWLockExclusive
CreateIoCompletionPort
HeapReAlloc
GetProcessHeap
LoadLibraryW
TlsFree
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetProcessId
GetCurrentThread
GetConsoleScreenBufferInfo
GetStdHandle
CopyFileExW
GetSystemInfo
SetEnvironmentVariableW
FindClose
CloseHandle
GetTickCount64
GlobalUnlock
GlobalLock
GlobalAlloc
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
RtlUnwindEx
GetLastError
GetModuleHandleW
RtlPcToFileHeader
GetSystemTimes
RaiseException
EncodePointer
TerminateProcess
DeleteCriticalSection
RtlVirtualUnwind
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
TlsAlloc
GetCurrentThreadId
TlsGetValue
TlsSetValue
OutputDebugStringW
OutputDebugStringA
SystemTimeToFileTime
GetSystemTime
GetTimeZoneInformation
LCIDToLocaleName
GetUserDefaultUILanguage
AcquireSRWLockExclusive
FreeLibrary
ReleaseSRWLockExclusive
SwitchToThread
HeapFree

user32

SetWindowLongW
PeekMessageW
ReleaseCapture
MapVirtualKeyExW
SendMessageW
DispatchMessageW
EnableMenuItem
GetKeyboardState
TranslateMessage
GetKeyboardLayout
ToUnicodeEx
SetWindowTextW
MsgWaitForMultipleObjectsEx
PostMessageW
GetSystemMenu
GetMonitorInfoW
SetWindowPlacement
ChangeDisplaySettingsExW
GetWindowTextLengthW
MonitorFromWindow
GetDC
GetAncestor
SystemParametersInfoA
GetWindowPlacement
TrackPopupMenu
SetForegroundWindow
GetCursorPos
GetWindowTextW
GetWindowLongPtrW
ShowWindow
PostQuitMessage
SendInput
SetMenuItemInfoW
AppendMenuW
CreateIcon
UnregisterHotKey
VkKeyScanW
DefWindowProcW
RegisterClassExW
MonitorFromRect
GetWindowRect
DestroyAcceleratorTable
AdjustWindowRectEx
GetMenu
GetWindowLongW
InvalidateRgn
SetWindowPos
RegisterWindowMessageA
TranslateAcceleratorW
ClientToScreen
GetActiveWindow
GetClipCursor
GetSystemMetrics
ClipCursor
ShowCursor
EnumChildWindows
GetKeyState
LoadCursorW
DispatchMessageA
GetMessageA
GetMessageW
PostThreadMessageW
GetClientRect
RedrawWindow
CreateMenu
CreatePopupMenu
SetCursorPos
GetForegroundWindow
FlashWindowEx
CreateAcceleratorTableW
CreateWindowExW
SetWindowLongPtrW
RegisterRawInputDevices
GetRawInputData
ValidateRect
GetUpdateRect
GetAsyncKeyState
TrackMouseEvent
MapVirtualKeyW
OpenClipboard
RegisterTouchWindow
EmptyClipboard
SetClipboardData
SetWindowDisplayAffinity
EnumDisplayMonitors
MonitorFromPoint
SetMenu
IsWindowVisible
IsIconic
CheckMenuItem
RegisterHotKey
IsWindow
CloseClipboard
DestroyWindow
RegisterClassW
SetCursor
CloseTouchInputHandle
GetTouchInputInfo
SetCapture
IsProcessDPIAware
ScreenToClient
DestroyIcon

comctl32

RemoveWindowSubclass
SetWindowSubclass
DefSubclassProc
TaskDialogIndirect

ws2_32

WSASocketW
getsockopt
bind
setsockopt
connect
freeaddrinfo
accept
WSACleanup
getsockname
listen
WSAIoctl
closesocket
getpeername
getaddrinfo
ioctlsocket
recv
WSAGetLastError
shutdown
WSASend
send
WSAStartup

shell32

DragFinish
CommandLineToArgvW
DragQueryFileW
SHAppBarMessage
ShellExecuteExW
SHGetKnownFolderPath
Shell_NotifyIconGetRect
ShellExecuteW
Shell_NotifyIconW

advapi32

CheckTokenMembership
GetTokenInformation
IsValidSid
RegCloseKey
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW
RegQueryValueExW
SystemFunction036
DuplicateTokenEx
CreateWellKnownSid
GetLengthSid
CopySid
RegOpenKeyExW
RegSetValueExW
OpenProcessToken
IsWellKnownSid
RegDeleteValueW

dwmapi

DwmExtendFrameIntoClientArea
DwmEnableBlurBehindWindow

iphlpapi

SendARP
GetIfEntry2
GetAdaptersAddresses

ole32

CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx
CoUninitialize
CreateStreamOnHGlobal
CoSetProxyBlanket
RevokeDragDrop
CoCreateInstance
CoInitializeSecurity
RegisterDragDrop
OleInitialize

bcrypt

BCryptGenRandom

ntdll

NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile
NtQuerySystemInformation
NtCreateFile
NtQueryInformationProcess
RtlGetVersion
NtReadFile

crypt32

CertDuplicateStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertGetCertificateChain
CertOpenStore
CertFreeCertificateContext

secur32

EncryptMessage
AcceptSecurityContext
InitializeSecurityContextW
QueryContextAttributesW
FreeCredentialsHandle
DeleteSecurityContext
DecryptMessage
AcquireCredentialsHandleA
ApplyControlToken
FreeContextBuffer

psapi

GetModuleFileNameExW
GetPerformanceInfo

pdh

PdhOpenQueryA
PdhAddEnglishCounterW
PdhCollectQueryData
PdhRemoveCounter
PdhGetFormattedCounterValue
PdhCloseQuery

powrprof

CallNtPowerInformation

oleaut32

SysAllocString
SysStringLen
GetErrorInfo
VariantClear
SetErrorInfo
SysFreeString

wininet

InternetSetOptionA

uxtheme

SetWindowTheme

gdi32

DeleteObject
GetDeviceCaps
CreateRectRgn

api-ms-win-crt-string-l1-1-0

_wcsicmp
strcat
wcsncmp
strlen
wcslen
strcmp
strcpy
strcpy_s

api-ms-win-crt-math-l1-1-0

pow
acos
sin
sinh
sqrt
tan
tanh
asinh
lrint
acosh
log10
log1p
expm1
atanh
log2
asin
log
fabs
trunc
__setusermatherr
exp
floor
round
hypot
fmin
fmax
fmod
ceil
cosh
_dclass
cos
atan2
_fdclass
atan
cbrt
_dsign

api-ms-win-crt-heap-l1-1-0

calloc
_set_new_mode
realloc
_callnewh
malloc
free
_msize

api-ms-win-crt-runtime-l1-1-0

_wassert
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_seh_filter_exe
_set_app_type
fesetround
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_exit
exit
_initterm_e
terminate
_initterm
_configure_narrow_argv
_get_initial_narrow_environment
_initialize_narrow_environment

api-ms-win-crt-convert-l1-1-0

_ultow_s
atoi
wcstol
strtod

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
_set_fmode
__p__commode
__stdio_common_vsprintf
__stdio_common_vfprintf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e86b00e180152343da870ec936854d4e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

comctl32

ws2_32

shell32

advapi32

dwmapi

iphlpapi

ole32

bcrypt

ntdll

crypt32

secur32

psapi

pdh

powrprof

oleaut32

wininet

uxtheme

gdi32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 4.0MB - Virtual size: 4.0MB

.data Size: 12KB - Virtual size: 26KB

.pdata Size: 100KB - Virtual size: 99KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 46KB - Virtual size: 45KB

.reloc Size: 40KB - Virtual size: 40KB

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 4.0MB - Virtual size: 4.0MB

.data
Size: 12KB - Virtual size: 26KB

.pdata
Size: 100KB - Virtual size: 99KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 46KB - Virtual size: 45KB

.reloc
Size: 40KB - Virtual size: 40KB