2024-06-08_18ce8cd25afa59d008bfc43607e064fb_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-08_18ce8cd25afa59d008bfc43607e064fb_megazord
Size

17.5MB
MD5

18ce8cd25afa59d008bfc43607e064fb
SHA1

b29064415823a311f8aac8088ddb18d9cca3078e
SHA256

3c6da4964a3a11708edb107cfefc0882795f39a58709078b40dab45983c9fbaf
SHA512

cbdaaa899b8fe2522ebba96fd3bed7e04faf20fe4cf57ff07ff82a6efe90125c102b38b5a025a867b65f84e19969bc1ffb32f1a88978660848650921825923d3
SSDEEP

98304:Mrqp6BdtNjQnh6ZMMq5otU4UvwWoDCjwlfFYlzfPbDafPbDKfPbDqaGn6k150QYQ:Mr4StNfaMftr1DC6i3i3y3jPa9f87LM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-08_18ce8cd25afa59d008bfc43607e064fb_megazord

Files

2024-06-08_18ce8cd25afa59d008bfc43607e064fb_megazord
.exe windows:6 windows x64 arch:x64

93467247a1ec340169c811a21b35121b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\zebar\zebar\packages\desktop\target\x86_64-pc-windows-msvc\release\deps\desktop.pdb

Imports

bcryptprimitives

ProcessPrng

comctl32

SetWindowSubclass
DefSubclassProc
RemoveWindowSubclass
TaskDialogIndirect

user32

GetSystemMenu
ReleaseCapture
SetCapture
GetUpdateRect
MsgWaitForMultipleObjectsEx
GetWindowDC
OffsetRect
GetMenuBarInfo
PeekMessageW
PostThreadMessageW
GetSystemMetrics
ValidateRect
RedrawWindow
CreateAcceleratorTableW
DestroyAcceleratorTable
PostMessageW
TrackPopupMenu
DrawIconEx
ReleaseDC
SetCursor
CheckMenuItem
GetMenuItemInfoW
SetMenuItemInfoW
AppendMenuW
InsertMenuW
CreatePopupMenu
CreateMenu
DestroyMenu
RemoveMenu
DrawMenuBar
EnumChildWindows
EnableMenuItem
DestroyWindow
GetTouchInputInfo
ScreenToClient
CloseTouchInputHandle
GetCursorPos
MonitorFromWindow
MonitorFromRect
SetWindowPos
GetWindowRect
MapWindowPoints
GetMonitorInfoW
LoadCursorW
IsProcessDPIAware
GetDC
TranslateMessage
DispatchMessageW
FindWindowW
RegisterClassExW
CreateWindowExW
SendMessageW
IsIconic
MapVirtualKeyW
GetMessageW
GetAsyncKeyState
RegisterRawInputDevices
DefWindowProcW
SetWindowLongW
ClientToScreen
GetClipCursor
GetRawInputData
GetClientRect
ChangeDisplaySettingsExW
PostQuitMessage
ClipCursor
ShowCursor
SetWindowDisplayAffinity
GetKeyboardState
GetWindowLongW
MapVirtualKeyExW
RegisterWindowMessageA
SendInput
DestroyIcon
SetMenu
GetKeyState
SetWindowPlacement
SystemParametersInfoW
GetWindowPlacement
CreateIcon
GetMenu
AdjustWindowRectEx
DispatchMessageA
GetMessageA
ToUnicodeEx
GetKeyboardLayout
RealGetWindowClassW
GetWindowTextW
IsWindowVisible
EnumDisplayMonitors
MonitorFromPoint
SetForegroundWindow
GetWindowThreadProcessId
ShowWindow
InvalidateRgn
GetWindowLongPtrW
SetWindowLongPtrW
GetParent
SystemParametersInfoA
SetPropW
TranslateAcceleratorW
GetWindowTextLengthW
SetWindowTextW
RegisterTouchWindow
IsWindow
GetForegroundWindow
FlashWindowEx
GetActiveWindow
SetCursorPos
TrackMouseEvent

ole32

CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoTaskMemFree
RegisterDragDrop
OleInitialize
RevokeDragDrop
CoCreateInstance

shell32

SHCreateItemFromParsingName
DragQueryFileW
CommandLineToArgvW
DragFinish
SHAppBarMessage
SHGetKnownFolderPath

kernel32

CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
ReadFileEx
ExitProcess
GetFileType
CopyFileExW
GetFinalPathNameByHandleW
GetTempPathW
CreateNamedPipeW
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
lstrlenW
GetTickCount64
DeleteFileW
FindFirstFileW
CreateDirectoryW
GetFileInformationByHandleEx
FindClose
HeapReAlloc
QueryPerformanceFrequency
WakeConditionVariable
GetLogicalProcessorInformationEx
GetProcessHeap
HeapFree
LocalFree
FormatMessageW
HeapAlloc
WakeAllConditionVariable
LocalAlloc
InitializeProcThreadAttributeList
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
GetExitCodeProcess
TerminateProcess
VirtualQueryEx
ReadProcessMemory
SleepEx
WriteFileEx
GetStdHandle
SetFileInformationByHandle
GetCommandLineW
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetComputerNameExW
DeviceIoControl
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
SetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
RtlVirtualUnwind
CreateThread
CreateFileW
WaitForSingleObjectEx
QueryPerformanceCounter
SetWaitableTimer
CreateWaitableTimerExW
GetConsoleMode
SetConsoleMode
LoadLibraryA
SwitchToThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
CompareStringOrdinal
DeleteProcThreadAttributeList
GetSystemInfo
GetProcAddress
GetModuleHandleA
GetProcessId
QueryFullProcessImageNameW
OpenProcess
GetCurrentProcessId
CreatePipe
DuplicateHandle
GetCurrentProcess
WaitForSingleObject
SleepConditionVariableSRW
GetCurrentThreadId
GetModuleHandleW
GetLastError
CreateMutexW
ReleaseMutex
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSListHead
FreeEnvironmentStringsW
CreateMutexA
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlLookupFunctionEntry
TlsFree
RtlCaptureContext
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
GetCurrentThread
Sleep
RaiseException
EncodePointer
GetUserDefaultUILanguage
LCIDToLocaleName
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetFileInformationByHandle
LoadLibraryExA
SetFileCompletionNotificationModes
GetEnvironmentVariableW
FreeLibrary
DeleteCriticalSection
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
GetModuleFileNameW
OutputDebugStringW
OutputDebugStringA
GetFileAttributesW
LoadLibraryW
SetHandleInformation
GetFullPathNameW
GetSystemTimeAsFileTime

gdi32

SelectObject
DeleteDC
CreateCompatibleDC
CreateDIBSection
CreateRectRgn
BitBlt
DeleteObject
GetDeviceCaps

dwmapi

DwmSetWindowAttribute
DwmEnableBlurBehindWindow

ws2_32

accept
WSADuplicateSocketW
recv
send
ioctlsocket
shutdown
getsockopt
WSASend
WSAIoctl
WSASocketW
getpeername
connect
bind
listen
getaddrinfo
freeaddrinfo
WSAStartup
WSACleanup
WSAGetLastError
getsockname
closesocket
setsockopt

advapi32

OpenProcessToken
GetTokenInformation
IsValidSid
EventRegister
GetLengthSid
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW
CopySid
RegOpenKeyExW
SystemFunction036
RegCloseKey
RegQueryValueExW

pdh

PdhCollectQueryData
PdhAddEnglishCounterW
PdhOpenQueryA
PdhCloseQuery
PdhRemoveCounter
PdhGetFormattedCounterValue

powrprof

CallNtPowerInformation

ntdll

NtDeviceIoControlFile
RtlNtStatusToDosError
NtWriteFile
NtReadFile
NtCancelIoFileEx
RtlGetVersion
NtQueryInformationProcess
NtCreateFile
NtQuerySystemInformation

secur32

InitializeSecurityContextW
DecryptMessage
FreeContextBuffer
DeleteSecurityContext
EncryptMessage
QueryContextAttributesW
AcceptSecurityContext
ApplyControlToken
AcquireCredentialsHandleA
FreeCredentialsHandle

iphlpapi

GetIfEntry2
FreeMibTable
GetIfTable2
GetAdaptersAddresses

oleaut32

GetErrorInfo
SysStringLen
SetErrorInfo
SysFreeString

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces

crypt32

CertOpenStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCloseStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateChain
CertDuplicateStore

shlwapi

SHCreateMemStream

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
DrawThemeText

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

api-ms-win-crt-math-l1-1-0

pow
round
trunc
floor
__setusermatherr

api-ms-win-crt-string-l1-1-0

strlen
wcslen
wcscmp
_wcsicmp
strcpy_s
wcsncmp

api-ms-win-crt-heap-l1-1-0

calloc
malloc
_callnewh
realloc
_set_new_mode
free

api-ms-win-crt-convert-l1-1-0

_ultow_s
wcstol
_wtoi

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_initialize_onexit_table
_set_app_type
_seh_filter_exe
_register_onexit_function
_register_thread_local_exe_atexit_callback
abort
_configure_narrow_argv
_initialize_narrow_environment
_c_exit
_cexit
__p___argv
__p___argc
_get_initial_narrow_environment
_exit
_initterm
exit
_initterm_e

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 10.9MB - Virtual size: 10.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 575KB - Virtual size: 574KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93467247a1ec340169c811a21b35121b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

comctl32

user32

ole32

shell32

kernel32

gdi32

dwmapi

ws2_32

advapi32

pdh

powrprof

ntdll

secur32

iphlpapi

oleaut32

setupapi

crypt32

shlwapi

uxtheme

bcrypt

api-ms-win-core-synch-l1-2-0

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 10.9MB - Virtual size: 10.9MB

.rdata Size: 5.9MB - Virtual size: 5.9MB

.data Size: 14KB - Virtual size: 19KB

.pdata Size: 575KB - Virtual size: 574KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 86KB - Virtual size: 85KB

.reloc Size: 75KB - Virtual size: 75KB

.text
Size: 10.9MB - Virtual size: 10.9MB

.rdata
Size: 5.9MB - Virtual size: 5.9MB

.data
Size: 14KB - Virtual size: 19KB

.pdata
Size: 575KB - Virtual size: 574KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 86KB - Virtual size: 85KB

.reloc
Size: 75KB - Virtual size: 75KB