2024-06-08_b7658ddd286a261fa97d6eded8b7db5c_megazord

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-08_b7658ddd286a261fa97d6eded8b7db5c_megazord
Size

40.4MB
MD5

b7658ddd286a261fa97d6eded8b7db5c
SHA1

dce82393cfcd1d27b0c8059adbfbf5910ce2b54e
SHA256

a21b40d36cce7be90372bf192027ddf779f709372480f8db264635dd91e6c226
SHA512

56bb3548084038672e94d5faab0c2431fa67fcc26beebf6c5ddbf8566fe0e3423254795df6ff9be7dc5bc5c66e54b5f9af5cdd2f1ca2f0f0089d65b4ca50db39
SSDEEP

786432:t1UWh1wCL9YFd9r9y+Pt+L6RiHC1BWgGkzd:VMIOd+SE2RtflZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-08_b7658ddd286a261fa97d6eded8b7db5c_megazord

Files

2024-06-08_b7658ddd286a261fa97d6eded8b7db5c_megazord
.exe windows:6 windows x64 arch:x64

e203505f78872618fafa1dc22585a2e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\pot-desktop\pot-desktop\src-tauri\target\x86_64-pc-windows-msvc\release\deps\pot.pdb

Imports

kernel32

WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEvent
GetModuleFileNameW
SetThreadErrorMode
SetEndOfFile
UnlockFileEx
GetTempPathW
WaitForSingleObject
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
GlobalUnlock
MultiByteToWideChar
Sleep
GetTempPathA
GlobalLock
GlobalSize
FormatMessageW
InitializeCriticalSection
GetDiskFreeSpaceA
GlobalAlloc
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
GlobalFree
FlushViewOfFile
CreateFileA
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
GetModuleHandleA
HeapAlloc
lstrlenW
HeapCompact
GetUserDefaultLocaleName
SetFileTime
HeapDestroy
UnlockFile
LocalFree
HeapFree
GetFileSize
GetUserDefaultUILanguage
LCIDToLocaleName
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
EnterCriticalSection
MapViewOfFile
QueryPerformanceCounter
LeaveCriticalSection
GetFullPathNameW
GetTickCount
TryEnterCriticalSection
HeapCreate
FlushFileBuffers
TlsSetValue
TlsGetValue
CreateThread
WriteConsoleW
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
WaitForMultipleObjects
CreateNamedPipeW
ExitProcess
CopyFileExW
GetFinalPathNameByHandleW
CreateHardLinkW
CreateSymbolicLinkW
RemoveDirectoryW
FindFirstFileW
CreateDirectoryW
GetFileInformationByHandleEx
FindNextFileW
CreateMutexA
QueryPerformanceFrequency
WakeConditionVariable
WakeAllConditionVariable
GetProcessId
TerminateProcess
GetExitCodeProcess
ReadFileEx
AreFileApisANSI
LockFileEx
ReadFile
SleepEx
WriteFileEx
GetStdHandle
SetFilePointerEx
SetFileInformationByHandle
GetCommandLineW
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
ReleaseSemaphore
ReadDirectoryChangesW
CreateSemaphoreW
GetEnvironmentVariableW
CreatePipe
GetCurrentProcess
DuplicateHandle
GetFileInformationByHandle
SetFileAttributesW
MoveFileExW
SystemTimeToTzSpecificLocalTime
GetConsoleMode
CreateFileW
SetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
CancelIo
WaitForSingleObjectEx
SetLastError
RtlLookupFunctionEntry
CreateMutexW
GetLastError
LoadLibraryExW
DeleteCriticalSection
CreateFileMappingW
RtlVirtualUnwind
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
FreeLibrary
GetProcAddress
LoadLibraryA
RtlPcToFileHeader
ReleaseMutex
RaiseException
ReleaseSRWLockShared
RtlCaptureContext
AcquireSRWLockShared
GetCurrentThread
SwitchToThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
EncodePointer
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TlsAlloc
CreateEventW
CompareStringOrdinal
FindClose
FreeEnvironmentStringsW
CloseHandle
SetFileCompletionNotificationModes
GetOverlappedResult
SetHandleInformation
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
TlsFree

user32

GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
MapVirtualKeyExW
GetKeyState
GetAsyncKeyState
GetKeyboardState
TranslateMessage
GetRawInputData
SetWindowLongW
GetSystemMenu
CreateAcceleratorTableW
DestroyAcceleratorTable
TrackPopupMenu
SetForegroundWindow
RegisterHotKey
CreateIcon
GetKeyboardLayout
GetWindowLongW
TrackMouseEvent
UnregisterHotKey
DispatchMessageW
LoadCursorW
SystemParametersInfoA
IsWindowVisible
ClipCursor
GetClientRect
ShowCursor
AdjustWindowRectEx
GetWindowRect
PostQuitMessage
MonitorFromRect
AppendMenuW
SetWindowPos
PostMessageW
TranslateAcceleratorW
CreateMenu
MonitorFromWindow
ToUnicodeEx
CheckMenuItem
SetMenuItemInfoW
EnableMenuItem
GetMessageA
MapVirtualKeyW
GetMessageW
DispatchMessageA
SetWindowDisplayAffinity
GetUpdateRect
PeekMessageW
GetMenu
ChangeDisplaySettingsExW
PostThreadMessageW
IsProcessDPIAware
DestroyIcon
SetCapture
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
RegisterWindowMessageA
EnumChildWindows
RedrawWindow
FlashWindowEx
ClientToScreen
ValidateRect
DestroyWindow
DefWindowProcW
GetMonitorInfoW
SetCursor
GetAncestor
RegisterClipboardFormatW
GetClipCursor
CloseClipboard
SetClipboardData
EmptyClipboard
GetDC
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
VkKeyScanW
SendInput
GetFocus
AttachThreadInput
GetWindowThreadProcessId
GetClipboardSequenceNumber
RegisterClassExW
IsWindow
GetCursorPos
CloseTouchInputHandle
ScreenToClient
CreatePopupMenu
GetTouchInputInfo
CreateWindowExW
MonitorFromPoint
EnumDisplaySettingsExW
EnumDisplayMonitors
GetWindowLongPtrW
SetWindowLongPtrW
SendMessageW
FindWindowW
GetForegroundWindow
GetActiveWindow
SetCursorPos
ReleaseCapture
IsIconic
SetMenu
ShowWindow
RegisterClassW
RegisterTouchWindow
GetSystemMetrics
InvalidateRgn
GetWindowPlacement
SetWindowPlacement

comctl32

RemoveWindowSubclass
SetWindowSubclass
DefSubclassProc
TaskDialogIndirect

ole32

CoUninitialize
CreateStreamOnHGlobal
CoInitializeEx
CoTaskMemFree
RevokeDragDrop
RegisterDragDrop
CoCreateInstance
CoInitialize
CoTaskMemAlloc
OleInitialize

shell32

ShellExecuteW
DragFinish
SHGetKnownFolderPath
SHAppBarMessage
SHCreateItemFromParsingName
DragQueryFileW
Shell_NotifyIconW
Shell_NotifyIconGetRect

gdi32

DeleteObject
CreateRectRgn
CreateDIBitmap
GetDeviceCaps
DeleteDC
GetObjectW
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetDIBits

dwmapi

DwmExtendFrameIntoClientArea
DwmEnableBlurBehindWindow

advapi32

RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
RegCloseKey
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW

oleaut32

SetErrorInfo
SysStringLen
SysFreeString
GetErrorInfo

ws2_32

send
closesocket
getaddrinfo
getsockname
getpeername
WSASocketW
freeaddrinfo
WSACleanup
WSAStartup
bind
connect
ioctlsocket
listen
accept
getsockopt
WSADuplicateSocketW
WSAGetLastError
shutdown
recv
WSAIoctl
setsockopt
WSASend

uxtheme

SetWindowTheme

secur32

EncryptMessage
InitializeSecurityContextW
QueryContextAttributesW
DeleteSecurityContext
AcquireCredentialsHandleA
AcceptSecurityContext
FreeCredentialsHandle
ApplyControlToken
DecryptMessage
FreeContextBuffer

crypt32

CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertOpenStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertFreeCertificateChain
CertDuplicateCertificateChain
CertCloseStore

ntdll

NtWriteFile
NtReadFile
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
NtCancelIoFileEx
RtlGetNtVersionNumbers

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

trunc
round
truncf
ceil
exp2f
powf
__setusermatherr
floor
log
roundf
exp
pow

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free
_callnewh
_msize
realloc
calloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcpy_s
strcspn
strncmp
_wcsicmp
wcslen
wcsncmp
strlen
strcmp

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_endthreadex
_beginthreadex
_c_exit
_cexit
_initialize_onexit_table
__p___argv
__p___argc
_register_onexit_function
_exit
exit
_initterm_e
_crt_atexit
_initterm
_get_initial_narrow_environment
terminate
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
strerror
abort

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 14.5MB - Virtual size: 14.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24.9MB - Virtual size: 24.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 747KB - Virtual size: 747KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e203505f78872618fafa1dc22585a2e3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

comctl32

ole32

shell32

gdi32

dwmapi

advapi32

oleaut32

ws2_32

uxtheme

secur32

crypt32

ntdll

bcrypt

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 14.5MB - Virtual size: 14.5MB

.rdata Size: 24.9MB - Virtual size: 24.9MB

.data Size: 41KB - Virtual size: 45KB

.pdata Size: 747KB - Virtual size: 747KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 39KB - Virtual size: 39KB

.reloc Size: 79KB - Virtual size: 79KB

.text
Size: 14.5MB - Virtual size: 14.5MB

.rdata
Size: 24.9MB - Virtual size: 24.9MB

.data
Size: 41KB - Virtual size: 45KB

.pdata
Size: 747KB - Virtual size: 747KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 39KB - Virtual size: 39KB

.reloc
Size: 79KB - Virtual size: 79KB