2024-06-15_c4a3fb378deb99e48d1a2b0f7612f5e2_megazord

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-15_c4a3fb378deb99e48d1a2b0f7612f5e2_megazord
Size

19.1MB
MD5

c4a3fb378deb99e48d1a2b0f7612f5e2
SHA1

5f771e11b0885216b641a0faf65749089d3b9941
SHA256

d1e822cd95392b656d2e9b74f0512f5aaeb3b61d4d9013b4592fd6d4d00e6792
SHA512

df9177d27bfb991ddcd5f06d4a3c0768b2b6cd5c1dde0c7fcc282f026ada7cf977a2ae10b1bf9c9729a443ab53c79104374d18e7c154502f396939d3c57b924a
SSDEEP

196608:0u2mUX94QXJdEfmvrxOgFd6Jn4ubxI3jtbVQ2Ml/q8+lPEIuq:0mUN48sgXiITDel/XCPEk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-15_c4a3fb378deb99e48d1a2b0f7612f5e2_megazord

Files

2024-06-15_c4a3fb378deb99e48d1a2b0f7612f5e2_megazord
.exe windows:6 windows x64 arch:x64

bc5e3d31fbe834ad41e53c0d442a2c39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\msys64\home\admin\git\baimiao-desktop-src\src-tauri\target\release\deps\app.pdb

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SystemFunction036
RegSetValueExW
RegDeleteValueW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
NtReadFile
NtDeviceIoControlFile
NtWriteFile
NtQuerySystemInformation
RtlGetVersion
RtlPcToFileHeader
RtlUnwindEx
RtlNtStatusToDosError
NtCreateFile
NtQueryInformationProcess
RtlVirtualUnwind
NtCancelIoFileEx

kernel32

OpenProcess
GetSystemTimes
GetProcessIoCounters
HeapAlloc
GetLastError
LocalFree
VirtualQueryEx
ReadProcessMemory
HeapFree
GetProcessHeap
GetSystemInfo
GetDriveTypeW
GetVolumeInformationW
CreateFileW
LockFileEx
GetLogicalDrives
GetTickCount64
SetFileInformationByHandle
GetTempPathW
GetSystemTimeAsFileTime
TlsSetValue
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
TlsGetValue
ReleaseSRWLockShared
AcquireSRWLockShared
GetModuleHandleA
GetProcAddress
CreateThread
lstrlenW
GetUserDefaultLocaleName
SetFileTime
GetFileInformationByHandleEx
WriteConsoleW
MultiByteToWideChar
CreateProcessW
GetWindowsDirectoryW
FormatMessageW
SetEvent
WaitForSingleObject
LoadLibraryA
FreeLibrary
WaitForMultipleObjects
GetUserDefaultUILanguage
LCIDToLocaleName
CreateNamedPipeW
LoadLibraryW
GetFullPathNameW
ExitProcess
CancelIo
CreateEventW
GetFinalPathNameByHandleW
CreateHardLinkW
CreateSymbolicLinkW
GetExitCodeProcess
GlobalUnlock
DeleteFileW
FindFirstFileW
CreateDirectoryW
FindNextFileW
CreateMutexA
WaitForSingleObjectEx
HeapReAlloc
QueryPerformanceFrequency
GlobalAlloc
QueryPerformanceCounter
WakeConditionVariable
WakeAllConditionVariable
GetProcessId
TerminateProcess
GetProcessTimes
ReadFileEx
SleepEx
WriteFileEx
SetFilePointerEx
GetCommandLineW
SetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
GetCurrentThread
SwitchToThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
CompareStringOrdinal
FindClose
ReleaseMutex
FreeEnvironmentStringsW
MoveFileExW
SetFileAttributesW
GetLogicalProcessorInformationEx
GetSystemDirectoryW
GetFileInformationByHandle
SetFileCompletionNotificationModes
GetOverlappedResult
ReadFile
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetHandleInformation
DuplicateHandle
GetCurrentProcess
GetCurrentProcessId
GetFileAttributesW
GetModuleFileNameW
OutputDebugStringA
OutputDebugStringW
LoadLibraryExW
GetEnvironmentVariableW
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetStdHandle
GetConsoleMode
Sleep
CreatePipe
GetDiskFreeSpaceExW
GlobalLock
GlobalMemoryStatusEx
GetModuleHandleW
CloseHandle
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ResetEvent
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
RaiseException
EncodePointer
TlsAlloc
DeviceIoControl
TlsFree

user32

IsProcessDPIAware
GetDC
DestroyIcon
SetClipboardData
RegisterClipboardFormatW
EmptyClipboard
SetMenuItemInfoW
TrackPopupMenu
SetForegroundWindow
EnumDisplayMonitors
SendMessageW
MonitorFromPoint
GetKeyboardLayout
UnregisterHotKey
CloseClipboard
GetClipboardData
OpenClipboard
SetCapture
SetWindowLongPtrW
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
RegisterWindowMessageA
DispatchMessageA
RegisterClassExW
GetMenu
EnumChildWindows
CreatePopupMenu
SetWindowDisplayAffinity
AppendMenuW
VkKeyScanW
MapVirtualKeyExW
GetKeyState
GetWindowLongPtrW
GetMessageA
CreateMenu
EnableMenuItem
AdjustWindowRectEx
ShowCursor
GetClipCursor
RedrawWindow
GetClientRect
PostMessageW
CheckMenuItem
CreateIcon
RegisterHotKey
ClipCursor
IsWindowVisible
SystemParametersInfoA
ToUnicodeEx
GetRawInputData
IsIconic
GetCursorPos
ReleaseCapture
ClientToScreen
SetWindowPos
PostQuitMessage
InvalidateRgn
SetCursorPos
GetActiveWindow
GetForegroundWindow
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
DestroyWindow
RegisterClassW
CreateWindowExW
IsWindow
ValidateRect
SendInput
DestroyAcceleratorTable
CreateAcceleratorTableW
ShowWindow
GetSystemMenu
PostThreadMessageW
SetWindowLongW
GetKeyboardState
GetAsyncKeyState
PeekMessageW
GetUpdateRect
RegisterTouchWindow
GetSystemMetrics
GetWindowPlacement
SetWindowPlacement
ChangeDisplaySettingsExW
FlashWindowEx
DefWindowProcW
TranslateAcceleratorW
GetAncestor
GetMessageW
MapVirtualKeyW
LoadCursorW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
SetCursor
SetMenu
MonitorFromWindow
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
GetWindowLongW
TrackMouseEvent
MonitorFromRect
GetWindowRect

comctl32

TaskDialogIndirect
SetWindowSubclass
RemoveWindowSubclass
DefSubclassProc

ole32

CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoTaskMemFree
OleInitialize
RevokeDragDrop
CoTaskMemAlloc
CoInitializeEx
RegisterDragDrop
CreateStreamOnHGlobal

shell32

CommandLineToArgvW
SHAppBarMessage
ShellExecuteW
SHGetKnownFolderPath
SHCreateItemFromParsingName
DragFinish
DragQueryFileW
Shell_NotifyIconW
Shell_NotifyIconGetRect

gdi32

CreateRectRgn
GetDeviceCaps
DeleteObject

dwmapi

DwmEnableBlurBehindWindow

iphlpapi

GetIfEntry2
GetAdaptersAddresses
FreeMibTable
GetIfTable2

pdh

PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhOpenQueryA

powrprof

CallNtPowerInformation

oleaut32

GetErrorInfo
VariantClear
SetErrorInfo
SysAllocString
SysStringLen
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetLocalGroups

secur32

AcceptSecurityContext
InitializeSecurityContextW
EncryptMessage
DeleteSecurityContext
QueryContextAttributesW
DecryptMessage
ApplyControlToken
FreeCredentialsHandle
AcquireCredentialsHandleA
LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer
FreeContextBuffer

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

ws2_32

ioctlsocket
connect
WSACleanup
freeaddrinfo
bind
getsockopt
WSAStartup
shutdown
WSASocketW
recv
send
getpeername
WSASend
setsockopt
WSAIoctl
closesocket
WSAGetLastError
getaddrinfo
getsockname

crypt32

CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertGetCertificateChain
CertEnumCertificatesInStore
CertOpenStore
CertDuplicateStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext

psapi

GetModuleFileNameExW
GetPerformanceInfo

api-ms-win-crt-math-l1-1-0

pow
floor
trunc
round
__setusermatherr
ceil

api-ms-win-crt-string-l1-1-0

wcsncmp
_wcsicmp
wcslen
strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_seh_filter_exe
_exit
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_crt_atexit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
abort
_initialize_onexit_table
_register_onexit_function
terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc
_callnewh
_set_new_mode

Sections

.text
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10.8MB - Virtual size: 10.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 458KB - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc5e3d31fbe834ad41e53c0d442a2c39

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ntdll

kernel32

user32

comctl32

ole32

shell32

gdi32

dwmapi

iphlpapi

pdh

powrprof

oleaut32

netapi32

secur32

uxtheme

bcrypt

ws2_32

crypt32

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 7.5MB - Virtual size: 7.5MB

.rdata Size: 10.8MB - Virtual size: 10.8MB

.data Size: 13KB - Virtual size: 17KB

.pdata Size: 458KB - Virtual size: 458KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 271KB - Virtual size: 271KB

.reloc Size: 40KB - Virtual size: 40KB

.text
Size: 7.5MB - Virtual size: 7.5MB

.rdata
Size: 10.8MB - Virtual size: 10.8MB

.data
Size: 13KB - Virtual size: 17KB

.pdata
Size: 458KB - Virtual size: 458KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 271KB - Virtual size: 271KB

.reloc
Size: 40KB - Virtual size: 40KB