2024-06-29_90274760ff54a7ef56563e7169423f36_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-29_90274760ff54a7ef56563e7169423f36_megazord
Size

16.6MB
MD5

90274760ff54a7ef56563e7169423f36
SHA1

f9745459a82e4967012e592a228b478142944b1a
SHA256

a9f296fefdc0f04c597ba9505e0c490bde987aa40873a5f11a19f4bfe27bcf38
SHA512

6e78bbe94defe3404b724d336a360243210d91c019bc6265265b466071a35172bfccb8105904b2fd97e3635074c725382a40d30309ac86e6fa789f5950052df6
SSDEEP

98304:wPbdJ6pq6XifMddKEV3c6dGElldntQDf7xzLr6gcwhgaDtSQCwApol+6++8UPGxd:0upPig3rGEu6kga9Zpub51

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-29_90274760ff54a7ef56563e7169423f36_megazord

Files

2024-06-29_90274760ff54a7ef56563e7169423f36_megazord
.exe windows:6 windows x64 arch:x64

5825e26d73e4194df4d3a71a8d9a76fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

schema_engine.pdb

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

bcryptprimitives

ProcessPrng

iphlpapi

GetAdaptersAddresses

kernel32

HeapFree
GetSystemTimePreciseAsFileTime
HeapReAlloc
GetSystemInfo
GetCommandLineW
SetLastError
GetModuleFileNameW
GetLastError
CloseHandle
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetStdHandle
GetConsoleMode
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetProcAddress
GetCurrentProcess
ReleaseMutex
RtlLookupFunctionEntry
GetCurrentThread
RtlCaptureContext
GetFileInformationByHandleEx
GetFileType
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
SetFilePointerEx
SwitchToThread
Sleep
GetModuleHandleA
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentDirectoryW
lstrlenW
GetEnvironmentVariableW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFullPathNameW
CreateDirectoryW
WideCharToMultiByte
ReadConsoleW
SetStdHandle
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
RtlVirtualUnwind
SetHandleInformation
PostQueuedCompletionStatus
CreateThread
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
FreeLibrary
SystemTimeToFileTime
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetEnvironmentVariableW
GetStringTypeW
GetConsoleOutputCP
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTimeZoneInformation
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

advapi32

RegCloseKey
CryptReleaseContext
RegOpenKeyExW
SystemFunction036
RegQueryValueExW

ntdll

RtlNtStatusToDosError
NtDeviceIoControlFile
NtCancelIoFileEx
NtWriteFile
NtCreateFile
NtReadFile

crypt32

CertDuplicateStore
CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateContext
CertGetCertificateChain
CertCloseStore
PFXImportCertStore
CryptAcquireCertificatePrivateKey
CryptStringToBinaryA
CertOpenStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCreateCertificateContext
CertDuplicateCertificateChain
CryptHashCertificate
CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

ws2_32

getsockopt
connect
ioctlsocket
socket
WSAGetLastError
WSAIoctl
closesocket
bind
WSASocketW
send
WSASend
shutdown
recvfrom
getaddrinfo
sendto
recv
getpeername
getsockname
WSACleanup
WSAStartup
freeaddrinfo
setsockopt

secur32

DecryptMessage
QueryContextAttributesW
FreeContextBuffer
InitializeSecurityContextW
AcceptSecurityContext
EncryptMessage
ApplyControlToken
FreeCredentialsHandle
AcquireCredentialsHandleA
DeleteSecurityContext

ncrypt

NCryptFreeObject

Sections

.text
Size: 11.9MB - Virtual size: 11.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 507KB - Virtual size: 506KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5825e26d73e4194df4d3a71a8d9a76fa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

iphlpapi

kernel32

advapi32

ntdll

crypt32

bcrypt

ws2_32

secur32

ncrypt

Sections

.text Size: 11.9MB - Virtual size: 11.9MB

.rdata Size: 4.1MB - Virtual size: 4.1MB

.data Size: 32KB - Virtual size: 39KB

.pdata Size: 507KB - Virtual size: 506KB

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 65KB - Virtual size: 64KB

.text
Size: 11.9MB - Virtual size: 11.9MB

.rdata
Size: 4.1MB - Virtual size: 4.1MB

.data
Size: 32KB - Virtual size: 39KB

.pdata
Size: 507KB - Virtual size: 506KB

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 65KB - Virtual size: 64KB