General

  • Target
    Mega_Hack_Installer_Setup.exe
  • Size 40.2MB
  • Sample260706-31n6caay2j
  • SHA256 8ce5796f81ded11eabb005f4cf717d160be89eeb8699da020ee74c0b67f02901
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • DLL Hijacking vulnerability 1 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • Mega_Hack_Installer_Setup.exe
    .exe 40.2MB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/modern-wizard.bmp
    25KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • $TEMP/VC_redist.x64.exe
    .exe 17.7MB
  • D3Dcompiler_47.dll
    .dll 4.0MB
  • Qt5Core.dll
    .dll 5.7MB
  • Qt5Gui.dll
    .dll 6.7MB
  • Qt5Network.dll
    .dll 1.3MB
  • Qt5Svg.dll
    .dll 322KB
  • Qt5Widgets.dll
    .dll 5.2MB
  • bearer/qgenericbearer.dll
    .dll 51KB
  • iconengines/qsvgicon.dll
    .dll 40KB
  • imageformats/qgif.dll
    .dll 38KB
  • imageformats/qicns.dll
    .dll 43KB
  • imageformats/qico.dll
    .dll 37KB
  • imageformats/qjpeg.dll
    .dll 411KB
  • imageformats/qsvg.dll
    .dll 31KB
  • imageformats/qtga.dll
    .dll 30KB
  • imageformats/qtiff.dll
    .dll 380KB
  • imageformats/qwbmp.dll
    .dll 29KB
  • imageformats/qwebp.dll
    .dll 498KB
  • libEGL.dll
    .dll 24KB
  • libGLESv2.dll
    .dll 3.2MB
  • libcrypto-1_1-x64.dll
    .dll 3.3MB
  • libssl-1_1-x64.dll
    .dll 676KB
  • mega-installer.exe
    .exe 613KB
  • opengl32sw.dll
    .dll 20.0MB
  • platforms/qwindows.dll
    .dll 1.4MB
  • styles/qwindowsvistastyle.dll
    .dll 140KB
  • translations/qt_ar.qm
    156KB
  • translations/qt_bg.qm
    161KB
  • translations/qt_ca.qm
    205KB
  • translations/qt_cs.qm
    170KB
  • translations/qt_da.qm
    177KB
  • translations/qt_de.qm
    215KB
  • translations/qt_en.qm
    33B
  • translations/qt_es.qm
    161KB
  • translations/qt_fi.qm
    175KB
  • translations/qt_fr.qm
    162KB
  • translations/qt_gd.qm
    185KB
  • translations/qt_he.qm
    135KB
  • translations/qt_hu.qm
    156KB
  • translations/qt_it.qm
    157KB
  • translations/qt_ja.qm
    126KB
  • translations/qt_ko.qm
    153KB
  • translations/qt_lv.qm
    150KB
  • translations/qt_pl.qm
    159KB
  • translations/qt_ru.qm
    198KB
  • translations/qt_sk.qm
    122KB
  • translations/qt_tr.qm
    189KB
  • translations/qt_uk.qm
    154KB
  • translations/qt_zh_TW.qm
    124KB

Mega_Hack_Installer_Setup.exe

  • IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
  • SHA256 8ce5796f81ded11eabb005f4cf717d160be89eeb8699da020ee74c0b67f02901
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Digest
96:ee:58:0c:6d:f4:57:11:d3:d6:8c:e1:e0:87:8e:7b:98:5a:d2:b3:6b:55:25:0b:3d:91:9c:c3:b7:a6:83:80
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=14540363,CN=Absolute Mods Ltd,O=Absolute Mods Ltd,ST=West Midlands,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Minor OS version
0
Major OS version
4
Entry point
13709
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths