1028.rar
- SHA256 6ddedcad95db1ff26704bdfffcbdb651ce48a80cac974ae3c121c2d2b75afdf8
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Env_DX8/MeGaShield.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Env_DX8/MeGaShield.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Env_DX9/MeGaShield.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Env_DX9/MeGaShield.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 1028.rar
- Size 766KB
- Sample260819-wxqrfazerg
- SHA256 6ddedcad95db1ff26704bdfffcbdb651ce48a80cac974ae3c121c2d2b75afdf8
- MD5 c6af90e05d67d741f92389f83e88e745
- SHA1 812f415ece1e462ecd4efaf1771f380025256052
- SHA512 eba6dbe13c7144a26fb60f24e5daff700a2aba58d300303933a8018111ea3cff8b30af5a3910d7c2038e3de761f2dbf83a01281fa887b67e02d488188ccc859f
- SSDEEP 12288:LkfCGddzmHiK7h9mnEt7GKKyXbH/kfCGddzmHiK7h9mnEt7GKKyXY+Z1:LyHcvt7hKyryHcvt7hKyIc
- TLSH T1EDF4237135F5CBCAEC573A444F32C08E856A428D286321D6C9A54979ECB403BCDEBB97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Env_DX8/MeGaShield.dll unpack001/Env_DX9/MeGaShield.dll
File Explorer
-
1028.rar.rar 766KB
-
Env_DX8/MeGaShield.dll.dll 1.3MB
-
Env_DX9/MeGaShield.dll.dll 1.3MB
Env_DX8/MeGaShield.dll
- IMPHASH bd98ea7c90f91ec9b4c91b1b09291e56
- SHA256 fac018bfb447f3a8d30f8f6bff25cf227814abcadb5fde10402d15317380bdba
- MD5 c578e6a1abf495a4611ac5cf0f014cdb
- SHA1 23c183c7c6b097c42d3ef12dd5bb270cad600336
- SHA512 956e6eddb56e331afd3090e65adfa26ede0da228ae74ef5433e3916ab746ac71473307f2f60fba7e07a2757e51a7f06669f6ac45434e094bf3adfbe8e40cacbf
- SSDEEP 24576:GfLqvCI8FU48h2CkChroO3xHcPFoMgTdGcYDCtTkwmoaL:GfL2ClFUbhrv5c+MgTdGcYDCtTjmlL
- TLSH T1C9553A01A7919138F9FB09B68EFE545E543CBD911B2884DB53C818DE4A39EE5BE30723
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
384768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Pezzi\Downloads\MeGa\MeGa\Loader_6609 - MeGa\Loader_6609 - MeGa\MeGaDLL\MeGaShield.pdb
ws2_32
ntohs
inet_ntop
getpeername
kernel32
CloseHandle
GetSystemDirectoryA
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep
InterlockedExchange
InterlockedCompareExchange
GetCurrentProcessId
GetLastError
WriteFile
ReadFile
PeekNamedPipe
CreateFileW
WaitNamedPipeW
VirtualProtect
WriteProcessMemory
GetModuleHandleW
TryEnterCriticalSection
GetTickCount
RtlCaptureStackBackTrace
InitOnceExecuteOnce
FlushInstructionCache
ReadProcessMemory
IsDebuggerPresent
lstrlenW
MultiByteToWideChar
InterlockedDecrement
FreeLibraryAndExitThread
DisableThreadLibraryCalls
GetModuleFileNameA
SetEvent
CreateEventW
Module32FirstW
Module32NextW
CreateDirectoryA
GetFileSize
InterlockedIncrement
QueryPerformanceCounter
QueryPerformanceFrequency
CreateFileA
OutputDebugStringA
FreeLibrary
LoadLibraryA
GetFileInformationByHandle
QueryFullProcessImageNameW
GetFileAttributesExW
TerminateProcess
DuplicateHandle
ReleaseMutex
CreateMutexA
GetEnvironmentVariableA
SetFileAttributesA
GetVolumeInformationA
GetComputerNameA
InterlockedPopEntrySList
ReleaseSemaphore
GetVersionExW
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
SetEndOfFile
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
ExitProcess
GetCurrentProcess
OpenProcess
GetFileAttributesW
GetModuleHandleExW
GetModuleFileNameW
GetCurrentThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleHandleA
GetProcAddress
VirtualQuery
VirtualFree
LoadLibraryW
VirtualAlloc
QueryDepthSList
UnregisterWaitEx
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
HeapQueryInformation
HeapSize
HeapReAlloc
HeapFree
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
CheckRemoteDebuggerPresent
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
VirtualProtectEx
VirtualQueryEx
SetLastError
LoadLibraryExA
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
SwitchToThread
GetExitCodeThread
EncodePointer
DecodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
HeapAlloc
HeapValidate
GetSystemInfo
GetStdHandle
GetFileType
WriteConsoleW
ExitThread
OutputDebugStringW
user32
GetWindowThreadProcessId
MonitorFromPoint
GetForegroundWindow
PostMessageA
MessageBoxA
SendInput
GetMonitorInfoA
GetSystemMetrics
GetTopWindow
ScreenToClient
GetWindow
SendMessageTimeoutA
FindWindowA
IsWindowVisible
GetClientRect
EnumDisplayDevicesW
GetWindowTextLengthA
GetWindowTextA
IsWindow
GetMessageW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
DispatchMessageW
TranslateMessage
GetWindowTextLengthW
advapi32
LookupPrivilegeValueA
RegCreateKeyExW
RegOpenKeyExW
RegGetValueA
RegOpenKeyExA
AdjustTokenPrivileges
OpenProcessToken
CryptAcquireContextA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegQueryValueExW
RegCloseKey
ole32
CoCreateGuid
psapi
EnumProcessModules
EnumProcesses
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleInformation
wtsapi32
WTSEnumerateProcessesW
WTSFreeMemory
winmm
timeGetTime
bcrypt
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
iphlpapi
GetAdaptersInfo
_DllMain@12
Name
.text
Size
947KB
Virtual Size
946KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
284KB
Virtual Size
284KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=172, id=243, version=40116,
count=34, id=242, version=40116,
count=118, id=261, version=26706,
count=34, id=260, version=26706,
count=24, id=259, version=26706,
count=3, id=225, productName=VS2013 build 21005, version=21005,
count=243, id=1, productName=Unmarked objects,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=32, id=261, version=27054,
count=2, id=260, version=27054,
count=1, id=256, version=27054,
count=1, id=255, version=27054,
count=1, id=151,
count=1, id=258, version=27054,
Env_DX9/MeGaShield.dll
- IMPHASH bd98ea7c90f91ec9b4c91b1b09291e56
- SHA256 fac018bfb447f3a8d30f8f6bff25cf227814abcadb5fde10402d15317380bdba
- MD5 c578e6a1abf495a4611ac5cf0f014cdb
- SHA1 23c183c7c6b097c42d3ef12dd5bb270cad600336
- SHA512 956e6eddb56e331afd3090e65adfa26ede0da228ae74ef5433e3916ab746ac71473307f2f60fba7e07a2757e51a7f06669f6ac45434e094bf3adfbe8e40cacbf
- SSDEEP 24576:GfLqvCI8FU48h2CkChroO3xHcPFoMgTdGcYDCtTkwmoaL:GfL2ClFUbhrv5c+MgTdGcYDCtTjmlL
- TLSH T1C9553A01A7919138F9FB09B68EFE545E543CBD911B2884DB53C818DE4A39EE5BE30723
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
384768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Pezzi\Downloads\MeGa\MeGa\Loader_6609 - MeGa\Loader_6609 - MeGa\MeGaDLL\MeGaShield.pdb
ws2_32
ntohs
inet_ntop
getpeername
kernel32
CloseHandle
GetSystemDirectoryA
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep
InterlockedExchange
InterlockedCompareExchange
GetCurrentProcessId
GetLastError
WriteFile
ReadFile
PeekNamedPipe
CreateFileW
WaitNamedPipeW
VirtualProtect
WriteProcessMemory
GetModuleHandleW
TryEnterCriticalSection
GetTickCount
RtlCaptureStackBackTrace
InitOnceExecuteOnce
FlushInstructionCache
ReadProcessMemory
IsDebuggerPresent
lstrlenW
MultiByteToWideChar
InterlockedDecrement
FreeLibraryAndExitThread
DisableThreadLibraryCalls
GetModuleFileNameA
SetEvent
CreateEventW
Module32FirstW
Module32NextW
CreateDirectoryA
GetFileSize
InterlockedIncrement
QueryPerformanceCounter
QueryPerformanceFrequency
CreateFileA
OutputDebugStringA
FreeLibrary
LoadLibraryA
GetFileInformationByHandle
QueryFullProcessImageNameW
GetFileAttributesExW
TerminateProcess
DuplicateHandle
ReleaseMutex
CreateMutexA
GetEnvironmentVariableA
SetFileAttributesA
GetVolumeInformationA
GetComputerNameA
InterlockedPopEntrySList
ReleaseSemaphore
GetVersionExW
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
SetEndOfFile
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
ExitProcess
GetCurrentProcess
OpenProcess
GetFileAttributesW
GetModuleHandleExW
GetModuleFileNameW
GetCurrentThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleHandleA
GetProcAddress
VirtualQuery
VirtualFree
LoadLibraryW
VirtualAlloc
QueryDepthSList
UnregisterWaitEx
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
HeapQueryInformation
HeapSize
HeapReAlloc
HeapFree
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
CheckRemoteDebuggerPresent
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
VirtualProtectEx
VirtualQueryEx
SetLastError
LoadLibraryExA
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
SwitchToThread
GetExitCodeThread
EncodePointer
DecodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
HeapAlloc
HeapValidate
GetSystemInfo
GetStdHandle
GetFileType
WriteConsoleW
ExitThread
OutputDebugStringW
user32
GetWindowThreadProcessId
MonitorFromPoint
GetForegroundWindow
PostMessageA
MessageBoxA
SendInput
GetMonitorInfoA
GetSystemMetrics
GetTopWindow
ScreenToClient
GetWindow
SendMessageTimeoutA
FindWindowA
IsWindowVisible
GetClientRect
EnumDisplayDevicesW
GetWindowTextLengthA
GetWindowTextA
IsWindow
GetMessageW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
DispatchMessageW
TranslateMessage
GetWindowTextLengthW
advapi32
LookupPrivilegeValueA
RegCreateKeyExW
RegOpenKeyExW
RegGetValueA
RegOpenKeyExA
AdjustTokenPrivileges
OpenProcessToken
CryptAcquireContextA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegQueryValueExW
RegCloseKey
ole32
CoCreateGuid
psapi
EnumProcessModules
EnumProcesses
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleInformation
wtsapi32
WTSEnumerateProcessesW
WTSFreeMemory
winmm
timeGetTime
bcrypt
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
iphlpapi
GetAdaptersInfo
_DllMain@12
Name
.text
Size
947KB
Virtual Size
946KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
284KB
Virtual Size
284KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=172, id=243, version=40116,
count=34, id=242, version=40116,
count=118, id=261, version=26706,
count=34, id=260, version=26706,
count=24, id=259, version=26706,
count=3, id=225, productName=VS2013 build 21005, version=21005,
count=243, id=1, productName=Unmarked objects,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=32, id=261, version=27054,
count=2, id=260, version=27054,
count=1, id=256, version=27054,
count=1, id=255, version=27054,
count=1, id=151,
count=1, id=258, version=27054,