General

Malware Config

Signatures

Files

• 20221212_adobehtml.zip

  .zip
• Scan_Dec12.lnk

  .lnk
• ragaxe/codXl.cmd
• ragaxe/offscouring.bin

  .dll windows x64

  f9dedfeda1e654e0c907f26f701683c4

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  advapi32

  AllocateAndInitializeSid

  CryptAcquireContextW

  CryptGenRandom

  CryptReleaseContext

  FreeSid

  GetSecurityInfo

  GetTokenInformation

  InitializeSecurityDescriptor

  OpenProcessToken

  OpenThreadToken

  SetEntriesInAclW

  SetSecurityDescriptorDacl

  kernel32

  CancelIo

  CloseHandle

  ConnectNamedPipe

  CreateEventW

  CreateFileW

  CreateNamedPipeW

  CreateProcessW

  CreateSemaphoreW

  DeleteCriticalSection

  DuplicateHandle

  EnterCriticalSection

  FreeLibrary

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetEnvironmentVariableA

  GetFileAttributesW

  GetLastError

  GetModuleFileNameA

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleExW

  GetModuleHandleW

  GetOverlappedResult

  GetProcAddress

  GetSystemDirectoryW

  GetSystemTimeAsFileTime

  GetTickCount

  GetVersionExW

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryW

  LocalAlloc

  LocalFree

  MultiByteToWideChar

  QueryPerformanceCounter

  RaiseException

  ReadFile

  ReleaseSemaphore

  RtlAddFunctionTable

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlUnwindEx

  RtlVirtualUnwind

  SetLastError

  SetNamedPipeHandleState

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  TransactNamedPipe

  UnhandledExceptionFilter

  VirtualProtect

  VirtualQuery

  WaitForMultipleObjects

  WaitForSingleObject

  WaitNamedPipeW

  WideCharToMultiByte

  WriteFile

  msvcrt

  ___lc_codepage_func

  __dllonexit

  __iob_func

  __mb_cur_max

  _amsg_exit

  _errno

  _exit

  _initterm

  _lock

  _onexit

  _snwprintf

  _strnicmp

  _unlock

  iswctype

  _write

  abort

  calloc

  fopen

  fputc

  fputs

  free

  fwprintf

  fwrite

  getenv

  isspace

  localeconv

  malloc

  memchr

  memcmp

  memcpy

  memmove

  memset

  raise

  realloc

  setlocale

  signal

  sprintf

  strchr

  strcmp

  strcoll

  strerror

  strftime

  strlen

  strncmp

  strrchr

  strtoul

  strxfrm

  towlower

  towupper

  vfprintf

  wcscoll

  wcscpy

  wcsftime

  wcslen

  wcsxfrm

  user32

  CloseDesktop

  CloseWindowStation

  CreateDesktopW

  CreateWindowStationW

  GetProcessWindowStation

  GetThreadDesktop

  GetUserObjectInformationW

  MessageBoxW

  SetProcessWindowStation

  Exports

  Exports

  hinpty_agent_process

  hinpty_conerr_name

  hinpty_config_free

  hinpty_config_new

  hinpty_config_set_agent_timeout

  hinpty_config_set_initial_size

  hinpty_config_set_mouse_mode

  hinpty_conin_name

  hinpty_conout_name

  hinpty_error_code

  hinpty_error_free

  hinpty_error_msg

  hinpty_free

  hinpty_open

  hinpty_set_size

  hinpty_spawn

  hinpty_spawn_config_free

  init

  Sections

  .text

  Size: 625KB - Virtual size: 625KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 70KB - Virtual size: 70KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 39KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 54KB - Virtual size: 53KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 5KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 1024B - Virtual size: 592B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ