RageLoader_1[.]exe

Resubmissions

23/01/2024, 21:11

240123-z1vfksacf2 8

Sharing

Copy URL Twitter E-mail

General

Target

RageLoader_1.exe
Size

12.5MB
MD5

7f681fc56e3924cb503e858695210eed
SHA1

53cb9a05458444d4ef82d5366e216ee667a02661
SHA256

db1ee7c89a83f246cfd39d918ca9e39f4ee9a8c5bf0154cf45c291ec57d31c71
SHA512

0129835d7cb6f1d9234f3441a2b23d9e7c27d440f6c38d62c137a3d941597c54af3603f26cca12c137e05f5259ae8694152e421510438704fcca9f5e79e6f036
SSDEEP

393216:1eCNlK/bolScvK6BmshoBL9y8pcrSafQUzfwRM:DNlK/sYcCQh+XtahLw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RageLoader_1.exe

Files

RageLoader_1.exe
.exe windows:6 windows x64 arch:x64

6432af57dc7cce54abc48d28d4bca2a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeviceIoControl
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

ShowWindow
CharUpperBuffW

advapi32

CryptCreateHash

shell32

SHChangeNotify

mfc140

ord5539

shlwapi

PathRemoveFileSpecA

msvcp140

?_Xbad_function_call@std@@YAXXZ

ws2_32

getsockname

ntdll

RtlLookupFunctionEntry

wininet

InternetCloseHandle

normaliz

IdnToAscii

wldap32

ord35

crypt32

CertFreeCertificateChain

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-math-l1-1-0

_dclass

Sections

.text
Size: - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.the0
Size: - Virtual size: 9.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.the1
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.the2
Size: 12.5MB - Virtual size: 12.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

6432af57dc7cce54abc48d28d4bca2a2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

mfc140

shlwapi

msvcp140

ws2_32

ntdll

wininet

normaliz

wldap32

crypt32

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: - Virtual size: 600KB

.rdata Size: - Virtual size: 164KB

.data Size: - Virtual size: 5KB

.pdata Size: - Virtual size: 23KB

.the0 Size: - Virtual size: 9.9MB

.the1 Size: 6KB - Virtual size: 5KB

.the2 Size: 12.5MB - Virtual size: 12.5MB

.reloc Size: 512B - Virtual size: 208B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 600KB

.rdata
Size: - Virtual size: 164KB

.data
Size: - Virtual size: 5KB

.pdata
Size: - Virtual size: 23KB

.the0
Size: - Virtual size: 9.9MB

.the1
Size: 6KB - Virtual size: 5KB

.the2
Size: 12.5MB - Virtual size: 12.5MB

.reloc
Size: 512B - Virtual size: 208B

.rsrc
Size: 512B - Virtual size: 480B