ragevip[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ragevip.zip
Size

171KB
MD5

b979d759d396c68229f5139c80910f05
SHA1

e58f57458ab06593da3eaa486ec17ae14a280794
SHA256

2cbb4f979428097dbae162712c71275cd3e76566bc4167f00e21831a0d95798c
SHA512

dc8a4380438580462770f06db2f69e1d5004539af638f700a1d3ef413dcd15cd972f9dd49eeef30eb0ffe6b3a2523b6f5b11fb5a5500317456895b2e8e6ef944
SSDEEP

3072:HeAhzA234eL3kq97n2PxqzYwiYjeKPdwekrkVVaA5DlW3qjU:HeEhJ1keyKPNVa4lZ4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/test.dll

Files

ragevip.zip
.zip
instructions.txt
test.dll
.dll windows:6 windows x64 arch:x64

ddd9fd50d7d2051e04f75fb2f0edb926

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Fortn\Desktop\rage\rage\x64\Release\test.pdb

Imports

kernel32

VirtualProtect
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
RtlLookupFunctionEntry
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlVirtualUnwind
RtlCaptureContext

user32

GetAsyncKeyState

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
__std_type_info_destroy_list
__C_specific_handler
__current_exception_context
__current_exception
memcpy
__std_exception_copy
__std_exception_destroy
memset

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

api-ms-win-crt-math-l1-1-0

cosf
round
sinf

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_invalid_parameter_noinfo_noreturn
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ddd9fd50d7d2051e04f75fb2f0edb926

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 73KB - Virtual size: 72KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 512B - Virtual size: 18KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 512B - Virtual size: 96B

.text
Size: 73KB - Virtual size: 72KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 512B - Virtual size: 18KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 512B - Virtual size: 96B