FN[.]Rage loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FN.Rage loader.exe
Size 476KB
Sample260717-vsqefact2s
SHA256 b0f163957f3bf6dff10015814be3237f9ba6356805e318f5df2fb91b9b071d96
MD5 72ca4aef0374df058946cb0f0aca9a12
SHA1 54e10a9ee2990079db758f121a79b18495cd2260
SHA512 bf580373f2d1575087755b3eeb36a5830d0581265905fac4ec757a7d0e080912c8fc907c16556a8d29a8e82ba82a9db48a20008df25ef0d55bdd2ae5a78df9b0
SSDEEP 12288:PajaCZ9QUUFDnb+4QNKnEUxCj2AqeMQmELO:SjaCZRUFD6NKnEuGKFEL
TLSH
T113A4BF85B2E546E8E13BE078906AF72BE5753448072046C763E498687FF27D45EFB342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FN.Rage loader.exe

File Explorer

FN.Rage loader.exe

.exe 476KB

FN.Rage loader.exe

IMPHASH 8e7e19bdf75b199e355a7eb37e445265
SHA256 b0f163957f3bf6dff10015814be3237f9ba6356805e318f5df2fb91b9b071d96
MD5 72ca4aef0374df058946cb0f0aca9a12
SHA1 54e10a9ee2990079db758f121a79b18495cd2260
SHA512 bf580373f2d1575087755b3eeb36a5830d0581265905fac4ec757a7d0e080912c8fc907c16556a8d29a8e82ba82a9db48a20008df25ef0d55bdd2ae5a78df9b0
SSDEEP 12288:PajaCZ9QUUFDnb+4QNKnEUxCj2AqeMQmELO:SjaCZRUFD6NKnEuGKFEL
TLSH
T113A4BF85B2E546E8E13BE078906AF72BE5753448072046C763E498687FF27D45EFB342
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

288072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

kernel32

GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency CreateFileA FlushFileBuffers Sleep GetCurrentProcessId CreateThread VirtualAlloc MultiByteToWideChar WideCharToMultiByte GlobalUnlock SetConsoleTitleA GlobalAlloc GetCurrentThreadId TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimeAsFileTime InitializeSListHead

user32

SetCursorPos GetWindow GetWindowThreadProcessId FindWindowA SetWindowLongA GetWindowLongA GetWindowRect GetForegroundWindow UpdateWindow mouse_event GetAsyncKeyState SetWindowPos MoveWindow ShowWindow DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage LoadCursorA ScreenToClient ClientToScreen GetCursorPos OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetActiveWindow GetKeyState GetCapture SetCapture ReleaseCapture GetClientRect SetCursor

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

d3d9

Direct3DCreate9Ex

ntdll

RtlLookupFunctionEntry ZwCreateKey ZwSetValueKey ZwOpenKey ZwClose ZwQueryValueKey RtlVirtualUnwind RtlCaptureContext

xinput1_4

ord2

vcruntime140

memcmp __std_terminate strstr __current_exception_context memchr memcpy memmove memset __C_specific_handler __std_exception_copy __std_exception_destroy _CxxThrowException __current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy strlen isprint wcscpy_s wcslen strcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fwrite ftell fseek __stdio_common_vsnprintf_s __stdio_common_vsprintf_s fread __stdio_common_vsprintf _wfopen __acrt_iob_func __stdio_common_vsscanf _set_fmode __p__commode fclose fflush

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

powf asin tanf __setusermatherr pow atan2f fmodf sqrtf ceilf cosf floorf sinf

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _invoke_watson _initterm _get_initial_narrow_environment exit system _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function terminate _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _initterm_e

api-ms-win-crt-locale-l1-1-0

_configthreadlocale