Rage.zip
- SHA256 eb71e0e4019f774df6dcb4c7a34bdb34a3a54b89000fc4098add455b39367c0b
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Rage.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Rage.zip
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
hookloader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
hookloader.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
teox.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
teox.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target Rage.zip
- Size 322KB
- Sample260805-ph79lsag85
- SHA256 eb71e0e4019f774df6dcb4c7a34bdb34a3a54b89000fc4098add455b39367c0b
- MD5 326fbd20b4c666039f5dbebacb472e65
- SHA1 e9d4d9b997fbb67a4845895dc8f6ae767cdce735
- SHA512 e899d0dbee81769c99198e2ac9097a2e87cdf2e2526a7dce7ea71dfb3e664d148c78483108c360d92939eb90c6a309ccc1618069d77196f29f78ddb1de677613
- SSDEEP 6144:Q/GxKETOgJdCyiZ4ttOV3p+v0p68Z/CMftHka8YkgGghsRZ/xCYDM3em:QmR6IRiZ6OV3p+vO6zMFHkpIYI3V
- TLSH T1816423DC94BC9B821E9FB5B3C61584F6C81BA11A1DDB686CF10DF9B421DC7E018768C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/hookloader.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/teox.dll
File Explorer
-
Rage.zip.zip 322KB
-
hookloader.exe.exe 37KB
-
teox.dll.dll 688KB
hookloader.exe
- IMPHASH 085deee82875fe85e38462e30bb8a21c
- SHA256 4f3936ac7a90cb01a454780990bde67a4ee78ab2a6ad81894ecd36f6d4a82c7d
- MD5 eba73e4f21a0b764380f73d030fa5e05
- SHA1 f97b641b04885167167514493992a06830c499e3
- SHA512 cb070095fa9f107a21b8d7b419d27f14ee857a35e5a585aac80c39ccf3eec46429df78bc5755d6f9efcd216c57d038b535988f6e64fe6589a807935aec2b66c4
- SSDEEP 768:WkFFw7Zfg/bzGHG+3TchDrYg8EnKI6iNFFc37w:VUgjVrYX2rNFFAw
- TLSH T107033A6A675904E8F067D2BCDA961A05D7B6B80A0752EBCF1381A20E0F772C92D7FD40
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Mehmet\Desktop\hookloader\output\hookloader.pdb
dbghelp
ImageDirectoryEntryToData
kernel32
FormatMessageA
LocalFree
SetConsoleTextAttribute
SetConsoleScreenBufferSize
GetStdHandle
SetConsoleMode
SetConsoleWindowInfo
GetConsoleScreenBufferInfoEx
GetModuleHandleA
GetConsoleMode
SetConsoleScreenBufferInfoEx
LoadLibraryA
GetProcAddress
SetConsoleCP
FreeLibrary
GetConsoleWindow
SetConsoleOutputCP
SetConsoleTitleW
LoadLibraryExW
GetLastError
GetLocaleInfoEx
FindClose
FindFirstFileW
GetModuleHandleW
GetFileInformationByHandleEx
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
AreFileApisANSI
CreateFile2
CloseHandle
GetFileAttributesExW
user32
GetWindowLongPtrW
SendMessageW
SetWindowLongPtrW
SetWindowPos
ShowScrollBar
GetWindowThreadProcessId
FindWindowW
msvcp140
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
memset
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memcpy
memmove
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argc
system
_register_onexit_function
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
terminate
_exit
_initialize_onexit_table
abort
__p___argv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-string-l1-1-0
strlen
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35721,
count=10, id=260, version=35721,
count=27, id=261, version=35721,
count=6, id=257, version=35721,
count=7, id=257, version=33145,
count=155, id=1, productName=Unmarked objects,
count=1, id=265, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,
teox.dll
- IMPHASH 37aad9283eda5636a433fbaf1fe9aee6
- SHA256 7a6a2dcc842890752ef47673ad74f506e2aac29f8e5869f341fddd782fe1486b
- MD5 2b9bf01a0380e281e7fe670e8accac3b
- SHA1 e1417e812090cd22f9566396ec21e87001d949f3
- SHA512 7406b97793db27dac13f052096ebe0e5a7818a1eeb38b2b0a3b73efe69502544550ae1910f3fd0a86ec47df1599837d81a37d810d76c56c5538517b4ef28aa4f
- SSDEEP 12288:ZVUWnIhICncHo4ngyBtAPKSr4SzY0EVjQ1GZYWiu:ZuWneICncHo4nj6KSLzYC0ZPiu
- TLSH T1BCE46B45A3E8119DF1B3EA76D9B25611EAB27C850B70E5EF03A0489D1F377E0963B312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
b5:7e:c7:c9:2f:61:d7:59:c9:48:1d:63:8b:a2:85:5a:f8:fd:d2:e1:fc:75:ca:20:fb:48:07:1a:5b:61:6d:dd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN
Chains
Aug 5, 2026
CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN
Subject
CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN
Serial Number
28:77:79:fb:66:62:61:cb:73:17:47:92:9a:62:17:70
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 13, 2017 - Oct 13, 2018
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
299280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\ASRock\Desktop\memo\Wechsen Paste\dvn\project\x64\Release\wechsen.pdb
kernel32
VirtualQuery
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileW
GetFileAttributesW
WriteFile
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetLocalTime
GetTickCount
VirtualProtect
WideCharToMultiByte
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
HeapReAlloc
GetOEMCP
GetTickCount64
VirtualAlloc
GetACP
IsValidCodePage
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
LocalFree
FormatMessageA
GetLocaleInfoEx
GetLastError
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
GetStringTypeW
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
InterlockedFlushSList
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CreateThread
ExitThread
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
IsProcessorFeaturePresent
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleFileNameW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
LoadLibraryExW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
RtlUnwind
user32
GetAsyncKeyState
GetKeyboardState
MessageBoxW
GetActiveWindow
CallNextHookEx
GetKeyNameTextA
ScreenToClient
GetCursorPos
GetSystemMetrics
MapVirtualKeyW
ToUnicode
advapi32
GetUserNameW
shell32
SHGetFolderPathA
wininet
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetOpenA
winmm
PlaySoundW
teox_hook
Name
.text
Size
474KB
Virtual Size
474KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
172KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
441KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=176, id=261, version=33145,
count=28, id=260, version=33145,
count=20, id=259, version=33145,
count=10, id=259, version=35721,
count=14, id=260, version=35721,
count=85, id=261, version=35721,
count=13, id=257, version=33145,
count=163, id=1, productName=Unmarked objects,
count=4, id=261, version=36252,
count=1, id=259, version=36252,
count=1, id=256, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,