RAVEX[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RAVEX.exe
Size 353KB
Sample261003-ps4n6sdb82
SHA256 7236a03ba56e4cd012f245adc1c5218c0db0bac63195fd3f81f8a1f582c28b4e
MD5 1d2ad2f4a42e9ba700240e6f7a6f056a
SHA1 fbef5cc9ae937174bb886f5e73eedf5ddd9a47a1
SHA512 b3dc99a486326db722b2f186b0e9e508d225e2a2d9af2fe185a66ba33801c86d3b8abdbdb27950c47a3bde6a62c4fa783f5c063993c30a3e426822096b2bc91b
SSDEEP 6144:tEp1/q2pA25TV20q7H79MVZJy01lZ8aD7p:tEps2dhQ7HBQZh3fp
TLSH
T1C8747D15FB9414F9E177D578CDA24902E7727C4A4371AACF23E00A961F236E09E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RAVEX.exe

File Explorer

RAVEX.exe

.exe 353KB

RAVEX.exe

IMPHASH 2a7f89429f60d1523404137956dc140d
SHA256 7236a03ba56e4cd012f245adc1c5218c0db0bac63195fd3f81f8a1f582c28b4e
MD5 1d2ad2f4a42e9ba700240e6f7a6f056a
SHA1 fbef5cc9ae937174bb886f5e73eedf5ddd9a47a1
SHA512 b3dc99a486326db722b2f186b0e9e508d225e2a2d9af2fe185a66ba33801c86d3b8abdbdb27950c47a3bde6a62c4fa783f5c063993c30a3e426822096b2bc91b
SSDEEP 6144:tEp1/q2pA25TV20q7H79MVZJy01lZ8aD7p:tEps2dhQ7HBQZh3fp
TLSH
T1C8747D15FB9414F9E177D578CDA24902E7727C4A4371AACF23E00A961F236E09E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

89600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SetWindowPos DrawMenuBar GetSystemMenu DeleteMenu GetWindowLongW SetLayeredWindowAttributes SetWindowLongW

wininet

InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA

advapi32

RegDeleteTreeA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey GetTokenInformation OpenProcessToken ConvertSidToStringSidA

shell32

SHEmptyRecycleBinA

kernel32

GetEnvironmentStringsW FreeEnvironmentStringsW FindFirstFileExW FindClose SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize CreateFileW WriteConsoleW FindNextFileW GetCPInfo GetStdHandle ExpandEnvironmentStringsA CreateDirectoryA CreateFileA SetFileAttributesA SetFileTime WriteFile GetVolumeInformationA CloseHandle WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId CreateThread CreateProcessA FlushInstructionCache OpenProcess GetSystemTime VirtualProtectEx ReadProcessMemory WriteProcessMemory GetModuleFileNameA LocalFree GetComputerNameA SystemTimeToFileTime GetConsoleMode SetConsoleMode SetConsoleCP SetConsoleOutputCP GetConsoleScreenBufferInfo SetConsoleScreenBufferSize SetConsoleWindowInfo SetConsoleTitleA GetConsoleWindow K32EnumProcessModules K32GetModuleFileNameExA K32GetModuleInformation CreateToolhelp32Snapshot Process32First Process32Next WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW RtlUnwind SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead HeapReAlloc RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree GetExitCodeProcess CreateProcessW GetFileAttributesExW GetFileType VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP FlushFileBuffers GetConsoleOutputCP ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW

Name

.text

Size

241KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RAVEX.exe

user32

wininet

advapi32

shell32

kernel32

generic