018979dd40d8b602d529ac860964292998da729838d1fdcde1efbfbb1ca0343b

Sharing

Copy URL Twitter E-mail

General

Target

018979dd40d8b602d529ac860964292998da729838d1fdcde1efbfbb1ca0343b
Size

211KB
MD5

b73b58873a1aa552da55763ae3045db0
SHA1

8f22c5268839f2541578d3890e65eed56d0f77ac
SHA256

018979dd40d8b602d529ac860964292998da729838d1fdcde1efbfbb1ca0343b
SHA512

b38b21c7302c1facfdfcdcedbcf9d0ad8acab5e63e28971b66d0010da9b7fa3e9e799b9944c8c30e6b71b0c32922a6babe2b78e97f78a3028c2feceb4ab936b8
SSDEEP

3072:YyYS/aXDG+cENJp9T0PBwKtuyus2rwDyV7T+WeXW5:lBA7zuJw1cSbH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
018979dd40d8b602d529ac860964292998da729838d1fdcde1efbfbb1ca0343b

Files

018979dd40d8b602d529ac860964292998da729838d1fdcde1efbfbb1ca0343b
.dll windows:4 windows x64 arch:x64

e57debc8e9ed2c6418bdfd307e4baeb6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

x64-msvcrt-ruby250

Sleep
clock_gettime
localtime_r
rb_alloc_tmp_buffer_with_count
rb_ary_new_capa
rb_ary_new_from_args
rb_ary_push
rb_backref_get
rb_backref_set
rb_block_given_p
rb_cFalseClass
rb_cFloat
rb_cInteger
rb_cNilClass
rb_cNumeric
rb_cObject
rb_cRational
rb_cSymbol
rb_cTime
rb_cTrueClass
rb_check_typeddata
rb_cmpint
rb_copy_generic_ivar
rb_cstr_to_inum
rb_data_typed_object_zalloc
rb_define_alloc_func
rb_define_class
rb_define_const
rb_define_method
rb_define_private_method
rb_define_singleton_method
rb_eArgError
rb_eTypeError
rb_enc_copy
rb_enc_dummy_p
rb_enc_get
rb_enc_sprintf
rb_enumeratorize_with_size
rb_error_arity
rb_error_frozen_object
rb_float_new
rb_float_value
rb_frame_this_func
rb_free_tmp_buffer
rb_funcallv
rb_gc_mark
rb_gc_register_mark_object
rb_gc_writebarrier
rb_hash_aref
rb_hash_aset
rb_hash_delete
rb_hash_new
rb_id2sym
rb_include_module
rb_int2big
rb_int_positive_pow
rb_intern
rb_intern2
rb_ll2inum
rb_mComparable
rb_marshal_load
rb_match_busy
rb_memhash
rb_num2dbl
rb_num2long
rb_num_coerce_cmp
rb_obj_class
rb_obj_freeze
rb_obj_is_kind_of
rb_raise
rb_rational_den
rb_rational_new
rb_rational_num
rb_reg_new
rb_reg_nth_match
rb_str_append
rb_str_cat
rb_str_dup
rb_str_format
rb_str_new
rb_str_new_cstr
rb_str_new_static
rb_str_to_inum
rb_string_value
rb_string_value_cstr
rb_sym2id
rb_sys_fail
rb_uint2big
rb_undef_method
rb_usascii_encoding
rb_usascii_str_new
rb_usascii_str_new_cstr
rb_usascii_str_new_static
rb_warning
rb_yield
round
ruby_malloc_size_overflow
ruby_scan_digits
ruby_snprintf
ruby_strtoul
ruby_xfree
ruby_xmalloc
strlcpy

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__iob_func
_amsg_exit
_difftime64
_errno
_initterm
_lock
_mktime64
_strnicmp
_time64
_timezone
_unlock
_tzset
abort
calloc
free
fwrite
isalpha
isspace
memchr
memcpy
memmove
memset
realloc
signal
strchr
strlen
strncmp
strspn
strtoul
tolower
vfprintf

Exports

Exports

Init_date_core

Sections

.text
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e57debc8e9ed2c6418bdfd307e4baeb6

Headers

File Characteristics

Imports

x64-msvcrt-ruby250

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 177KB - Virtual size: 177KB

.data Size: 1024B - Virtual size: 912B

.rdata Size: 16KB - Virtual size: 16KB

.pdata Size: 3KB - Virtual size: 3KB

.xdata Size: 4KB - Virtual size: 3KB

.bss Size: - Virtual size: 6KB

.edata Size: 512B - Virtual size: 78B

.idata Size: 6KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 336B

.text
Size: 177KB - Virtual size: 177KB

.data
Size: 1024B - Virtual size: 912B

.rdata
Size: 16KB - Virtual size: 16KB

.pdata
Size: 3KB - Virtual size: 3KB

.xdata
Size: 4KB - Virtual size: 3KB

.bss
Size: - Virtual size: 6KB

.edata
Size: 512B - Virtual size: 78B

.idata
Size: 6KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 336B