�\���Bb����;�jZ,2��8������ NV"k1T˺O�(�Ji~�V?���}����s��_�`�v�y�`x�<yh�Nv�K�u�p 6�g%�=��R�m���h�i[�s,�����3�M��5v}�h6w�ӬW�a��թ!�%[� t��Mi�v����d�&��9�s�y������+xQ�t������`��]��adK߭(<��Z��V$�~pF�%hB��cF��b�2�y drE罊bo_���i|I���6�.�����_�TQv>�Ծr?!���ڟOq��B��G���^9��C�g��p�ue���1��5i&���r�à��}�D���p�?���u�&;�R�5����-���x2DD��<��tȤ�V�T+7P��� ��H������E9#c�pD$�әk�����9��PK�&�x��B��+��c�bx�D~\qr���y �5���cn�n�jl��kQ�U�.2�|�yJS?�����t�$����k�Cu&�skQ#������چ��U�wCr���gJ�1�7��y�l�}I#J6�F���]__���3�����ڻ�l֞}��^�F�z�T�'>�����%ө��a㮗}��v���I�:p���\�%�mB��[3����l�`��n��$t���g��$����&�1���L�a�����Zv�d|G��6��ϴ"�+����97�gw�$+�����#R�����,�|����E4�>8%�ۥ��lš�3�.�g��6-��y �'��AUiq������H�WG��_�H��-@�D�|��X�2,f�x��� ��4��'s����ii�=��m����@��b�DiQ�P&�?�l��vV�L�v^��T��X��O�;����y?��RKw4S^�p��uZ@�n�� ��' �Xڥ��x{��8�a�4�8MfT���=>:���xO���*�:%o�;R��,��$��rx�祂���8 +YI�k���wQR�t����-f��D>.N�]�69�{2�J�Ժa��������D'Y��)���]q`GV��n���|��e?��k�6tճ�������c��]�Y?b<X�J��� Y৴�:U9p����#�wR���i ��V@�cC����X $�JW[������5��0���o[��e���n�e��e�R���ש�$M��-"��F�P�w<e���\�(0�Q����9��������V�*��A�"N҂{x�ٍ������D�m��`V�%["�L����ُی���ƹ�t���4�p� �v��`S�����}�ΰf�ZE�n:�j��?F"lj�@�uF�����m�#�3H���W^�o�z���J���U����K���TІ�Q�ˑ�6)�o�9fOg�P�2�ߔ#4G�l����� Ҭʮ������ֽȇ�����}��[�bH�&�՝�$[��`4`1�����~��lx���P�ᆒI�I��"����X�l=D�m��:ё)�#" ��-��� ������6�=m�KG�l���Zg�ZT�vh�hy������E"�b�CCM���Dqq�1�PR.x�8�B_�װ�<�ϖ`�1D�� ��vE��L7���#\܋�sL鞓sf��Ϊ�J�RHЧ�����W�Rs �A�y� ��b�/#<1x4l f+��( I{���t �X�rr����O\v����#�*��']x��W�����X����-TfA@�{! ��F�No#:9.�|Z�'���m�[��XF���5}(x��X����x�l�� D��tx���Һ�*�ߚ@���[X���g6#�^��c�+JUZ�8�1R�^�p�Q�>��?�3P��7��H��q9�H�U���*��j.ZL>F��Mѩ����ԫ�P[p�vz�-��٣ߢe�-Θ�����$�����禱��@G��\�&��������-!g�� C�����1Ћ9c��K�h?��Q�ws�'oR���u ���W��u�_�,3,$+@�g�"��p����B�QwG�+m��|�?�jx&��Q��=��KB-�'qe f*�� UB�c�\��F�\�ʧ�+�<9\����o�KF�+O"��z+����M����!5Ԥ��W\�a�Z�(��6\,A�r�)�>R&ԇJd��zw\�k&E�XBA/y��Xs����]���������PH}S����� &)O_����Zº6^�nخ&�/DΙ�-%0�HVV9�a+�"C�������4��"r� �9�@�����_�Q�J!����H�Ąp�)�[ZN�Z��-N�`@���곗:����?J��[i�� �}ؓ�`� ��� .�g��3�G���X�����`��o�k}r���³P�V�7�h.cu�OUR@��K+}\���ٕ? ��~;���ͼڂz��W� O���Ӽ�YIO���������Oqx0!a�g�<0�ʹ� �%�K��떄�������� ���-�DE����w=e��zMo �ɠ�e��Z�@��,�k^��)>-o��������+�0"���++��ꞾP�yP5�u�� �Y蔻���S����آ����n}U?��W."�l�.�W��xt�˺��ԖWR��oD-�p�sGMf?��1|B =,��a$�X_T��f��Vyc����f���lE�`��d}I!�H�+?�j߄r�������U�s��Ű��ӂ�1�k���y��(U�H��6i|',3�@���_���koQ���~S�>�:��b7�Y����r.�Q2��T���^1{]5�����Fȅ�V���]�]�b_��1M�#/�LT:�n�8���Z{)�j��K쨷�*� |���3\9�D�~�K�y9��?HP`�\/�Ƃ�>A1�RD#������d1�@$�ُ9� ���h�Ñ�����������_��!]s%����c4DTH&9����&m��4���7gG�ɞ���I�#}�O�U�5s��9Zƹ��D��q����5=Y P��+�w�ị���ӆV��$�����������\�[
Behavioral task
behavioral1
Sample
RUBY STUFF.exe
Resource
win11-20240802-en
General
-
Target
RUBY STUFF.exe
-
Size
6.1MB
-
MD5
97c16fc90f8042fe7cfc8f9643c0060e
-
SHA1
3e1d822ba2a7a770a92fdd521cf7304e85771585
-
SHA256
19f8fe45d70804d09769198f25dc1a470a5fe194ff598b4edcf0a96e3dd051f4
-
SHA512
75fc9ee9763bcf643846c9d853072c14864c0686e8b09c45d806ecee243963f868272d155b508bab7f7553ab7d67c2a66f97d1915a7a14b29ad941175cbcfb6a
-
SSDEEP
196608:FtPO0qo8qaPCJNlteDoikCd2leK7muEDbx2qqI:4paJBeDhd2cKHxK
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RUBY STUFF.exe
Files
-
RUBY STUFF.exe.exe windows:6 windows x64 arch:x64
9a2a0bdac11016112338bec650230654
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
PeekNamedPipe
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CopySid
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
wininet
InternetOpenW
normaliz
IdnToAscii
wldap32
ord30
crypt32
CertFreeCertificateChainEngine
ws2_32
ntohs
shlwapi
PathFindFileNameW
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
_dupenv_s
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 729KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 835KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ