ruby_loader (1)[.]exe

Resubmissions

09/08/2026, 22:39

260809-2ldwdscg647

09/08/2026, 22:37

260809-2jz1vazxcx7

Sharing

Copy URL Twitter E-mail

General

Target
ruby_loader (1).exe
Size 327KB
Sample260809-2ldwdscg64
SHA256 af59320d8c76807feaabd807e6650090feea4f7429b28d860d130d67e81b475e
MD5 f894f4eccf307fec041ca9c2cb41b0ab
SHA1 a5e10017ab21831d11b00cd7fe4556cef1dcfe2f
SHA512 94bf7d6a1286f2b16bb4beb08b6b4b90a8e19f2d534cec8181d3c2800721c9a114c8fb959b9e3c99b7bc2f6c9eb07cf991c9d66a8b4e6feac37fe8662517f542
SSDEEP 6144:CM9G4rkNCAjnLw+jrR4c63+oS0r5UzVbdz5t9XHx:JIjLwh93+oS0KBXHx
TLSH
T1CD648D69F7A414F9E2B7C17CCD524506DAB2BC060761ABCF23A04A963F236D49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ruby_loader (1).exe

File Explorer

ruby_loader (1).exe

.exe 327KB

ruby_loader (1).exe

IMPHASH 39500d400468220a2b85eae4f52ee0fc
SHA256 af59320d8c76807feaabd807e6650090feea4f7429b28d860d130d67e81b475e
MD5 f894f4eccf307fec041ca9c2cb41b0ab
SHA1 a5e10017ab21831d11b00cd7fe4556cef1dcfe2f
SHA512 94bf7d6a1286f2b16bb4beb08b6b4b90a8e19f2d534cec8181d3c2800721c9a114c8fb959b9e3c99b7bc2f6c9eb07cf991c9d66a8b4e6feac37fe8662517f542
SSDEEP 6144:CM9G4rkNCAjnLw+jrR4c63+oS0r5UzVbdz5t9XHx:JIjLwh93+oS0KBXHx
TLSH
T1CD648D69F7A414F9E2B7C17CCD524506DAB2BC060761ABCF23A04A963F236D49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpConnect WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReadData WinHttpReceiveResponse WinHttpQueryHeaders

bcrypt

BCryptCloseAlgorithmProvider BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptCreateHash BCryptOpenAlgorithmProvider

kernel32

SetEndOfFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW CloseHandle GetLastError WaitForSingleObject Sleep TerminateProcess CreateProcessW OpenProcess lstrcmpiW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetModuleHandleW GetProcAddress MoveFileExW GetFileInformationByHandleEx WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW RtlUnwind GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree GetExitCodeProcess HeapAlloc SetEnvironmentVariableW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

Name

.text

Size

223KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ruby_loader (1).exe

winhttp

bcrypt

kernel32

shell32

ole32

generic