RukiaPlayerLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RukiaPlayerLauncher.exe
Size 2.3MB
Sample261026-vd8mgafs71
SHA256 be92bd2f1719a42801efd678875061c824e21be01aec7ce9bf645585cb1fce7f
MD5 1fb237b9e506b3ba5f7cbadf63bc8205
SHA1 078466d3c632a7172551b0e9444e981ee2c819db
SHA512 e0278f60819cc74d0daf44a1effe785209a052fc234106c9777f281df1a69e945c25504d79cc1a1c2f27379a0abece8434d324b8d21f5b94f657e04b30e5cd80
SSDEEP 24576:NT3iR7BS6yRaIEcMcTGgPFpM3ydgtdVIwfslqj+Kr7lfux9qOnEK24GjqGlJ:NQVcMcTGYC3ydgtDZ6oJ
TLSH
T1D0B50911ED8F6AD8D461C2F9F425859C41FFAC21742161CA62883EC99AB3E43F724D7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RukiaPlayerLauncher.exe

File Explorer

RukiaPlayerLauncher.exe

.exe 2.3MB

RukiaPlayerLauncher.exe

IMPHASH d5c41485b5798096fbf2324f9ee1db13
SHA256 be92bd2f1719a42801efd678875061c824e21be01aec7ce9bf645585cb1fce7f
MD5 1fb237b9e506b3ba5f7cbadf63bc8205
SHA1 078466d3c632a7172551b0e9444e981ee2c819db
SHA512 e0278f60819cc74d0daf44a1effe785209a052fc234106c9777f281df1a69e945c25504d79cc1a1c2f27379a0abece8434d324b8d21f5b94f657e04b30e5cd80
SSDEEP 24576:NT3iR7BS6yRaIEcMcTGgPFpM3ydgtdVIwfslqj+Kr7lfux9qOnEK24GjqGlJ:NQVcMcTGYC3ydgtDZ6oJ
TLSH
T1D0B50911ED8F6AD8D461C2F9F425859C41FFAC21742161CA62883EC99AB3E43F724D7E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

325743

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Trunk2016\BootstrapperClient\bin\Release\RukiaPlayerLauncher.pdb

kernel32

GetTempPathW DeleteFileW GetVersionExW lstrcmpW GetProcAddress GetModuleHandleW GetModuleFileNameW WaitForSingleObject InterlockedDecrement ReleaseMutex CreateMutexW SetEvent ResetEvent OpenEventW CreateEventW CloseHandle CreateEventA SystemTimeToFileTime CreateWaitableTimerA ResumeThread OpenEventA SetEndOfFile WriteConsoleW SetStdHandle OutputDebugStringW SetFilePointer ReadConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP GetFileType GetStdHandle GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetStartupInfoW SetUnhandledExceptionFilter GetSystemTime GetLastError MultiByteToWideChar UnhandledExceptionFilter GetCPInfo AreFileApisANSI GetModuleHandleExW ExitProcess LoadLibraryExW ExitThread CreateThread IsProcessorFeaturePresent IsDebuggerPresent GetCommandLineW RtlUnwind DecodePointer EncodePointer GetStringTypeW HeapSize HeapReAlloc InitializeCriticalSectionAndSpinCount WideCharToMultiByte InterlockedIncrement LocalFree DeleteCriticalSection EnterCriticalSection LeaveCriticalSection FormatMessageA TlsAlloc InterlockedExchange WaitForMultipleObjects SetWaitableTimer SetLastError VerSetConditionMask VerifyVersionInfoW Sleep GetTickCount TlsGetValue TlsSetValue SizeofResource LockResource LoadResource FindResourceW FindResourceExW TlsFree GetModuleHandleA CreateSemaphoreA HeapAlloc GetProcessHeap HeapFree GetSystemTimeAsFileTime ReleaseSemaphore lstrlenW GetCurrentThreadId GetCurrentProcess GetCurrentThread DuplicateHandle LoadLibraryW FreeLibrary CreateProcessW RaiseException TerminateProcess GetUserGeoID GetGeoInfoW CompareFileTime FindFirstFileW FindNextFileW FindClose GetLocalTime OpenProcess CreateDirectoryW GetEnvironmentVariableW SetEnvironmentVariableW GetDiskFreeSpaceExW SetFileAttributesW RemoveDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetShortPathNameW FormatMessageW lstrcmpiW CreateFileW GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetCurrentProcessId MoveFileExW MulDiv GlobalFree WaitForSingleObjectEx GetExitCodeProcess ReadFile lstrcpyW lstrcatW WriteFile GetFileTime DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime HeapDestroy

user32

SetWindowLongW ShowWindow InvalidateRect GetParent CallWindowProcW SendMessageW GetWindowLongW AllowSetForegroundWindow CharNextW CharUpperW GetWindowRect DefWindowProcW MessageBoxA CreateWindowExW RegisterClassW GetWindowTextW PostMessageW SetForegroundWindow IsWindowVisible EnableWindow DestroyWindow KillTimer SetWindowTextW LoadAcceleratorsW GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW SetFocus SetWindowPos MessageBoxW PostThreadMessageW GetWindowThreadProcessId EnumWindows LoadImageW GetDC SetTimer GetDlgItem PostQuitMessage BeginPaint FillRect EndPaint DestroyIcon GetSystemMetrics ReleaseDC

gdi32

CreatePen SetBkMode CreateSolidBrush DeleteObject SetTextColor GetDeviceCaps Rectangle SetBrushOrgEx SetStretchBltMode SelectObject DeleteDC CreateCompatibleBitmap CreateCompatibleDC GetObjectW GetStockObject StretchBlt CreateFontW

advapi32

CryptCreateHash CopySid OpenProcessToken OpenThreadToken GetSidLengthRequired InitializeSid RegDeleteValueW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameW GetSidSubAuthority CheckTokenMembership DuplicateToken RegOpenKeyExA RegQueryValueExA IsValidSid GetTokenInformation CryptGetHashParam CryptHashData CryptDestroyHash CryptReleaseContext GetLengthSid CryptAcquireContextW RegFlushKey RegEnumKeyExW RegDeleteKeyW

shell32

ShellExecuteW SHGetFolderPathAndSubDirW SHChangeNotify ShellExecuteExW

ole32

CoInitialize CoCreateGuid CoCreateInstance CoUninitialize

oleaut32

VariantClear VariantInit RegisterTypeLi SysFreeString SysAllocString

shlwapi

StrRChrW StrCmpW StrStrW SHDeleteKeyW StrCmpNW PathFileExistsW PathAddBackslashW StrDupW StrCpyW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

ws2_32

WSAStartup WSACleanup

wininet

InternetConnectW InternetOpenW HttpQueryInfoW HttpEndRequestW InternetWriteFile HttpSendRequestExW InternetGetLastResponseInfoA InternetQueryOptionA InternetQueryOptionW InternetSetOptionW HttpAddRequestHeadersW HttpOpenRequestW InternetCloseHandle InternetQueryDataAvailable InternetReadFile InternetGetConnectedState HttpSendRequestW

sensapi

IsNetworkAlive

userenv

UnloadUserProfile

comctl32

_TrackMouseEvent InitCommonControlsEx

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpAddRequestHeaders WinHttpReadData WinHttpSetOption WinHttpSetStatusCallback WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpSetTimeouts WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpQueryHeaders

psapi

GetProcessImageFileNameW EnumProcesses

iphlpapi

GetAdaptersInfo

Name

.text

Size

463KB

Virtual Size

462KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RukiaPlayerLauncher.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

ws2_32

wininet

sensapi

userenv

comctl32

winhttp

psapi

iphlpapi

generic