rulez-windows-x86_64[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
rulez-windows-x86_64.exe.zip
Size 3.1MB
Sample261102-ff2vdazzdy
SHA256 65de06f1c10a3b93ce0036caf34ca8b16b9e700ecdcd6e5bd84246dfb5c42b30
MD5 8596e238616a1462abe6f95fae53a734
SHA1 cb68e667015e5aeb095399c437c08de2346db672
SHA512 d9783d98b61617b91a5ff239c65ebbd150b88a667fb2d5e80a9e3b829f369c840bc8a3a06248dbc09a0b4317fff3fb8b0544a2c898767c51748e99fa27ec955f
SSDEEP 98304:bbK4g+pzbup8Zyz3ZM6z0qgNnJK2a24TmUE/J90b:bbK7+dup8Zy1tgqgG294KUqOb
TLSH
T117E533FE38810AC27315B110BFE545ECFB7A176516E01934384FA012756A8BD6E2BFB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/rulez.exe

File Explorer

rulez-windows-x86_64.exe.zip

.zip 3.1MB
rulez.exe

.exe 6.8MB

rulez-windows-x86_64.exe.zip

SHA256 65de06f1c10a3b93ce0036caf34ca8b16b9e700ecdcd6e5bd84246dfb5c42b30
MD5 8596e238616a1462abe6f95fae53a734
SHA1 cb68e667015e5aeb095399c437c08de2346db672
SHA512 d9783d98b61617b91a5ff239c65ebbd150b88a667fb2d5e80a9e3b829f369c840bc8a3a06248dbc09a0b4317fff3fb8b0544a2c898767c51748e99fa27ec955f
SSDEEP 98304:bbK4g+pzbup8Zyz3ZM6z0qgNnJK2a24TmUE/J90b:bbK7+dup8Zy1tgqgG294KUqOb
TLSH
T117E533FE38810AC27315B110BFE545ECFB7A176516E01934384FA012756A8BD6E2BFB6
MD5 SHA1 SHA512 SSDEEP TLSH

rulez.exe

IMPHASH a84f5e1c3783f807a74445e44d4c947f
SHA256 d213962cfb349161711b14f285684a586daa0bea8f3d9189e0d0831e57eb6a9b
MD5 f25d3b31fed5aa3d37c585f78d4693a8
SHA1 e64c4e7cde6452236ac14eb1fd8db4a87d355bb4
SHA512 3ac066f48fd697a1aee7ae14405f7c8113e2273b69830fd3c6730df7a5d5c9bc46c23ef7ddacd826670bdb7e8d19a0b6de3e9382459d6903a048ac74a9e0a6c0
SSDEEP 98304:TpzneTrs56OuJS+NBk4rBR8Y6flN28kJ827EDThuH+F2:TpaU6nmkBsTh0C
TLSH
T1CC763943F66291E9C069C074834A6233FA32B89D47357AEB57E44B313F65F906A3CB49
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5369244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rulez.pdb

bcryptprimitives

ProcessPrng

kernel32

ReadConsoleW GetFileInformationByHandle SetHandleInformation SetFileInformationByHandle CopyFileExW MoveFileExW CreateSymbolicLinkW CreateHardLinkW GetFileType ReadFileEx CreateEventW CancelIo CreateProcessW FindFirstFileExW WaitForMultipleObjects GetFullPathNameW CreateDirectoryW SetFileAttributesW UnregisterWaitEx WriteConsoleW GetConsoleOutputCP ReleaseMutex CreateMutexA WaitForSingleObjectEx GetCurrentThreadId SetFilePointerEx Sleep SetWaitableTimer CreateWaitableTimerExW DuplicateHandle GetCurrentProcess GetProcessHeap HeapFree QueryPerformanceCounter HeapReAlloc ExitProcess lstrlenW CreateProcessA GetSystemTimePreciseAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW AddVectoredExceptionHandler GetModuleFileNameW GetCommandLineW LocalFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA GetProcAddress WideCharToMultiByte MultiByteToWideChar HeapAlloc GetEnvironmentVariableW GetModuleHandleW FormatMessageW GetModuleHandleA QueryPerformanceFrequency CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW DeleteFileW CreateThread CreateFileW CancelIoEx GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx ReadFile WriteFile PostQueuedCompletionStatus GetOverlappedResult IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetFileTime SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterA GetFileInformationByHandleEx GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode GetStdHandle GetCurrentThread SetThreadStackGuarantee RegisterWaitForSingleObject WriteFileEx SleepEx GetCurrentProcessId GetExitCodeProcess WaitForSingleObject TerminateProcess CloseHandle SwitchToThread FindClose FindNextFileW GetLastError GetTempPathW GetFileAttributesW SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

WSACleanup WSAStartup recv getsockopt send getpeername WSAIoctl ioctlsocket WSASocketW setsockopt closesocket getaddrinfo shutdown bind freeaddrinfo connect getsockname WSAGetLastError WSASend

ntdll

NtCancelIoFileEx NtReadFile NtCreateFile NtWriteFile NtOpenFile NtDeviceIoControlFile RtlNtStatusToDosError NtCreateNamedPipeFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

vcruntime140

memset memcmp memcpy memmove __CxxFrameHandler3 __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

cbrt asin floor log1p log2 tanh round exp log10 log pow fmod trunc truncf acos sinh cosh exp2 __setusermatherr ceil tan _hypot sin atan cos atan2

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _set_app_type terminate _get_initial_narrow_environment _initterm _initterm_e exit _exit _seh_filter_exe _register_onexit_function _configure_narrow_argv _crt_atexit _initialize_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free