rulez-windows-x86_64[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
rulez-windows-x86_64.exe.zip
Size 3.1MB
Sample261102-ff3rnszzdz
SHA256 6438a1589719f399d8ddd249626c27081e464e26ac362fac1097c994699fae36
MD5 316525d7cf4fdb0359ee8786eb172c31
SHA1 06a827d13b1207d3fc939b1bced2315dd4c7a994
SHA512 ab08d6be68b99046851abd154b9cc8c3b9fa309f2e80ccf61ef784e9835771f8dfe3107e69310f85057baee2f509e46627d397c2c251744cf580cb03c16ed7d1
SSDEEP 98304:82i2Bln25URK94W9tHXj1oiyCjFyhOmVDWfEh:8xYl28K9xXBoi9y5wfY
TLSH
T174E53326AC24DB24738CB881692E17FD544A10FAE815112E7DEA4322A5C40D7FF76FDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/rulez.exe

File Explorer

rulez-windows-x86_64.exe.zip

.zip 3.1MB
rulez.exe

.exe 6.8MB

rulez-windows-x86_64.exe.zip

SHA256 6438a1589719f399d8ddd249626c27081e464e26ac362fac1097c994699fae36
MD5 316525d7cf4fdb0359ee8786eb172c31
SHA1 06a827d13b1207d3fc939b1bced2315dd4c7a994
SHA512 ab08d6be68b99046851abd154b9cc8c3b9fa309f2e80ccf61ef784e9835771f8dfe3107e69310f85057baee2f509e46627d397c2c251744cf580cb03c16ed7d1
SSDEEP 98304:82i2Bln25URK94W9tHXj1oiyCjFyhOmVDWfEh:8xYl28K9xXBoi9y5wfY
TLSH
T174E53326AC24DB24738CB881692E17FD544A10FAE815112E7DEA4322A5C40D7FF76FDB
MD5 SHA1 SHA512 SSDEEP TLSH

rulez.exe

IMPHASH 2f5e44ff64314fed1a324db65a659cff
SHA256 b0dda2bfa63345e05aed0a06da108ddc8e8da0db8955c81c93fa0ee063cb84ac
MD5 993e4e479de76189794bad2b7156c6fa
SHA1 b5d97c31775e62aea78d3dd7344316b672b98a03
SHA512 db4da57af7074fb633175d2df138495209e6ddf095de674c00b24294ecab03afbcf24322a7b852b389dfb07f65b7c0c9bf518daeef1799eb0fef65826c50ca7d
SSDEEP 98304:zGmrSBJ9MG2SR2v8zI/ujSTnWDbLWCw0WFVPH+:zm91bbpmFVv
TLSH
T1AD763943F66291E8C069C074835A6233FA72BC8947357AEB57E44B313F65F906A3CB49
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5369052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rulez.pdb

bcryptprimitives

ProcessPrng

kernel32

ReadConsoleW GetFileInformationByHandle SetHandleInformation SetFileInformationByHandle CopyFileExW MoveFileExW CreateSymbolicLinkW CreateHardLinkW GetFileType ReadFileEx CreateEventW CancelIo CreateProcessW FindFirstFileExW WaitForMultipleObjects GetFullPathNameW CreateDirectoryW SetFileAttributesW UnregisterWaitEx WriteConsoleW GetConsoleOutputCP ReleaseMutex CreateMutexA WaitForSingleObjectEx GetCurrentThreadId SetFilePointerEx Sleep SetWaitableTimer CreateWaitableTimerExW DuplicateHandle GetCurrentProcess GetProcessHeap HeapFree QueryPerformanceCounter HeapReAlloc ExitProcess lstrlenW CreateProcessA GetSystemTimePreciseAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW AddVectoredExceptionHandler GetModuleFileNameW GetCommandLineW LocalFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA GetProcAddress WideCharToMultiByte MultiByteToWideChar HeapAlloc GetEnvironmentVariableW GetModuleHandleW FormatMessageW GetModuleHandleA QueryPerformanceFrequency CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW DeleteFileW CreateThread CreateFileW CancelIoEx GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx ReadFile WriteFile PostQueuedCompletionStatus GetOverlappedResult IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetFileTime SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterA GetFileInformationByHandleEx GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode GetStdHandle GetCurrentThread SetThreadStackGuarantee RegisterWaitForSingleObject WriteFileEx SleepEx GetCurrentProcessId GetExitCodeProcess WaitForSingleObject TerminateProcess CloseHandle SwitchToThread FindClose FindNextFileW GetLastError GetTempPathW GetFileAttributesW SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

WSACleanup WSAStartup recv getsockopt send getpeername WSAIoctl ioctlsocket WSASocketW setsockopt closesocket getaddrinfo shutdown bind freeaddrinfo connect getsockname WSAGetLastError WSASend

ntdll

NtCancelIoFileEx NtReadFile NtCreateFile NtWriteFile NtOpenFile NtDeviceIoControlFile RtlNtStatusToDosError NtCreateNamedPipeFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

vcruntime140

memset memcmp memcpy memmove __CxxFrameHandler3 __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

cbrt cosh sinh atan tan log exp2 floor sin log10 atan2 fmod trunc truncf exp ceil log2 cos __setusermatherr tanh log1p _hypot acos asin round pow

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _set_app_type terminate _get_initial_narrow_environment _initterm _initterm_e exit _exit _seh_filter_exe _register_onexit_function _configure_narrow_argv _crt_atexit _initialize_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free