rulez-windows-x86_64[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
rulez-windows-x86_64.exe.zip
Size 3.1MB
Sample261102-ff4nzaeb37
SHA256 52a8bfeb4d59a28699a56d32f53079855a5f5782ec52597063a6d2719dc2efd9
MD5 2729379bc8c408613f479f64517aaf92
SHA1 f026172fcd7683363bf59ea1c7e6d0fa633fe07e
SHA512 9e07c1579e852a635d9b66a73c4ec6553a9a4eb06212a0f8a2c7d2f2b634cfcaabfaf8db96a4f19a4838c48ee57185f1e9c3e22c7459c671577f459f4cacf647
SSDEEP 98304:UQgRCaXYDl2XfGj408CbDK+fStkVntyvAI2f5AnVd+M28:nhlrjT9zskVtDI+iVUk
TLSH
T1CAE53377D12A62774F0EEFC2A7448726F098C192B86C55A8F5F248A56D0B9FC0EB113D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/rulez.exe

File Explorer

rulez-windows-x86_64.exe.zip

.zip 3.1MB
rulez.exe

.exe 6.8MB

rulez-windows-x86_64.exe.zip

SHA256 52a8bfeb4d59a28699a56d32f53079855a5f5782ec52597063a6d2719dc2efd9
MD5 2729379bc8c408613f479f64517aaf92
SHA1 f026172fcd7683363bf59ea1c7e6d0fa633fe07e
SHA512 9e07c1579e852a635d9b66a73c4ec6553a9a4eb06212a0f8a2c7d2f2b634cfcaabfaf8db96a4f19a4838c48ee57185f1e9c3e22c7459c671577f459f4cacf647
SSDEEP 98304:UQgRCaXYDl2XfGj408CbDK+fStkVntyvAI2f5AnVd+M28:nhlrjT9zskVtDI+iVUk
TLSH
T1CAE53377D12A62774F0EEFC2A7448726F098C192B86C55A8F5F248A56D0B9FC0EB113D
MD5 SHA1 SHA512 SSDEEP TLSH

rulez.exe

IMPHASH c787d52a0518929623b96129abda1e33
SHA256 daf635459fa455920a6ff519a0a5fc960793bcb3bb65a5d29a46a2e242976d22
MD5 65eb5ae67ee99f737666286774a98d2d
SHA1 6ae4cb2046f3ed738572c92921ab5589ef8adec4
SHA512 9e15fb68683a4fe87b09fad3f24f49959f3cb47981f75ac6fae4081db534277b185668bbae2132ad2e388efe058192c922c64ffc791b03d580c8f8e263e214c9
SSDEEP 98304:2SXPUppKNN0rA/4KqFRwUwjJGK771VCsWBM5cfAH+P:2mP1Gi7aI5cOi
TLSH
T130763943F66291E9C069C074834A6233FA72BC8947357AEB57E44B313F65F906A3CB49
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5369052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rulez.pdb

bcryptprimitives

ProcessPrng

kernel32

ReadConsoleW GetFileInformationByHandle SetHandleInformation SetFileInformationByHandle CopyFileExW MoveFileExW CreateSymbolicLinkW CreateHardLinkW GetFileType ReadFileEx CreateEventW CancelIo CreateProcessW FindFirstFileExW WaitForMultipleObjects GetFullPathNameW CreateDirectoryW SetFileAttributesW UnregisterWaitEx WriteConsoleW GetConsoleOutputCP ReleaseMutex CreateMutexA WaitForSingleObjectEx GetCurrentThreadId SetFilePointerEx Sleep SetWaitableTimer CreateWaitableTimerExW DuplicateHandle GetCurrentProcess GetProcessHeap HeapFree QueryPerformanceCounter HeapReAlloc ExitProcess lstrlenW CreateProcessA GetSystemTimePreciseAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW AddVectoredExceptionHandler GetModuleFileNameW GetCommandLineW LocalFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA GetProcAddress WideCharToMultiByte MultiByteToWideChar HeapAlloc GetEnvironmentVariableW GetModuleHandleW FormatMessageW GetModuleHandleA QueryPerformanceFrequency CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW DeleteFileW CreateThread CreateFileW CancelIoEx GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx ReadFile WriteFile PostQueuedCompletionStatus GetOverlappedResult IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetFileTime SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterA GetFileInformationByHandleEx GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode GetStdHandle GetCurrentThread SetThreadStackGuarantee RegisterWaitForSingleObject WriteFileEx SleepEx GetCurrentProcessId GetExitCodeProcess WaitForSingleObject TerminateProcess CloseHandle SwitchToThread FindClose FindNextFileW GetLastError GetTempPathW GetFileAttributesW SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

WSACleanup WSAStartup recv getsockopt send getpeername WSAIoctl ioctlsocket WSASocketW setsockopt closesocket getaddrinfo shutdown bind freeaddrinfo connect getsockname WSAGetLastError WSASend

ntdll

NtCancelIoFileEx NtReadFile NtCreateFile NtWriteFile NtOpenFile NtDeviceIoControlFile RtlNtStatusToDosError NtCreateNamedPipeFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

vcruntime140

memset memcmp memcpy memmove __CxxFrameHandler3 __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

ceil acos cbrt log1p _hypot sinh tanh log round exp2 atan2 fmod trunc truncf log2 asin log10 cosh __setusermatherr cos exp sin tan atan floor pow

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _set_app_type terminate _get_initial_narrow_environment _initterm _initterm_e exit _exit _seh_filter_exe _register_onexit_function _configure_narrow_argv _crt_atexit _initialize_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free